NXP Data Protection Terms

Appendix A: NXP and Supplier Act as 'Controllers'

1. STANDARD CONTRACTUAL CLAUSES

When there is a transfer of Personal Data, pursuant to the GDPR, to a Supplier located outside of the European Economic Area whilst there is no adequacy decision or any other transfer mechanism in place, the Standard Contractual Clauses Module 1 will apply. In all other instances, Section 2 of Appendix A of these DPTs, 'Controller to Controller' will apply.

Specifically, the following deviations to the Model 1 SCCs will apply:

• Clause 7 (Docking Clause): Not Applicable.
• Clause 17 (Governing Law): The SCCs shall be governed by the law of The Netherlands.
• Clause 18 (Choice of forum and jurisdiction), sub-section (b): The choice of forum and jurisdiction shall be the courts of The Netherlands.
• ANNEX I.A (List of Parties): Specified in PO.
• ANNEX I.B (Description of Transfer): Specified in PO.
• ANNEX I.C (Competent Supervisory Authority): Autoriteit Persoonsgegevens (Netherlands) NXP HQ is based in the Netherlands.
• ANNEX II (Technical and Organisational Measures): Specified in APPENDIX C.

2. CONTROLLER TO CONTROLLER

For the performance of the Services each Party will solely be responsible and comply with their respective obligations under Data Protection Laws relating to the Processing of Personal Data in force during the term the Service is being provided. In furtherance of this commitment, the Parties undertake to:

1. handle Personal Data relating to individuals, only if this Personal Data has been collected and processed fairly and lawfully;
2. ensure that they have duly informed the individual whose Personal Data is being processed in accordance with the Data Protection Laws and have established a valid legal basis, in particular with regard to the processing made by the Parties for the purposes of the Service;
3. where applicable, ensure individuals whose Personal Data is being processed can exercise their data protection rights;
4. process Personal Data only for the purposes strictly necessary for the provisioning of the Service;
5. if required to share with third parties, to share the Personal Data only with third parties who offer the same guarantees as those defined herein;
6. safeguard the transfer of the Personal Data to any other country by means of required data transfer mechanisms, and specifically in the case the Supplier is located within the European Economic Area, to refrain from transferring Personal Data to third parties located outside the European Economic Area unless:
   1. the Supplier and the third party have entered into the appropriate EU Standard Contractual Clauses,
   2. the Parties have implemented binding corporate rules that have received European approval and that cover all Personal Data that Parties will receive in their capacity of Controller,
   3. the countries where Parties will process such Personal Data have received a binding adequacy decision by the European Commission, or
   4. another validly executed transfer mechanism applies to the transfer of Personal Data to such countries that have not received a binding adequacy decision by the European Commission;
7. implement technical and organizational measures to ensure an adequate level of protection of the Personal Data, which are no less protective than those stipulated in Appendix C; and
8. delete the Personal Data when it is no longer necessary for the purposes of the Services, or at the request of the Party which provided it.

Appendix C: Technical and Organisational Measures ("TOMs")

1. Security Policy and Counsellor, Supervision, Inspection and Maintenance

The Supplier puts in place - inter alia - the following measures:

• A written policy in relation to data security, giving a precise description of the security strategies and protection features for Data security. The security policy considers the real risks the Data is exposed to. It includes a description of how to manage security incidents, a description of the awareness raising process for the policy within the organization and a description of the various responsibilities and organizational rules. It also specifies the measures foreseen in keeping the security system up to date after installation.
• An approved security policy by the relevant persons in charge and which has been adequately disseminated within the organization. A reassessment of the technical and organizational measures is performed on a regular basis in order to assure that the initial goals and the measures taken remain up to date so that improvements can be made if necessary. In case of reorganization or modification of infrastructure, security controls are updated. The security policy will be adapted where necessary as a result of modifications or reassessment.
• Information classification procedures. Whenever necessary, an inventory can be drawn up and all Data being Processed can be localized, irrespective of the type of data carrier.

2. Organization and Human Aspects of Security

The Supplier puts in place - inter alia - the following measures:

• Sufficient and adequate organizational, technical and financial resources to organize security,
• A security counsellor appointed by the Supplier, who is in charge of the implementation of the security policy. The security counsellor possesses the necessary competences, is adequately trained and will not be able to discharge any function or take up any responsibility that is incompatible or conflicting with that of a security counsellor,
• Guidelines on Data protection disseminated within the organization in order to ensure that all employees accessing Data are sufficiently informed about their duties and responsibilities during any operations, and
• Necessary measures for background verifications and checks before recruiting personnel.

3. Access Control to Premises and Facilities (Physical)

The Supplier puts in place - inter alia - the following measures to avoid the access of unauthorized persons or authorities to the carriers of Data and computer systems by which the Data is accessed or used:

• By formal/technical access procedures, the access to the premises and facilities involving data centers is regulated.
• All persons or authorities have to identify themselves in front of the security staff to gain access to a premise and facility or to certain areas of the premise and facility. This requires an identity card issued by the Supplier. There are documented processes for the issuance of identity cards by the Supplier. The ownership and the return of this identity card is followed and examined according to the defined process.
• Records of visitors are made. Visitors are provided with temporary identity cards and have to be accompanied by an employee of the Supplier to gain access to areas behind the reception area of a premise and facility.
• Only authorized employees and contracting parties who are constantly employed in the premise and facility have the right to get electronic access cards for these institutions.
• The standardized security measures which also exist and are carried out in each premise and facility are composed of known technologies and follow generally recognized "best practices" of the sector. Electronic access control systems by card access, alarm systems, cameras for the interior and the exterior and security staff are part of this. The equipment is inspected on a regular basis.

4. Access Control to Systems and Data (Logical)

The Supplier puts in place - inter alia - the following measures to avoid the use by unauthorized persons or authorities of equipment by which Data could be accessed:

• Secured access connections and technologies for the authentication control are implemented to regulate the access to the systems and internal support-tools.
• Technics for encryption are used to secure user authentications.
• A formal process is followed to permit the access to the resources or to deny it. Unique login names, strong passwords and periodic examinations of the access lists are existent to guarantee the appropriate use of user accounts. For critical systems, passwords for one use and/or accounts for only one use are applied.
• All groups which have access to the services are controlled by a regular examination. All named measures are described in a formalized concept of authorization.
• The Supplier ensures (i) Data in the systems can only be accessed by authorized individuals according to their access privileges and (ii) that the unauthorized reading, copying, printing, change or deletion of Data is excluded during use, Processing or after the storing of Data.
• The granting of access rights is based on the job responsibilities of the user and on a need-to-know basis and has to be authorized and granted by the corresponding supervisor of the person who makes a request for it.
• The access to production systems is only granted to users who are periodically trained and authorized for performing administrative action. The access to production systems is also immediately withdrawn in case of a termination of the contract of employment or in case of an assignment of a different task.

5. Network Security

The Supplier puts in place - inter alia - the following measures to guarantee that Data is not read, copied, altered or removed during the process of electronic transmission, during the transport or storage of data-on-data carriers:

• The systems/resources are protected against the risk of intrusion with the help of suitable software and hardware which effectiveness is checked periodically and updated accordingly.
• The routers/firewalls are appropriately configurated to secure internal network from unauthorized external connections and to secure that computer connections and data flow do not breach the logical access adjustment control of the systems.
• Amendments on the hardware-based network components or on their configurations need the acceptance of the designated person in charge and are subject to a change management process.
• The organization has a firewall configuration regulation which defines acceptable ports. Only used ports and services are open. The access for the amendment of the firewall configuration is restricted to an internal team of security experts. Such team regularly examines critical firewall regulations.

6. Input control (Data Quality)

The Supplier puts in place - inter alia - the following measures to guarantee that it can be examined and determined subsequently if and by whom the Data has been entered into, removed from, or altered in the Data Processing systems:

• Effective input control is applied to ensure that Data cannot be read, copied, modified or re-modified without authorization in the course of Processing or use and after storage. All access requests are logged, and their compliance is monitored because detection data are also Data, any operation performed on these Data is submitted to adequate security measures.

7. Job control

The Supplier shall ensure that the functions and obligations of every individual with access to the Data are clearly defined, updated and documented. Measures are adopted to make staff familiar and periodically trained with respect to the specific rules applicable to their functions and the consequences of any breach of these rules.

8. Availability control and Business Continuity Management

The Supplier puts in place - inter alia - the following measures to ensure that Data is protected against damage by accident or loss:

• Data is protected from accidental destruction or loss through effective retrieval systems, disaster recovery and business continuity planning. The procedures laid down for making backup copies and for recovering Data ensure that can be reconstructed to the state in which they were at the time they were last backed up.
• At least annually executed perform drills for Business Continuity and Disaster Recovery (BC-DR) purposes which is then stored or shared as evidence.
• The organization must take steps to perform a Business Impact Assessment (BIA/) to identify and mitigate potential threats and attacks.
• Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for all their applications and resources, and a formal verification and validation process of the defined measures should be in place. Necessary evidence for audit purpose to be shared with the Customer.

9. IT and Security operation

The Supplier puts in place - inter alia - the following measures to ensure that Data is protected against external threats:

• A formalized process to be defined regarding the acquisition and development of systems which incorporates the assessment on the adequacy of security measures.
• Secure system development using:
  1. frameworks to build secure software and address security issues, and
  2. separating development, test and production environment.
• Reducing the surface of vulnerability by hardening of systems according to their exposure and sensitivity.
• Implementing Patch and Vulnerability Management to timely detect and resolve any known vulnerabilities which could result in exploits.
• Assess the exploitability of the IT environment by performing penetration testing and cyber-attack testing addressing the attack surface and vulnerability of the systems to external cyber-attack, including readiness testing assessing levels of preparedness and capability.
• Implementation of Endpoint and Network Protection to evade malicious attacks and intrusions.

10. Security Incident Management

The Supplier puts in place - inter alia - the following measures to respond and recover from security incident:

• The security policy contains a precise description of the steps to be taken when a security incident relating to Data is detected, as well as of the persons in charge of dealing with the incident, in order to return to the normal situation as quickly as possible.
• The procedure for reporting and managing security incidents includes a record of each incident, the time at which it occurred, the person reporting it, to whom it was reported and the effects thereof.
• The circumstances of any incident are to be analyzed in order to elaborate preventive measures or make adaptations so as to avoid a repetition of this type of incident.

11. Security Monitoring and Governance

The Supplier puts in place - inter alia - the following measures to detect malicious events which compromise the security of the Data:

• Implementation of security event monitoring to timely detect anomalies in the behavior of users and systems. These events logs are maintained for at least a period of 6 months for audit reasons.
• Establishment of a security function (SOC - Security Operation Center) to govern the detection of malicious events to initiate response and recovery actions.
• Enabling of logging of network activities, transaction data, configuration changes and security events according to the defined policies and guidelines. Logs may be collected locally.
• Implementation of Data Leakage Prevention Policy and methods to prevent and / or detect breach or Data leaks.

12. Segregation control

The Supplier puts in place - inter alia - the following measures to separate the processing of collected data for different purposes:

Each Data Processing is made on server systems which are separated by a system of logical and physical access controls in the network. The Data Processing is only made in accordance with the Data Processing Agreement.

13. Documentation

The Supplier puts in place - inter alia - the following measures to have the following Information Security Management System (ISMS) document measures to be in place:

• Centralized documentation relating to security, which is complete and formalized, proportional to security needs, up to date at any time and accompanied by a directory at the disposal of properly authorized persons whenever necessary.

Such documentation should at least contain the following elements: the identity of the security counsellor, the security policy, the implementation of security measures, an inventory of the Data being Processed, their localization and the operations performed on them, a nominative list of the bodies or appointees having access to the Data; the system and network configuration, technical documentation about the security controls that were introduced, a schedule of planned operations, the detection policy, security control test plans, incident reports, audit reports, if any.

14. Encryption

The Supplier puts in place - inter alia - the following measures for encryption of Data at rest (e.g., hard disk, flash drives) and Data in transit (e.g., Bluetooth devices, Internet, e-commerce):

• Data transmission / transfer (data-in-transit) to and from the organizations network and / or solution it encrypted used industry best practice encryption technologies, such as SSL/TLS.
• Data encryption of Data at rest e.g., BitLocker, Sophos on both user endpoint and system processing and/or storing Data.
• Industry best practices of encryption algorithms, key length and key management should be implemented which are considered effective in protection (Confidentiality, Integrity and Availability) of Data-at-rest and in-transit.
• Pseudonymization is a means of protecting the Data. Pseudonymization can be established by methods like encryption, tokenization or hashing.

15. Data Minimization / Retention

The Supplier puts in place - inter alia - the following measures so that only the necessary or minimal Data is shared:

• The processed/shared Data is either destroyed or stored with appropriate security measures for a defined period of time.
• The Data received from the NXP will be destroyed/deleted/handed over to NXP or a party designated by NXP on termination of the PO unless agreed otherwise for legitimate reason. During the course of the Processing activities, the Supplier needs to destroy all the copies of the Processed and validated Data once shared with the NXP using a standard operating procedure or statement of work, unless agreed otherwise. If both Supplier and NXP agree on a certain retention period of Data, then it should be clearly documented in the PO and justified by a legal reasoning. The Supplier will upon request of NXP provide evidence of maintaining necessary Data according to NXP's data retention policy; this should at least include a policy for deletion or erasure of records after termination or expiration of the PO.
• The Supplier may store the necessary Data for the duration necessary for the performance of the PO and will ensure appropriate data deletion techniques (NIST standards) are used to delete the NXP Data.

16. Data Portability and Right to Erasure

The Supplier puts in place - inter alia - the following measures:

• The Supplier ensures the employees of the NXP have the possibility of accessing the Processed Data at any given point in time. If need be, an employee can share his/her information with another third party for further processing. e.g., tax slips or pay slip.
• On the request of the NXP/NXP's employee, the Supplier will adhere to deletion of certain Data values/ fields which may no longer be deemed necessary to continue with the assigned work, where is illegally collected, if the consent is withdrawn, when there is an objection raised for sharing Data and also in compliance with law.

17. Certifications

Supplier holds one or more of the certifications specified below on their ISMS in relation to the implementation of technical and organizational measures:

• SOC 2 type II;
• ISO 27001, together with a statement of applicability including data privacy in scope.

If Supplier does not hold one or more of the certifications specified below Supplier will inform NXP without undue delay and will be required to complete the Security Assessment Questionnaire initiated by NXP.

Supplier will for the term of providing the Service to NXP and at a minimum for an additional six (6) months afterwards:

1. maintain such certification;
2. provide yearly or upon request and in a format acceptable to NXP the updated certificates and/or reports evidencing maintenance of such certification;
3. provide all information on maintenance and implementation of such certification as reasonably requested by NXP;
4. immediately identify to NXP any deficiencies discovered during self-assessments of such certifications and/or reported by independent auditors in relation to such certifications;
5. remedy identified deficiencies within a timeframe acceptable to NXP;
6. implement additional procedures requested by NXP within a period specified by NXP; and
7. ensure for onward transfers to other parties, the above mentioned technical and organizational measures are implemented by such other parties.

Data Protection Terms

Version: April 2025

Last updated: 04-2025