The following terms and conditions (hereinafter referred to as this "Agreement" or the "AG Connect Distribution Service Agreement") are a legally binding agreement and constitute a supplementary agreement to the HUAWEI Developers Merchant Service Agreement and HUAWEI AppGallery Connect Service Agreement which are supplementary agreements to the HUAWEI Developers Service Agreement between you and Huawei and establishes your legal responsibilities and rights when you use AppGallery Distribution Service for Paid Apps provided by Huawei (hereafter HUAWEI Developers Merchant Service Agreement, HUAWEI Developers Service Agreement, and HUAWEI AppGallery Connect Service Agreement collectively referred to as the "Base Agreements"). By clicking "I agree" button at the bottom of this Agreement or using any service under this Agreement, you are deemed to fully understand and accept the terms of this Agreement and the Base Agreements from that date of such acceptance or use ("Effective Date").

Your use of any of the Services under this Agreement will be deemed as your full understanding and acceptance of the terms of this Agreement. This Agreement takes effect immediately on Effective Date. In case any terms of this Agreement conflict with the terms of the Base Agreements, the terms of this Agreement shall prevail only to the extent of issues in related with AppGallery Distribution Service for Paid Apps.

This Agreement constitutes a legally binding commercial agency agreement between you and Huawei.

1 Definitions

Capitalized terms not defined in this Agreement shall have the meanings ascribed to them in the Base Agreements. The following terms shall have the following meanings when used in this Agreement:

1.1 "Distribution Service for Paid Apps" means the cooperation between and respective activities of Huawei and Developer through AppGallery Connect, to make available and promote Paid Apps, In-App Purchases, and Digital Content via HUAWEI AppGallery, HUAWEI GameCenter, HUAWEI EduCenter and HUAWEI AppTouch. The activities of Huawei include services such as providing access via the AppGallery Platform, big data reporting, marketing event operations, and end user operations.

1.2 "EEA" means the European Economic Area, consisting of the Member States of the European Union and Iceland, Liechtenstein, and Norway.

1.3 "EU SCC" means the standard contractual clauses issued by the European Commission by implementing decision 2021/914 of June 4, 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

1.4 "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and superseding Directive 95/46/EC.

1.5 "Paid Apps" means Apps that can only be used by Users after payment which includes but is not limited to downloading Apps, In-App Purchases, and Digital Content Purchase.

1.6 "In-App Purchases" or "IAP" means purchase of digital content, advanced features, or other value-added services by Users during the use of an installed App. Payments are made by Users within the App ("IAP Function").

1.7 "Payment and Subscription Service" means a service Huawei provided to Developer which enables Developer sets subscription rules of User subscription and charge Users in accordance with such rules through IAP Function.

1.8 "Product Management System or "PMS" means the system where Huawei hosts information about Developers' offerings (including but not limited to the content and services of In-App Purchases and the paid Apps) released on AppGallery, which helps Developers manage the localized offerings of their apps across the globe. Prices for the offerings shall be entered into PMS by Developers.

1.9 "Digital Content" means information content distributed based on digital format switching by Developers on the AppGallery Connect. Combining digital technologies and cultural creatives, it is the product or service that integrates images, text, and videos by digital technologies.

1.10 "Digital Content Purchase" means purchase of information content by Users on the AppGallery Platform.

1.11 "AppTouch Membership Subscription" means the business model that through subscribing to AppTouch Provider's platform, User can access to your App and use your services.

1.12 "HUAWEI AppTouch" or "AppTouch" means the distribution platforms (a) for which Huawei cooperates with third parties ("AppTouch Partner(s)"), including but not limited to telecom carriers, in operations and branding, (b) developed and for which technical support is provided by Huawei, and (c) that allow Developers to distribute Products to End Users, in order to help Developers quickly distribute Products on more distribution platforms and increase exposure, traffic, monetization opportunities, and users for the Products. The HUAWEI AppTouch list is set forth here. Huawei may update the list from time to time.

1.15 "Personal Data" means any information relating to an identified or identifiable natural person in so far as it is processed under this Agreement.

1.16 "Third Country" means a country that is neither part of the EEA nor has been declared adequate by a decision of the European Commission according to the mechanism lined out in Article 45 GDPR.

1.17 “UK Addendum” means the addendum to the EU SCC issued by the UK Information Commissioner under Section 119A(1) of the UK Data Protection Act 2018 (version B1.0, in force March 21, 2022, as amended, available here: https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf).

2 Pricing and Payment

2.1 This Agreement shall apply and be binding on you if you decide to offer and distribute Paid Apps via AppGallery.

2.2 You may enter the Prices for your Paid Apps at your sole discretion into Huawei PMS. Such Prices shall apply in the countries/regions in which you choose to sell your Apps. The Prices you set include Value Added Tax ("VAT"), Goods and Services Tax ("GST"), Service Tax, Sales Tax and other applicable indirect and surtaxes (collectively referred to as "Indirect Taxes"), Digital Service Tax, User Withholding Tax, and other tax and fees involved in accordance with relevant tax laws by default. According to the Huawei Developer Service Agreement, if you are signing with Shenzhen Huawei Siray Technologies Co., Ltd. established in People's Republic of China, and the service distribution area is Russia, the Prices do not include Chinese VAT (if applicable) by default.

2.4 Huawei reserves the right to modify its service charge/commission fee and will notify you of any such modifications thirty (30) days prior to the modification taking effect via email and prompt you through this Website.

2.5 IAP and Digital Content Purchase and Payment and Subscription Service facilitate you to manage your user subscription relationship. You may configure the price and billing and maintain a subscription relationship by recording User subscription period, billing amount, deduction time and so on via PMS. By using Payment and Subscription Service (hereinafter, "PSS"), you must follow all the applicable laws and ensure that any deduction of fee is in strict accordance with User's authorization and instruction. You understand and agree that Huawei may take all necessary measures to ensure Users' security on subscription and payment. These measures may include temporary suspending or closing your payment service without notifying you.

3 Settlement

3.1 As your commercial agent, Huawei will collect the payments from the Users on your behalf pursuant to Clause 4 of HUAWEI Developers Merchant Service Agreement.

3.2 Huawei will transfer the pertinent settlement amount to your nominated bank account after deduction of its commission charges and applicable taxes.

Pertinent settlement amount = (Total collection from Users – Discounts – Indirect Taxes – Refunds – Channel Deduction) x (1 – Commission Fee Ratio).

3.4.1 If you distribute PC games (games that run using an EXE file) in the Chinese mainland, as stated in Part I of Exhibit A hereto, and integrate HUAWEI Account Kit and/or In-App Purchases by December 31, 2023, the Commission Fee Ratio charged by Huawei shall be twenty percent (20%), starting from your games' integration of Account Kit and/or In-App Purchases and ending on December 31, 2023.

3.4.2 From January 1, 2022, Huawei will no longer deduct, as of the effective date of the standard Commission Fee Ratio or for the incentive plan for 2022, the Channel Deduction for the "Downloading" and "In-App purchase (subscriptions included) or Digital Content purchase (subscriptions included)" services stated in the table above when calculating the total settlement amount (comprising the pertinent settlement amount distributed to you and the Commission Fee charged by Huawei) if (a) the standard Commission Fee Ratio applies to you or you are eligible for the incentive plan for 2022 and (b) you distribute Paid Apps in the countries or regions listed in Part II or Part III or Part IV of Exhibit A hereto.

3.4.3 Regarding the "In-App purchase (subscriptions included) or Digital Content purchase (subscriptions included)" stated in the table above, for Developers who distribute Paid Apps (excluding game apps) in the countries or regions listed in Part II or Part III or Part IV of Exhibit A hereto, Huawei shall charge the Commission Fee Ratio of fifteen percent (15%) starting from June 1st, 2024 for the total settlement amount from the subscriptions (auto-renewable subscriptions) purchased by users, and will no longer deduct the Channel Deduction. The subscription incentive plan shall remain valid unless explicitly terminated.

3.5 For the "Downloading" and "In-App purchase (subscriptions included) or Digital Content purchase (subscriptions included)" services stated in the table above, you may be entitled to the incentive plan in Exhibit D if applicable.

3.6 If the cumulative amount to be settled within a Settlement Period is less than the applicable Minimum Settlement Amount listed in below table, the settlement will be postponed to the next cycle when the amount to be settled reaches the Minimum Settlement Amount. If the cumulative amount to be settled does not reach the Minimum Settlement Amount for consecutive six (6) months, Huawei shall make Settlement every six months. Within six (6) months after the termination of this Agreement (provided that such termination is not caused by any breach of Developer), Huawei shall continue to make settlement to Developer according to this Agreement provided that both Parties continue to comply with relevant provisions of this Agreement. The Minimum Settlement Amount is agreed as follows:

3.7 When your Apps were distributed through AppTouch, all the responsibility of collecting and remitting applicable Indirect Taxes to relevant tax authorities and issuing invoices to Users in accordance to Exhibit C of HUAWEI Developers Merchant Service Agreement will be determined in compliance with the local tax regulation.

4 Data Protection

4.1 You are the controller of personal data that you obtain from Huawei and/or AppTouch, related to your Users and their purchases, for settlement and shipment purposes and for subscription management purposes in order to perform your services. The aforesaid personal data may include without being limited to Users' Order ID, open ID, product information (ID of the course product purchased by the User, ID of the course purchased by the User, purchase order number, etc.), subscription information, currency, amount, and country code. You shall use the above personal information within the aforementioned purposes of this Agreement, and ensure the lawfulness of the processing in accordance with the applicable laws.

4.2 If your application or service needs to collect any user data, you must ensure a legal basis for data processing in accordance with applicable laws and collect only the user data necessary for the running of the application program and the implementation of its functions. In addition, you must inform the user of the purpose, scope, and usage of the data collection to protect the user's right to know.

4.3 After your app or service collects user data and receives user data shared by Huawei or Huawei AppTouch Partner, you shall take necessary technical and management measures to ensure user data security and to protect the personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, and which provide a level of security appropriate to the risk represented by the processing and the nature of the data received from Huawei regarding your Users to be protected.

4.4 You shall provide users with a method for correcting their personal data and deleting user data, subject to their data privacy rights and to applicable laws.

4.5 Data Breach. If you suspect or become aware of any unauthorized access to any User Data or Personal Data by any unauthorized person or third party, or become aware of any other security breach relating to Personal Data held or stored by you under this Agreement or in connection with the performance of the services performed under this Agreement, you shall immediately notify Huawei in writing and shall fully cooperate with Huawei to prevent or stop such Data Breach. In the event of such Data Breach, you shall fully and immediately comply with applicable laws, and shall take the appropriate steps to remedy such Data Breach. You will defend, indemnify, and hold harmless Huawei, its Affiliates, and their respective officers, directors, employees and agents, from and against any and all claims, suits, causes of action, liability, loss, costs and damages, including reasonable attorney fees, arising out of or relating to any third party claim arising from breach by you of your obligations contained in this Section, except to the extent resulting from the acts or omissions of Huawei.

4.6 In the event that you are suspected of violating relevant laws and regulations, this Agreement, or platform rules, Huawei has the right to stop data sharing and joint operations services.

4.7 If you are located outside of the EU or EEA, in a country or sector which is not (at the time of the transfer) an Adequate Country or Sector as provided by the European Commission, and (i) your contracting entity under the HUAWEI Developers Service Agreement is Aspiegel SE, or (ii) Personal Data is transferred between relevant AppTouch Provider established in EU/EEA and you (as applicable) when you are located in a country or region outside the EU which the European Commission finds to be unable to provide adequate protection for Personal Data, then Huawei and you, or relevant AppTouch Provider and you (as applicable), shall conform to, and hereby agree to the Data Transfer Agreement in the Exhibit B annexed to and forming part of this Agreement. The Parties shall be deemed to have executed the EU Standard Contractual Clauses, according to the process described in the preamble of this Agreement, such that:

4.8 To the extent that the data protection laws of the UK apply to the transfer of Personal Data under this Agreement, the Parties execute the UK Addendum which is incorporated into this Agreement and applies to transfers of personal data outside the UK (except for cases where such data is transferred to a country within the EU/EEA or to another country recognized as adequate in terms of level of data protection by the UK). Part 1 of the UK Addendum is completed as follows: (i) in Table 1, the “Exporter” is Huawei (or relevant AppTouch Provider, as applicable) and you are the “Importer”, their details are set forth in this Agreement; (ii) in Table 2, the first option is selected and the “Approved EU SCCs” are the EU SCC referred to in Section 4.7 above; (iii) in Table 3, the information is as provided in Annex I (A and B) and Annex II to the “Approved EU SCCs” (as set out in Exhibit B of this Agreement); and (iv) in Table 4, the “Exporter” can terminate the UK Addendum.

4.9 If you are located outside of Singapore and your contracting entity under the HUAWEI Developers Service Agreement is Huawei Services (Hong Kong) Co., Limited, and your Business Area is not Russia, you shall conform to, and hereby agree to the Data Transfer Agreement in the Exhibit C annexed to and forming part of this Agreement.

4.10 Data Protection for Developers Distributing Digital Content in the Chinese Mainland

(This clause is only applicable if you are contracting with Huawei Software Technologies Co., Ltd., which is legally established and incorporated in the People's Republic of China, and you designate Huawei Software Technologies Co., Ltd. as your agent in the Chinese mainland.)

If developers integrate Huawei HMS 3.0 or a later version SDK into joint operation applications distributed to the Chinese mainland, they need to inform users that the SDK will collect users' device identifiers and application package names and Startup Time. The data is used only for data operation analysis of the joint operation application.

5 Refunds

5.1 Unless covered in this clause, you shall refer to Clause 6 in HUAWEI Developers Merchant Service Agreement.

5.2 When your Apps are distributed through AppTouch, if your Apps or Digital Content is removed from the platform in accordance with the terms of the Base Agreements and Users are entitled to a refund from you, or Huawei exercises its sole discretion to issue a refund because of a legal right of the User or a valid complaint (including but not limited to identity theft and fraud) made by a User about your Products, you authorize Huawei (via AppTouch Provider) to refund on your behalf, and you shall compensate Huawei for all losses incurred therefrom.

5.3 You authorize Huawei to refund on your behalf based on Huawei's commercially reasonable judgment in case of any complaints and claims raised by purchasers of your Apps.

6 Termination of this Agreement

6.1 You shall notify Huawei of your intention to terminate three months in advance if you wish to terminate the Agreement. The termination will take effect after all Settlements (including credits) outlined above have been calculated and paid.

6.2 You shall maintain the functions, services and user experiences of your Products for new Users registered during the validity of this Agreement.

6.3 Huawei may terminate this Agreement at any time on giving you at least thirty (30) day notice.

6.4 When you delete your account after termination of this Agreement, all data (including your data, User Data, and Product Operation Data) stored on your account may be permanently deleted.

7 Distribution Area and Signing Huawei Entity

8 Governing Law and Dispute Resolution

9 General Terms

9.1 If any part of this Agreement is deemed as invalid by the court or other competent authorities, any other provisions shall not be affected and shall continue to be enforceable and binding upon both parties to the fullest extent permitted by applicable law.

9.2 You shall not sub-contract any obligations under this Agreement, or transfer, assign, or sub-license any rights under this Agreement.

9.3 You hereby acknowledges and agrees that Huawei may, at its sole discretion, subcontract any rights or obligations under this Agreement, in whole or in part to any third party, or assign this Agreement (with any and all supplementary agreements of this Agreement) to any Huawei Affiliate.

Exhibit A: List of Countries/Regions

Exhibit B: Data Transfer Agreement

(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (^[1]) for the transfer of personal data to a third country.

(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter 'entity/ies') transferring the personal data, as listed in Annex I.A (hereinafter each 'data exporter'), and

(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each 'data importer')

(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.

(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.

(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.

(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:

(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.

(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

(a) An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.

(b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.

(c) The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party.

The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B. It may only process the personal data for another purpose:

(ii) where necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or

(iii) where necessary in order to protect the vital interests of the data subject or of another natural person.

(a) In order to enable data subjects to effectively exercise their rights pursuant to Clause 10, the data importer shall inform them, either directly or through the data exporter:

(iv) where it intends to onward transfer the personal data to any third party/ies, of the recipient or categories of recipients (as appropriate with a view to providing meaningful information), the purpose of such onward transfer and the ground therefore pursuant to Clause 8.7.

(b) Paragraph (a) shall not apply where the data subject already has the information, including when such information has already been provided by the data exporter, or providing the information proves impossible or would involve a disproportionate effort for the data importer. In the latter case, the data importer shall, to the extent possible, make the information publicly available.

(c) On request, the Parties shall make a copy of these Clauses, including the Appendix as completed by them, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the Parties may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.

(d) Paragraphs (a) to (c) are without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.

(a) Each Party shall ensure that the personal data is accurate and, where necessary, kept up to date. The data importer shall take every reasonable step to ensure that personal data that is inaccurate, having regard to the purpose(s) of processing, is erased or rectified without delay.

(b) If one of the Parties becomes aware that the personal data it has transferred or received is inaccurate, or has become outdated, it shall inform the other Party without undue delay.

(c) The data importer shall ensure that the personal data is adequate, relevant and limited to what is necessary in relation to the purpose(s) of processing.

The data importer shall retain the personal data for no longer than necessary for the purpose(s) for which it is processed. It shall put in place appropriate technical or organisational measures to ensure compliance with this obligation, including erasure or anonymisation (^[2]) of the data and all back-ups at the end of the retention period.

(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the personal data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access (hereinafter 'personal data breach'). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subject. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner.

(b) The Parties have agreed on the technical and organisational measures set out in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.

(c) The data importer shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

(d) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the personal data breach, including measures to mitigate its possible adverse effects.

(e) In case of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the data importer shall without undue delay notify both the data exporter and the competent supervisory authority pursuant to Clause 13. Such notification shall contain i) a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), ii) its likely consequences, iii) the measures taken or proposed to address the breach, and iv) the details of a contact point from whom more information can be obtained. To the extent it is not possible for the data importer to provide all the information at the same time, it may do so in phases without undue further delay.

(f) In case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the data importer shall also notify without undue delay the data subjects concerned of the personal data breach and its nature, if necessary in cooperation with the data exporter, together with the information referred to in paragraph (e), points ii) to iv), unless the data importer has implemented measures to significantly reduce the risk to the rights or freedoms of natural persons, or notification would involve disproportionate efforts. In the latter case, the data importer shall instead issue a public communication or take a similar measure to inform the public of the personal data breach.

(g) The data importer shall document all relevant facts relating to the personal data breach, including its effects and any remedial action taken, and keep a record thereof.

Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person's sex life or sexual orientation, or data relating to criminal convictions or offences (hereinafter 'sensitive data'), the data importer shall apply specific restrictions and/or additional safeguards adapted to the specific nature of the data and the risks involved. This may include restricting the personnel permitted to access the personal data, additional security measures (such as pseudonymisation) and/or additional restrictions with respect to further disclosure.

The data importer shall not disclose the personal data to a third party located outside the European Union (^[3]) (in the same country as the data importer or in another third country, hereinafter 'onward transfer') unless the third party is or agrees to be bound by these Clauses, under the appropriate Module. Otherwise, an onward transfer by the data importer may only take place if:

(i) it is to a country benefiting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;

(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU) 2016/679 with respect to the processing in question;

(iii) the third party enters into a binding instrument with the data importer ensuring the same level of data protection as under these Clauses, and the data importer provides a copy of these safeguards to the data exporter;

(iv) it is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings;

(v) it is necessary in order to protect the vital interests of the data subject or of another natural person; or

(vi) where none of the other conditions apply, the data importer has obtained the explicit consent of the data subject for an onward transfer in a specific situation, after having informed him/her of its purpose(s), the identity of the recipient and the possible risks of such transfer to him/her due to the lack of appropriate data protection safeguards. In this case, the data importer shall inform the data exporter and, at the request of the latter, shall transmit to it a copy of the information provided to the data subject.

Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.

The data importer shall ensure that any person acting under its authority, including a processor, processes the data only on its instructions.

(a) Each Party shall be able to demonstrate compliance with its obligations under these Clauses. In particular, the data importer shall keep appropriate documentation of the processing activities carried out under its responsibility.

(b) The data importer shall make such documentation available to the competent supervisory authority on request.

(a) The data importer, where relevant with the assistance of the data exporter, shall deal with any enquiries and requests it receives from a data subject relating to the processing of his/her personal data and the exercise of his/her rights under these Clauses without undue delay and at the latest within one month of the receipt of the enquiry or request. (^[4]) The data importer shall take appropriate measures to facilitate such enquiries, requests and the exercise of data subject rights. Any information provided to the data subject shall be in an intelligible and easily accessible form, using clear and plain language.

(b) In particular, upon request by the data subject the data importer shall, free of charge:

(i) provide confirmation to the data subject as to whether personal data concerning him/her is being processed and, where this is the case, a copy of the data relating to him/her and the information in Annex I; if personal data has been or will be onward transferred, provide information on recipients or categories of recipients (as appropriate with a view to providing meaningful information) to which the personal data has been or will be onward transferred, the purpose of such onward transfers and their ground pursuant to Clause 8.7; and provide information on the right to lodge a complaint with a supervisory authority in accordance with Clause 12(c)(i);

(iii) erase personal data concerning the data subject if such data is being or has been processed in violation of any of these Clauses ensuring third-party beneficiary rights, or if the data subject withdraws the consent on which the processing is based.

(c) Where the data importer processes the personal data for direct marketing purposes, it shall cease processing for such purposes if the data subject objects to it.

(d) The data importer shall not make a decision based solely on the automated processing of the personal data transferred (hereinafter 'automated decision'), which would produce legal effects concerning the data subject or similarly significantly affect him/her, unless with the explicit consent of the data subject or if authorised to do so under the laws of the country of destination, provided that such laws lay down suitable measures to safeguard the data subject's rights and legitimate interests. In this case, the data importer shall, where necessary in cooperation with the data exporter:

(i) inform the data subject about the envisaged automated decision, the envisaged consequences and the logic involved; and

(ii) implement suitable safeguards, at least by enabling the data subject to contest the decision, express his/her point of view and obtain review by a human being.

(e) Where requests from a data subject are excessive, in particular because of their repetitive character, the data importer may either charge a reasonable fee taking into account the administrative costs of granting the request or refuse to act on the request.

(f) The data importer may refuse a data subject's request if such refusal is allowed under the laws of the country of destination and is necessary and proportionate in a democratic society to protect one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679.

(g) If the data importer intends to refuse a data subject's request, it shall inform the data subject of the reasons for the refusal and the possibility of lodging a complaint with the competent supervisory authority and/or seeking judicial redress.

(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.

[OPTION: The data importer agrees that data subjects may also lodge a complaint with an independent dispute resolution body (^[5]) at no cost to the data subject. It shall inform the data subjects, in the manner set out in paragraph (a), of such redress mechanism and that they are not required to use it, or follow a particular sequence in seeking redress.]

(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.

(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:

(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;

(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.

(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.

(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.

(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.

(b) Each Party shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages that the Party causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter under Regulation (EU) 2016/679.

(c) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.

(d) The Parties agree that if one Party is held liable under paragraph (c), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.

(e) The data importer may not invoke the conduct of a processor or sub-processor to avoid its own liability.

[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.

[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.

(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.

SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES

(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.

(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:

(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;

(ii) the laws and practices of the third country of destination – including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards (^[6]);

(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.

(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.

(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.

(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).

(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.

(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:

(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or

(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.

(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.

(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.).

(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.

(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.

(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).

(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.

(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.

(a) The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.

(b) In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).

(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:

(i) the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;

(ii) the data importer is in substantial or persistent breach of these Clauses; or

(iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.

In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.

(d) Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.

(e) Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.

These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.

(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.

(c) A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.

Name: shall be the contracting Huawei entity, determined according to clause 7 of the HUAWEI AppGallery Connect Distribution Service Agreement, or the AppTouch providers listed [here] (as applicable)

Address: shall be the address of the entity determined under clause 7 of the AG Connect Service Agreement, or with respect to AppTouch providers, as listed [here]

Contact person's name, position and contact details: Joerg Thomas, Director, DPO office, DPO@huawei.com

Provide distribution of paid products/apps or with in-app payment capabilities of Importer.

Name: your name or, as the case may be, the name of the company you represent. You being the Developer who signed the HUAWEI AppGallery Connect Distribution Service Agreement with data exporter and part of the Agreement

Address: your place of business or, as the case may be, the place of business of the company you represent

Contact person's name, position and contact details: your contact details and information as you have provided them in context of the AG Connect services and your Developer Account.

Provide distribution of paid products/apps or with in-app payment capabilities of Importer.

Data subjects of the data exporter who have signed both the AppGallery and IAP user agreements and made In-App-Purchase; or similarly, the data subjects who have signed the service agreement with the AppTouch provider as applicable.

Payment information except payment methods information, such as the order number, amount, subscription information (subscription ID), and currency.

Sensitive data transferred (if applicable) and applied restrictions or safeguards:

The data transfers are triggered by use of the services by the data subjects, in particular by certain action taken by the data subject when making an In-App purchase

The data is transferred through the API channels to Importer to enable the provision of the relevant IAP service.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: In accordance with the privacy policies and data retention practices of the data importer, subject to the applicable data protection laws.

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

The following measures are the minimum required to be implemented by the data importer on the transferred Personal Data:

Exhibit C: Data Transfer Agreement

Standard contractual clauses for the transfer of personal data from the Community to third countries (controller to controller transfers)

Name of the data exporting organisation: Huawei Services (Hong Kong) Co., Limited

Address: Room 03, 9th Floor, Tower 6, The Gateway, No. 9 Canton Road, Tsim Sha Tsui, Kowloon, Hong Kong (company registration number: 1451551)

and Huawei Services (Hong Kong) Co., Limited on behalf of other Data Controllers (please refer to our website for the controller list)

Developer who signed HUAWEI AppGallery Connect Distribution Service Agreement for Paid Apps with data exporter and part of the Agreement

(a) "individual", "personal data", "processing" shall have the same meaning as in Personal Data Protection Act (No. 26 of 2012) of Singapore;

(b) "Data Exporter" shall mean the organization who transfers the personal data;

(c) "Data Importer" shall mean the organization who agrees to receive in a country or territory outside Singapore the personal data transferred to it by or on behalf of the Data Exporter for processing in accordance with the terms of theses clauses;

(d) "Data Subject" shall mean the Data Subject that is particularly described in Annex B herein below;

(e) "clauses" shall mean these contractual clauses, which are a free-standing document that does not incorporate commercial business terms established by the parties under separate commercial arrangements.

(f) "PDPA" shall mean the Personal Data Protection Act (No. 26 of 2012) of Singapore.

The details of the transfer (as well as the personal data covered) are specified in Annex B, which forms an integral part of the clauses.

(a) The personal data has been collected, processed and transferred in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the country where the Data Exporter is established).

(b) It has used reasonable efforts to determine that the Data Importer is able to satisfy its legal obligations under these clauses.

(c) It will provide the Data Importer, when so requested, with copies of relevant data protection laws or references or any requirements set out in any advisory or other guidelines issued from time to time by Personal Data Protection Commission of Singapore ("PDPC") to them (where relevant, and not including legal advice).

(d) It will respond to enquiries from Data Subjects and the authority concerning processing of the personal data by the Data Importer, unless the parties have agreed that the Data Importer will so respond, in which case the Data Exporter will still respond to the extent reasonably possible and with the information reasonably available to it if the Data Importer is unwilling or unable to respond. Responses will be made within a reasonable time.

(e) It will make available, upon request, a copy of the clauses to Data Subjects who are third-party beneficiaries under clause III, unless the clauses contain confidential information, in which case it may remove such information. Where information is removed, the Data Exporter shall inform Data Subjects in writing of the reason for removal and of their right to draw the removal to the attention of the authority. However, the Data Exporter shall abide by a decision of the authority regarding access to the full text of the clauses by Data Subjects, as long as Data Subjects have agreed to respect the confidentiality of the confidential information removed. The Data Exporter shall also provide a copy of the clauses to the authority where required.

(a) It will have in place appropriate technical and organizational measures to provide a standard of protection, that is comparable to the protection required by the PDPA and any requirements set out in any advisory or other guidelines issued from time to time by the PDPC, to the personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, and which provide a level of security appropriate to the risk represented by the processing and the nature of the data to be protected.

(b) It will have in place procedures so that any third party it authorizes to have access to the personal data, including processors, will respect and maintain the confidentiality and security of the personal data. Any person acting under the authority of the Data Importer, including a data processor shall be obligated to process the personal data only on instructions from the Data Importer. This provision does not apply to persons authorized or required by law or regulation to have access to the personal data.

(c) It has no reason to believe, at the time of entering into these clauses, in the existence of any local laws that would have a substantial adverse effect on the guarantees provided for under these clauses, and it will inform the Data Exporter if it becomes aware of any such laws.

(d) It will process the personal data for purposes described in Annex B, and has the legal authority to give the warranties and fulfill the undertakings set out in these clauses.

(e) It will identify to the Data Exporter a contact point within its organization authorized to respond to enquiries concerning of the personal data, and will cooperate in good faith with the Data Exporter, the Data Subject and the authority concerning all such enquiries within a reasonable time. In case of legal dissolution of the Data Exporter, or if the parties have so agreed, the Data Importer will assume responsibility for compliance with the provisions of clause I (e).

(f) At the request of the Data Exporter, it will provide the Data Exporter with evidence of financial resources sufficient to fulfill its responsibilities under clause III (which may include insurance coverage).

(g) Upon reasonable request of the Data Exporter, it will submit its data processing facilities, data files and documentation needed for processing to reviewing, auditing and/or certifying by the Data Exporter (or any independent or impartial inspection agents or auditors, selected by the Data Exporter and not reasonably objected to by the Data Importer) to ascertain compliance with the warranties and undertakings in these clauses, with reasonable notice and during regular business hours. The request will be subject to any necessary consent or approval from a regulatory or supervisory authority within the country of the Data Importer, which consent or approval the Data Importer will attempt to obtain in a timely fashion.

i The data protection laws of Singapore, and the relevant regulations, provisions or other requirements issued by PDPC; and

(i) It will not disclose or transfer the personal data to a third-party organization located outside Singapore unless with prior consent of the Data Exporter on the transfer and,

The third-party organization processes the personal data in accordance with requirements prescribed under PDPA finding that the third-party organization provides a standard of protection to personal data so transferred that is comparable to the protection under PDPA;

Data subjects have been given the opportunity to object, after having been informed of the purposes of the transfer, the categories of recipients and the fact that the countries to which data is exported may have different data protection standards.

(a) The Data Importer shall be liable to the Data Exporter for damages it causes by any breach of these clauses. Liability as between the parties is including but not limited to actual damage suffered and penalties imposed by government or local authority. The Data Importer shall be liable to Data Subjects for damages it causes by any breach of third party rights under these clauses. This does not affect the liability of the Data Exporter under its data protection law.

(b) The parties agree that a Data Subject shall have the right to enforce as a third-party beneficiary this clause and clauses I(b), I(d), I(e), II(a), II(d), II(e), II(h), II(i), III(a), V, VI(d) and VII against the Data Importer or the Data Exporter, for their respective breach of their contractual obligations, with regard to his personal data, and accept jurisdiction for this purpose in the Data Exporter's country of establishment. In cases involving allegations of breach by the Data Importer, the Data Subject must first request the Data Exporter to take appropriate action to enforce his rights against the Data Importer, if the Data Exporter does not take such action within a reasonable period (which under normal circumstances would be one month), the Data Subject may then enforce his rights against the Data Importer directly. A Data Subject is entitled to proceed directly against a Data Exporter that has failed to use reasonable efforts to determine that the Data Importer is able to satisfy its legal obligations under these clauses (the Data Exporter shall have the burden to prove that it took reasonable efforts).

(a) In the event of a dispute or claim brought by a Data Subject or the authority concerning the processing of the personal data against either or both of the parties, the parties will inform each other about any such disputes or claims, and will cooperate with a view to settling them amicably in a timely fashion.

(b) The parties agree to respond to any generally available non-binding mediation procedure initiated by a Data Subject or by the authority. If they do participate in the proceedings, the parties may elect to do so remotely (such as by telephone or other electronic means). The parties also agree to consider participating in any other arbitration, mediation or other dispute resolution proceedings developed for data protection disputes.

(c) Each party shall abide by a decision of a competent court of Singapore or of the authority which is final and against which no further appeal is possible.

(a) In the event that the Data Importer is in breach of its obligations under these clauses, then the Data Exporter may temporarily suspend the transfer of personal data to the Data Importer until the breach is repaired or the contract is terminated.

i. The transfer of personal data to the Data Importer has been temporarily suspended by the Data Exporter for longer than one month pursuant to paragraph (a);

ii. Compliance by the Data Importer with theses clauses would put it in breach of its legal or regulatory obligations in the country of import;

iii. The Data Importer is in substantial or persistent breach of any warranties or undertakings given by it under these clauses;

iv. A final decision against which no further appeal is possible of a competent court of Singapore or of the authority rules that there has been a breach of the clauses by the Data Importer or the Data Exporter; or

v. A petition is presented for the administration or winding up of the Data Importer, whether in its personal or business capacity, which petition is not dismissed within the applicable period for such dismissal under applicable law; a winding up order is made; a receiver is appointed over any of its assets; a trustee in bankruptcy is appointed, if the Data Importer is an individual; a company voluntary arrangement is commenced by it; or any equivalent event in any jurisdiction occurs then the Data Exporter, without prejudice to any other rights which it may have against the Data Importer, shall be entitled to terminate these clauses, in which case the authority shall be informed where required. In cases covered by (i), (ii), or (iv) above the Data Importer may also terminate these clauses.

(c) Either party may terminate these clauses if (i) any Commission positive adequacy decision under Singapore PDPA 2012 (or any superseding text) is issued in relation to the country (or a sector thereof) to which the data is transferred and processed by the Data Importer, or any superseding text becomes directly applicable in such country.

(d) The parties agree that the termination of these clauses at any time, in any circumstances and for whatever reason (except for termination under clause VI(c)) does not exempt them from the obligations and/or conditions under the clauses as regards the processing of the personal data transferred.

The parties may not modify these clauses except to update any information in Annex B, in which case they will inform the authority where required. This does not preclude the parties from adding additional commercial clauses where required.

The details of the transfer and of the personal data are specified in Annex B. The parties agree that Annex B may contain confidential business information which they will not disclose to third parties, except as required by law or in response to a competent regulatory or government agency, or as required under clause I(e). The parties may execute additional annexes to cover additional transfers, which will be submitted to the authority where required. Annex B may, in the alternative, be drafted to cover multiple transfers.

1. Purpose limitation: Personal data may be processed and subsequently used or further communicated only for purposes described in Annex B or subsequently authorized by the Data Subject.

2. Data quality and proportionality: Personal data must be accurate and, where necessary, kept up to date. The personal data must be adequate, relevant and not excessive in relation to the purposes for which they are transferred and further processed.

3. Transparency: Data subjects must be provided with information necessary to ensure fair processing (such as information about the purposes of processing and about the transfer), unless such information has already been given by the Data Exporter.

4. Security and confidentiality: Technical and organizational security measures must be taken by the organization that are appropriate to the risks, such as against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, presented by the processing. Any person acting under the authority of the organization, including a processor, must not process the data except on instructions from the Data Exporter.

5. Rights of access, correction and objection: As provided under the PDPA, Data Subjects must, whether directly or via a third party, be provided with the personal information about them that an organization holds, except for requests which are manifestly abusive, based on unreasonable intervals or their number or repetitive or systematic nature, or for which access need not be granted under the law of the country of the Data Exporter. Provided that the authority has given its prior approval, access need also not be granted when doing so would be likely to seriously harm the interests of the Data Importer or other organizations dealing with the Data Importer and such interests are not overridden by the interests for fundamental rights and freedoms of the Data Subject. The sources of the personal data need not be identified when this is not possible by reasonable efforts, or where the rights of persons other than the individual would be violated. Data subjects must be able to have the personal information about the rectified, amended where it is inaccurate or processed against these principles. If there are compelling grounds to doubt the legitimacy of the request, the organization may require further justifications before proceeding to rectification, amendment. Notification of any rectification, amendment to third parties to whom the data has been disclosed need not be made when this involves a disproportionate effort. A Data Subject must also be able to object to the processing of the personal data relating to him if there are compelling legitimate grounds relating to his particular situation.

6. Data used for marketing purposes: Where data is processed for the purposes of direct marketing, effective procedures should exist allowing the Data Subject at any time to "opt-out" from having his data used for such purposes.

7. Automated decisions: For purposes hereof "automated decision" shall mean a decision by the Data Exporter or the Data Importer which produces legal effects concerning a Data Subject or significantly affects a Data Subject and which is based solely on automated processing of personal data intended to evaluate certain personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct, etc. The Data Importer shall not make any automated decisions concerning Data Subjects, except when:

(a) (i) such decisions are made by the Data Importer in entering into or performing a contract with the Data Subject, and

(ii) the Data Subject is given an opportunity to discuss the results of a relevant automated decision with a representative of the parties making such decision or otherwise to make representations to that parties.

The personal data transferred concern the following categories of data subjects:

•Data subjects of the data exporter who have signed both the AppGallery and IAP user agreements and made in-app purchases;

•Data subjects of the data exporter who have signed both the AppGallery and IAP user agreements and have an active subscription within the importer service.

•Payment information except bank card information, such as the order number, amount, subscription information (subscription ID), and currency.

The personal data transferred may be disclosed only to the following recipients or categories of recipients:

The personal data transferred concern the following categories of sensitive data:

Exhibit D: Preferential Policy

AppGallery (including AppTouch), GameCenter, and EduCenter hereby release an incentive plan for 2022 and a subscription incentive plan, as a complement to the standard Commission Fee Ratio policy mentioned herein, to boost cooperation and attract Developers.

2.1 Developers who sign this Agreement for the first time on January 1, 2022 or later may apply for enrollment in the incentive plan for 2022.

2.2 Developers who signed this Agreement prior to January 1, 2022 and are currently eligible for the standard Commission Fee Ratio tier may apply for enrollment in the incentive plan for 2022.

2.3 Developers who signed this Agreement prior to January 1, 2022 and are currently eligible for the incentive plan for 2021 may apply for enrollment in the incentive plan for 2022. Please note that your participation in the incentive plan for 2021 shall expire immediately upon your successful joining in the incentive plan for 2022 and you will no longer be allowed to switch back to the incentive plan for 2021. You may also choose to continue with the incentive plan for 2021 until the expiration date of the plan and then enroll in the incentive plan for 2022.

2.4 Developers who signed this Agreement prior to January 1, 2022 and are currently eligible for the incentive plan for 2020 may apply for enrollment in the incentive plan for 2022 subsequent to the expiration date of the incentive plan for 2020.

2.5 Developers mentioned in Clauses 2.1–2.4 shall mean the Developers who distribute Paid Apps in the countries or regions listed in Part II or Part III or Part IV of Exhibit A hereto.

3. Validity Period, Termination, and Disqualification of the Incentive Plan for 2022

3.2 The incentive plan for 2022 shall remain valid unless explicitly terminated.

3.3 Huawei may terminate this Agreement and/or withdraw you from the incentive plan for 2022 upon providing you with written notice or thirty (30) days' prior written notice (if required by applicable law) if: (a) You violate any provision of this Agreement; (b) Huawei is required by law to terminate this Agreement and/or withdraw you from the incentive plan for 2022; or (c) Huawei decides to discontinue the incentive plan for 2022.

3.4 If you or any Developer in your Account Group violates this Agreement, Huawei may, upon providing you with thirty (30) days' prior written notice, disqualify your Account Group or any Developer in your Account Group from the incentive plan for 2022.

3.5 Huawei shall have the right to withhold and/or recover any payments that you receive in breach of this Agreement.

3.6 After the HUAWEI AppGallery Connect Distribution Service Agreement for Paid Apps signed by a Developer from your Account Group is terminated, the HUAWEI Developers website will automatically remove the Developer and its Account from your Account Group and disqualify the Developer from the incentive plan for 2022.

3.7 You may terminate this Agreement and withdraw from the incentive plan for 2022 upon written notice to Huawei.

4.1.1 In order to be eligible for the incentive plan for 2022, a Developer must meet the following requirements: (1) meet the requirements for eligibility as stated in Clause 2 above; (2) agree and conform to this Agreement and the incentive plan for 2022 on the AppGallery Connect website on January 1, 2022 or later; and (3) successfully create an Account Group on the HUAWEI Developers website and submit information about all associated Developers, or join the Account Group created by a Developer associated with you.

(1) If the total settlement amount from all the transactions within your Account Group does not exceed three hundred thousand U.S. dollars (US$300,000), each Developer Account in your Account Group (hereinafter, the "Associated Account") will be eligible to a Commission Fee Ratio of fifteen percent (15%) every calendar year. Otherwise, the Associated Accounts will be eligible to a Commission Fee Ratio of fifteen percent (15%) for the transactions within the first three hundred thousand U.S. dollars (US$300,000) of the total settlement amount in a calendar year, and then to the standard Commission Fee Ratio for the rest of the year. All other provisions contained in Clause 4 of this Exhibit shall be complied with.

(2) To determine whether the threshold of three hundred thousand U.S. dollars (US$300,000) mentioned in the above clause is exceeded, the total settlement amount of each Associated Account in a calendar year shall be aggregated.

(3) For Developers participating in the incentive plan for 2022, Huawei will no longer deduct the Channel Deduction when calculating total settlement amounts.

(4) For any Associated Account or product that is transferred from one Account Group to another within a calendar year, its total settlement amount accumulated from the effective date of the incentive plan for 2022 (e.g. January 1 of a calendar year, or the date of activating the incentive plan) to the transfer date shall be credited to both the original and latter Account Groups, and shall be counted when whether the three hundred thousand U.S. dollars (US$300,000) threshold is exceeded is determined. All the total settlement amount generated from the Associated Account or product subsequent to the transfer date shall be credited to the latter Account Group.

(5) If the accumulated total settlement amount in a calendar year changes after settlement due to reasons such as refund to users, Huawei will not retroactively adjust the historical Commission Fee Ratio.

(1) Developers may create an Account Group by following the Operation Guide on HUAWEI Developers and submit information about all associated Developers, or join an Account Group created by an associated Developer and sign the latest HUAWEI AppGallery Connect Distribution Service Agreement for Paid Apps. The incentive plan for 2022 will become effective from the first day of the month following your creation or joining of an Account Group (hereinafter, the "Activation Date"), and you will be entitled to a preferential Commission Fee Ratio from the Activation Date in accordance with Clause 4.2.

(2) Developers who perform the operations stated above in January 2022 will be entitled to the incentive plan for 2022 from January 1, 2022.

(1) You warrant that you shall neither bypass the stipulations herein nor gain eligibility for the preferential Commission Fee Ratio mentioned in Clause 4.2 by creating multiple Developer Accounts, establishing multiple subsidiaries, or transferring your products to other Developer Accounts.

(2) You represent and warrant that any and all the information provided by you to Huawei in connection with this Agreement and the Account Group shall remain up-to-date, authentic, accurate, integral, legal, valid, and provable.

5.1 Eligibility, Validity Period, and Termination of the Subscription Incentive Plan

(1) To be eligible for the subscription incentive plan, a Developer must meet the following requirements: (a) distribute Paid Apps in the countries or regions listed in Part II or Part III or Part IV of Exhibit A hereto; and (b) have signed this Agreement.

(2) The subscription incentive plan shall apply to non-game apps in which auto-renewable subscriptions are sold.

(2) The subscription incentive plan shall remain valid unless explicitly terminated.

(1) Huawei may terminate the subscription incentive plan upon providing you with written notice or thirty (30) days' prior written notice (if required by applicable law) if: (a) You violate any provision of this Agreement; (b) Huawei is required by law to terminate the subscription incentive plan; or (c) Huawei decides to discontinue the subscription incentive plan.

(2) Huawei shall have the right to withhold and/or recover any payments that you receive in breach of this Agreement.

(1) The subscription incentive plan shall apply to apps distributed to the countries or regions listed in Part II or Part III or Part IV of Exhibit A hereto.

(2) The subscription incentive plan shall apply to auto-renewable subscriptions in non-game apps.

(3) Developers will be eligible to a Commission Fee Ratio of fifteen percent (15%) for the total settlement amount generated from auto-renewable subscriptions.

(4) Huawei will no longer deduct the Channel Deduction when calculating total settlement amounts.

(1) A Developer (a) will be eligible to the standard Commission Fee Ratio for the total settlement amount generated from in-app non-subscription products (consumable and non-consumable); and (b) will be eligible to a Commission Fee Ratio of fifteen percent (15%) for the total settlement amount generated from in-app auto-renewable subscriptions if (a) the standard Commission Fee Ratio applies to the Developer; and (b) the Developer is eligible for the subscription incentive plan for 2022.

(2) If a Developer and their Account Group are eligible to the incentive plan for 2022 and subscription incentive plan, (a) for the first three hundred thousand U.S. dollars (US$300,000) of the total settlement amount generated from product catalogue (consumable, non-consumable, and auto-renewable subscription) in the app to which the Associated Accounts belong, the Developer will be eligible to a Commission Fee Ratio of fifteen percent (15%); and (b) for the remaining amount (excluding the US$300,000) of the total settlement amount from product catalogue (consumable, non-consumable, and auto-renewable subscription) in the app to which the Associated Accounts belong, the Developer will be eligible to the standard Commission Fee Ratio for the total settlement amount generated from non-subscription products (consumable and non-consumable), and a Commission Fee Ratio of fifteen percent (15%) for the total settlement amount generated from auto-renewable subscriptions. The threshold of the total settlement amount of three hundred thousand U.S. dollars (US$300,000) for a calendar year in the incentive plan and other related matters shall comply with the provisions in Clause 4 of this Exhibit.

To be eligible for the subscription incentive plan, a Developer must meet the requirements stated above.

A. Incentive plan for 2021 (valid for twenty-four [24] calendar months following a Developer's first signing of this Agreement from January 1, 2021 to December 31, 2021)

B. Incentive plan for 2020 (valid for twenty-four [24] calendar months following a Developer's first signing of this Agreement from January 1, 2020 to December 31, 2020)

A. The revenues generated in a period when no Preferential Policy is valid shall be shared in accordance with the standard ratio, while other revenues shall be shared as per the applicable incentive plan. For example, a Developer who had never signed HUAWEI AppGallery Connect Distribution Service Agreement for Paid Apps and signed this Incentive Plan in January 2021 shall be eligible for the (a) preferential ratio for twenty-four (24) calendar months and (b) promotion fund rebate for twelve (12) calendar months, starting from January 2021.

The incentive periods for the 2021 incentive plan are listed below. The exact incentive amounts shall be determined by settlement records.

The incentive periods for the 2020 incentive plan are listed below. The exact incentive amounts shall be determined by settlement records.

B. The promotion fund allocated for the incentive plan for 2021 is a virtual fund that is (a) proportional to Huawei's commission fee for providing the AppGallery Distribution Service for a paid app and (b) channeled to the respective developer, who shall use it only to pay for promotions via Huawei apps, such as AppGallery, GameCenter, and EduCenter. Such funds aim to help developers expand their user bases. The promotion fund for a quarter will be calculated and transferred to the respective developer's promotion fund account by the 15th day (postponed in the case of holidays) of the first month (i.e. January, April, July, and October) of the following quarter. Promotion funds cannot be withdrawn as cash. A promotion fund shall remain valid for twelve (12) calendar months from the allocation date and be cleared upon expiration.

D. The standard commission fee ratio shall be effective upon the end of the preferential period defined in the applicable incentive plan.

7. All the dates and times mentioned in this exhibit shall be China Standard Time (GMT+8).

App Category	Standard Commission Fee Ratio Charged by Huawei	Preferential Commission Fee Ratio Charged by Huawei	Promotion Fund Rebate (Percentage of the Commission Fee Charged by Huawei)
Education	20%	15%	15%	25%	Not applicable
Gaming	30%	20%	20%	25%	Not applicable
Media and entertainment, tools, communication, books and references, photography, food and drink, travel and navigation, travel and accommodation, shopping, business, kids, finance, sports and health, lifestyle and convenience, cars, and personalized themes	30%	15%	15%	25%	Not applicable

App Category	Standard Commission Fee Ratio Charged by Huawei	Preferential Commission Fee Ratio Charged by Huawei
Education	20%	0%	10%
Gaming	30%	15%	15%
Media and entertainment, tools, communication, books and references, photography, food and drink, travel and navigation, travel and accommodation, shopping, business, kids, finance, sports and health, lifestyle and convenience, cars, and personalized themes	30%	0%	15%

1 Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915.

2 This requires rendering the data anonymous in such a way that the individual is no longer identifiable by anyone, in line with recital 26 of Regulation (EU) 2016/679, and that this process is irreversible.

3 The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union's internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses.

4 That period may be extended by a maximum of two more months, to the extent necessary taking into account the complexity and number of requests. The data importer shall duly and promptly inform the data subject of any such extension.

5 The data importer may offer independent dispute resolution through an arbitration body only if it is established in a country that has ratified the New York Convention on Enforcement of Arbitration Awards.

6 As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.

Distribution Area	Registration Location of Developer	Currency	Minimum Settlement Amount
Chinese mainland in Part I of Exhibit A "List of Countries/Regions"	Chinese mainland	CNY	0
	Outside the Chinese mainland	CNY	CNY1000
Countries/Regions in Part II of Exhibit A "List of Countries/Regions"	All	EUR	€200
Countries/Regions in Part III of Exhibit A "List of Countries/Regions"	All	EUR	€200
Countries/Regions in Part IV of Exhibit A "List of Countries/Regions"	Chinese mainland	EUR	€200
	Outside the Chinese mainland	EUR	€3000

Data importer	Data exporter
Place Data Protection Contact here	Huawei: datamanagement.hshk@huawei.com
	AppTouch Provider: AppTouch Provider DPO

Policy Scenario		Total Settlement Amount of A Calendar Year	Commission Fee Ratio (Developer: Huawei) for Non-subscription Products (Consumable and Non-consumable)	Commission Fee Ratio (Developer: Huawei) for Auto-renewable Subscriptions


1	Standard Commission Fee Ratio + Subscription incentive plan	N/A	Standard Commission Fee Ratio	85%: 15%
2	Incentive plan for 2022 + Subscription incentive plan	First US$300,000 (≤ US$300,000)	85%: 15%	85%: 15%
		Remaining amount (excluding the US$300,000)	Standard Commission Fee Ratio	85%: 15%

Developer	Incentive Plan Signing Month	First Month of the Incentive Plan Period	Last Month of the Incentive Plan Period
Developer who has never signed this Agreement before	Jan 2021	Jan 2021	Dec 2022
	Feb 2021	Feb 2021	Jan 2023
	Mar 2021	Mar 2021	Feb 2023
	Apr 2021	Apr 2021	Mar 2023
	May 2021	May 2021	Apr 2023
	Jun 2021	Jun 2021	May 2023
	Jul 2021	Jul 2021	Jun 2023
	Aug 2021	Aug 2021	Jul 2023
	Sep 2021	Sep 2021	Aug 2023
	Oct 2021	Oct 2021	Sep 2023
	Nov 2021	Nov 2021	Oct 2023
	Dec 2021	Dec 2021	Nov 2023

Developer	Incentive Plan Signing Month	First Month of the Incentive Plan Period	Last Month of the Incentive Plan Period
Developer who has never signed this Agreement before	Jan 2020	Jan 2020	Dec 2021
	Feb 2020	Feb 2020	Jan 2022
	Mar 2020	Mar 2020	Feb 2022
	Apr 2020	Apr 2020	Mar 2022
	May 2020	May 2020	Apr 2022
	Jun 2020	Jun 2020	May 2022
	Jul 2020	Jul 2020	Jun 2022
	Aug 2020	Aug 2020	Jul 2022
	Sep 2020	Sep 2020	Aug 2022
	Oct 2020	Oct 2020	Sep 2022
	Nov 2020	Nov 2020	Oct 2022
	Dec 2020	Dec 2020	Nov 2022

Type	App Category	Standard Commission Fee Ratio Charged by Huawei		Note
Type	App Category	Chinese mainland	Other countries or regions	Note
Downloading (including AppTouch)	Education	20%	20%	App features and content: Such as the ad-free version of the App, or new features or services that are not included in the free version. Subscription services: Such as online music, videos, books, or other media services, digital publications (including digital content bundled with physical publications), and social networking services. Digital Content: Including but not limited to game currency, gems, additional lives or rounds, special props or equipment, character or avatar, additional levels or game time, or information content products.
	Gaming	30%	30%
	Media and entertainment, tools, communication, books and references, photography, food and drink, travel and navigation, travel and accommodation, shopping, business, kids, finance, sports and health, lifestyle and convenience, cars, and personalized themes	30%	30%
In-App purchase (subscriptions included) or Digital Content purchase (subscriptions included) (including AppTouch)	Education	20%	20%
	Gaming	50%	30%
	Media and entertainment, tools, communication, books and references, photography, food and drink, travel and navigation, travel and accommodation, shopping, business, kids, finance, sports and health, lifestyle and convenience, cars, and personalized themes	30%	30%
AppTouch	Membership Subscription	Not applicable	70%	The Commission Fee Ratio charged by Huawei includes the ratio charged by AppTouch Partner. The Preferential Policy specified in Exhibit D does not apply to this app category.
Other				The relevant service agreement shall prevail.

App Category	Standard Commission Fee Ratio Charged by Huawei	Preferential Commission Fee Ratio Charged by Huawei		Promotion Fund Rebate (Percentage of the Commission Fee Charged by Huawei)
App Category	Standard Commission Fee Ratio Charged by Huawei	Months 1–12	Months 13–24	Months 1–12	Months 13–24
Education	20%	15%	15%	25%	Not applicable
Gaming	30%	20%	20%	25%	Not applicable
Media and entertainment, tools, communication, books and references, photography, food and drink, travel and navigation, travel and accommodation, shopping, business, kids, finance, sports and health, lifestyle and convenience, cars, and personalized themes	30%	15%	15%	25%	Not applicable

目录