Where required by EU Data Protection Law, Intrro will allow Customer (directly or through a third-party auditor subject to written confidentiality obligations) to conductan audit of Intrro’s procedures relevant to the protection of Customer Personal Data to verify Intrro’s compliance with its obligations under this DPA. In such case, any audit conducted under this DPA shall consist of examination of the most recent reports, certificates and/or extracts prepared by an independent auditor bound by confidentiality provisions similar to those set out in the Agreement. In the event that provision of the same is not sufficient under EU Data Protection Law, the Customer may at its own expense conduct a more extensive audit which will be:

(a) limited in scope to matters specific to the Customer and agreed in advance with the Intrro;

(b) carried out during EU business hours and upon reasonable notice which shall be not less than 4 weeks unless an identifiable material issue has arisen; and

(c) conducted in a way which does not interfere with the Intrro’s day-to-daybusiness;

(d) undertaken no more than once in any 12-month period, except where required by a competent Supervisory Authority or where an audit is required due to a Customer Personal Data Breach.

To that end and before the commencement of any such audit, Customer and Intrro shall mutually agree upon the audit’s participants, schedule and scope, which shall in no event permit Customer or its third-party auditor to access the Services’ hosting sites, underlying systems or infrastructure. Representatives of Customer performing an audit shall protect the confidentiality of all information obtained through such audits in accordance with the Agreement, may be required to execute an enhanced mutually agree able nondisclosure agreement and shall abide by Intrro’s security policies while on Intrro’s premises. Upon completion of an audit, Customer agrees to promptly furnish to Intrro any written audit report or, if no written report is prepared, to promptly notify Intrro of any non-compliance discovered during the course of the audit. Customer shall reimburse Intrro for its time expended in connection with an audit at Intrro’sthen-current professional service rates, which shall be made available to Customer upon request and shall be reasonable taking into account the time and effort required by Intrro.