Exhibit 99.2

Execution Version

GENOMICS INNOVATIONS COMPANY LIMITED

(“Company”)

and

CENTOGENE N.V.

(“NV”)

dated 27 November 2023

CONSULTANCY AGREEMENT

related to

KSA FACILITY

CONTENTS

Clause		Page
1.	Definitions; Interpretation; Conflicts	1
2.	Engagement and Scope of Authority	1
3.	NV’s Obligations and Responsibilities	3
4.	Company’s Obligations and Responsibilities	4
5.	FEES	5
6.	TAXES	8
7.	Standards	10
8.	COOPERATION	11
9.	NV Personnel	11
10.	Data Protection AND CYBERSECURITY	11
11.	Term	12
12.	Representations and Warranties	13
13.	Intellectual Property Rights	13
14.	Confidential information	14
15.	Indemnities	16
16.	Limitation of Liability	18
17.	Force Majeure	19
18.	Insurance	20
19.	Termination	20
20.	Notices	23
21.	Assignment and Subcontracting	25
22.	Costs	25
23.	Audit	25
24.	Language	26
25.	Cooperation with Regulators	26
26.	Anti-Bribery and Corruption	26
27.	Export Control and Sanctions	26
28.	Further Assurance	27
29.	Required Consents	27
30.	Rights of Third Parties	27
31.	Waiver and Variation	27
32.	Severability	28
33.	Governing Law; ARBITRATION AND JURISDICTION	28
34.	Entire Agreement	28
35.	Counterparts	29

ii 

Schedule 1 DEFINED TERMS AND INTERPRETATION	31
Part 1 - Defined Terms	31
Part 2 - Interpretation	39
Schedule 2   SCOPE OF NV SERVICES	40
Schedule 3 PERSONAL DATA AND INFORMATION SECURITY	51
Schedule 4 STAFFING AND SECONDMENT	75

iii 

CONSULTANCY AGREEMENT

This CONSULTANCY AGREEMENT (the “Agreement”) is dated 27 November 2023 (the “Effective Date”), and is entered into by and between:

(1) GENOMICS INNOVATIONS COMPANY LIMITED, a company organized under the laws of the Kingdom of Saudi Arabia with a registered office at Building No. 3936, 6651 Al Nakheel District, 12382 Riyadh, Kingdom of Saudi Arabia (“Company”); and

(2) CENTOGENE N.V., a company organized under the laws of the Netherlands with a registered office at Am Strande 7, 18055 Rostock, Germany (“NV”).

Company and NV shall be referred to herein either individually as a “Party” or together as the “Parties”.

WHEREAS:

(A) NV and its Affiliates (as defined below) have developed and maintain certain laboratories and a biodatabank relating to patient samples collected in the ordinary course of its diagnostics business at a site located in Rostock, Germany (“NV Facility”);

(B) Company and NV have entered into a Joint Venture Agreement dated 26 June 2023 (the “Joint Venture Agreement”) for the establishment of Company and the operation of the KSA Facility in the Kingdom;

(C) Company and NV have entered into a Technology Transfer and Intellectual Property License Agreement dated 27 November 2023 (“Technology Transfer and Intellectual Property License Agreement”) for the purposes of transferring and licensing certain technology and data from NV to Company in relation to the establishment of the KSA Facility;

(D) Company and NV have entered into a Laboratory Services Agreement dated 27 November 2023 (“Laboratory Services Agreement”) whereby NV or its Affiliates shall act as the exclusive provider of certain laboratory and diagnostic services to Company;

(E) Company desires to receive the NV Services (as defined in clause 3.1) to support Company in the construction and operation of the KSA Facility and NV desires to provide the NV Services pursuant to the terms and conditions set forth herein; and

(F) The Parties now desire to enter into this Agreement to document such terms and conditions.

NOW, THEREFORE, in consideration of the foregoing premises and the mutual covenants contained herein, and for other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, and intending to be legally bound, the Parties hereby agree as follows:

1. Definitions; Interpretation; Conflicts

Capitalized terms used in this Agreement shall have the meanings given in Part 1 (Defined Terms) of Schedule 1 (Defined Terms and Interpretation). This Agreement shall be interpreted in accordance with Part 2 (Interpretation) of Schedule 1 (Defined Terms and Interpretation).

2. Engagement and Scope of Authority

2.1 Engagement

1 

2.1.1 Subject to the terms and conditions of this Agreement, during the Term, Company hereby engages NV and its Affiliates, and NV and its Affiliates hereby agree to be so engaged, as the exclusive provider of the NV Services to support Company with its operation of the KSA Facility in accordance with Applicable Law; provided that Company shall have the ability to obtain related Third Party Services from the Third Party Service Providers, at Company’s sole cost and expense, as needed to perform such Third Party Services at the KSA Facility in consultation with NV.

2.1.2 NV shall provide, or shall cause to be provided, the NV Services (as defined in clause 3.1):

(a) in a professional and workmanlike manner; and

(b) by applying Commercially Reasonable Efforts to provide levels of accuracy, quality, completeness, timeliness, and care consistent with the levels provided by NV and its Affiliates at the NV Facility.

2.1.3 In the event NV is unable to or materially fails to provide one or more of the NV Services to Company’s reasonable satisfaction and such inability or failure continues for more than thirty (30) days following written notice from Company adequately describing such inability or material failure, then without prejudice to any other rights and remedies Company may have under this Agreement, Company shall have the right to engage other third-party service providers at Company’s discretion and NV’s sole cost and expense to provide such services; provided that NV shall not be responsible for any acts or omissions by any such third-party service provider that adversely affect NV’s provision of the NV Services.

2.1.4 In accordance with the terms of this Agreement:

(a) in consideration of NV’s and its Affiliates’ performance of its obligations under this Agreement (including with respect to Schedule 2 (Scope of Services)), Company shall pay to NV the Fees due under this Agreement and shall comply with its other obligations under this Agreement; and

(b) in consideration for the payment of the Fees due under this Agreement and Company performing its obligations under this Agreement, NV shall provide (or subject to clause 21.1, cause to be provided) the NV Services in accordance with the terms of this Agreement and comply with its other obligations under this Agreement.

2.2 Status

NV and its Affiliates at all times shall be deemed an independent contractor and neither it nor any of its Affiliates or any of their respective employees, directors, contractors, subcontractors or outside consultants shall be considered to be an agent, servant, employee or representative of Company.

2.3 Retention of Control by Company and Limitation on Authority

Company and NV expressly acknowledge and agree that this Agreement does not convey ownership or Control over all or any part of Company or the KSA Facility to NV. Company owns and Controls all rights to the KSA Facility, subject to the terms of the Technology Transfer and Intellectual Property License Agreement.

2.4 NV shall not, pursuant to this Agreement, take any actions:

2 

2.4.1 that require the prior approval of or are reserved to the Board of Directors, or the Shareholders, without first ensuring that such actions have been approved by the applicable governing body, or otherwise contravene any approval right under the Joint Venture Agreement;

2.4.2 that contravene policies adopted by Company or any directives issued by the Board of Directors, in each case that have been provided to NV in advance in writing; or

2.4.3 on behalf of, or assume, create or incur liability or obligation, against, in the name of, or on behalf of, any of Company, any Shareholder or the KSA Facility, except to the extent expressly permitted under this Agreement or authorized in writing by or on behalf of Company.

2.5 Company shall not, pursuant to this Agreement, take any actions:

2.5.1 that contravene policies relating to the provision of NV Services adopted by NV that have been provided to Company in advance in writing; or

2.5.2 on behalf of, or assume, create or incur liability or obligation, against, in the name of, or on behalf of, NV, its Affiliates or the NV Facility, except to the extent expressly authorized in writing by or on behalf of NV or otherwise expressly permitted under this Agreement.

3. NV’s Obligations and Responsibilities

3.1 Scope of NV Services

Subject to the terms and conditions of this Agreement, NV shall (or shall cause its Affiliates to) make available and provide to Company the services described in Schedule 2 (Scope of Services) and such other services as the Parties reasonably determine necessary to pursue the goal of achieving performance of the KSA Facility as a diagnostics centre, laboratory and biodatabank, in accordance with the same or substantially similar standards as the NV Facility, including Accreditation (collectively, “NV Services”).

3.2 Cooperation with Others

NV shall use Commercially Reasonable Efforts to cooperate with any Third Party Service Provider or other third party service providers engaged by Company pursuant to clause 2.1.1 in connection with the provision of the NV Services. Company shall use Commercially Reasonable Efforts to facilitate the cooperation of Third Party Service Providers or other third party service providers engaged by Company pursuant to clause 2.1.1 in connection with the provision of the NV Services under this Agreement.

3.3 NV Representative

3.3.1 NV shall designate a representative (the “NV Representative”) who shall be NV’s relationship manager for purposes of this Agreement and to facilitate NV’s provision of the NV Services under, and the administration of, this Agreement. At all times, NV shall designate a NV Representative who has the qualifications, expertise, industry experience and prior relationship with NV to assure Company that such NV Representative would successfully fulfil the role he or she is engaged to provide under this Agreement. The initial NV Representative shall be Miguel Coego. In the event NV is intending to replace the NV Representative, NV shall inform Company of such intent and provide a reasonable explanation for the replacement need at least ten (10) Business Days prior to replacing the NV Representative to the extent

3 

reasonably practicable. NV shall ensure that any such replacement shall meet all of Company’s requirements as provided herein.

3.3.2 If Company is not reasonably satisfied with the NV Representative, it shall provide detailed information to NV regarding its reasons for dissatisfaction and NV shall use Commercially Reasonable Efforts to address the reasons presented by Company. If after such Commercially Reasonable Efforts have been made, Company still remains dissatisfied with the NV Representative, NV shall remove and replace such NV Representative as soon as reasonably practicable, and such replacement shall otherwise meet the qualifications as described in clause 3.3.1.

3.4 NV Records

NV shall keep such business, financial and other records and other documentation as consistent with NV’s retention policies relating to its activities undertaken in connection with the provision of the NV Services, in accordance with Applicable Law and shall, if required pursuant to clause 23 of this Agreement, make such records available for inspection and/or provide copies thereof to an independent professional firm chosen and/or appointed by Company, provided such auditor is reasonably acceptable to NV.

3.5 Good Faith

NV will act in good faith to comply with its obligations under this Agreement.

4. Company’s Obligations and Responsibilities

4.1 Information

Company, at its reasonable discretion shall provide, or cause to be provided, to NV and its Affiliates copies of business, financial and other records or documentation relating to the KSA Facility that Company deems reasonably necessary for NV and its Affiliates to possess, or NV reasonably requests, in order to provide the NV Services.

4.2 Site Access

Company shall provide, or cause to be provided, to NV and its Affiliates reasonable access to the KSA Facility to the extent required for NV and its Affiliates to provide the NV Services. NV and its Affiliates will abide by all site health, safety and other procedures and policies established at the KSA Facility of which Company has provided reasonable advance written notice to NV or NV Personnel.

4.3 Project Information Systems

Company shall cause NV and its Affiliates to be provided with reasonable access to the KSA Facility’s:

(a) financial system;

(b) accounting and management maintenance system; and

(c) other information systems,

in each case in clauses (a)-(c) above, solely to the extent required for NV to perform the NV Services hereunder.

4.4 Company Records

4 

Company shall keep such business, financial and other records and other documentation as consistent with industry standards relating to its activities undertaken in connection with the receipt of the NV Services, in accordance with Applicable Law.

4.5 Good Faith

Company will act in good faith to comply with its obligations under this Agreement.

4.6 Company Representative

Company shall designate a representative (the “Company Representative”) who shall be Company’s relationship manager for purposes of this Agreement and to facilitate Company’s receipt of the NV Services under, and the administration of, this Agreement. At all times, Company shall designate a Company Representative who has the qualifications, expertise and industry experience to assure NV that such Company Representative would successfully fulfil the role he or she is engaged to provide under this Agreement. The initial Company Representative shall be Jeremy Panacheril. In the event Company is intending to replace the Company Representative, Company shall inform NV of such intent and provide an explanation for the replacement need at least ten (10) Business Days prior to replacing the Company Representative. Company shall ensure that any such replacement shall meet all of the requirements as provided herein.

5. FEES

5.1 Fees

5.1.1 In consideration for NV’s provision of the NV Services and performance of its obligations under this Agreement, Company shall pay to NV:

(a) the Project Consultation Fee as determined pursuant to clause 5.2 below; and

(b) the Fixed Performance Fee as determined pursuant to clause 5.3 below,

(collectively, the “Fees”).

5.1.2 The Fees are the only amounts payable by Company to NV in respect of NV’s provision of the NV Services and performance of its other obligations in this Agreement.

5.2 Project Consultation Fee

Company shall pay to NV, for the services provided by any NV Personnel, a fee (the “Project Consultation Fee”) of an amount equal to:

5.2.1 for all Seconded Personnel (including, for the avoidance of doubt, the Approved Seconded Personnel), all reasonable costs and expenses incurred by NV in connection with the NV Services provided by such Seconded Personnel as mutually agreed between the Parties in writing, in advance, including, for the avoidance of doubt, the wages and benefits of such Seconded Personnel during the period of secondment, and any federal, state, local or foreign Taxes owed by Company in respect of the payment of such wages or benefits, including any employer and/or withholding Taxes;

5.2.2 for Other Personnel, all reasonable costs and expenses incurred by NV in connection with the NV Services provided by such Other Personnel as mutually agreed between the Parties in writing, in advance, including, for the avoidance of doubt, the wages

5 

and benefits of such Other Personnel attributable to the period during which such Other Personnel provide the NV Services and any federal, state, local or foreign Taxes owed by Company in respect of the payment of such wages or benefits, including any employer and/or withholding Taxes; and

5.2.3 any and all costs and expenses (other than those covered by clauses 5.2.1 and 5.2.2) that are directly related to the provision of the NV Services that are mutually agreed between the Parties in advance and in writing, including reasonable expenses incurred in connection with NV’s use of any consultants and permitted subcontractors (pursuant to clause 21.1), such as reasonable travel, housing, logistics, daily allowances, project bonuses, expat packages and other reasonable costs and expenses related to the preparation of the NV Services by NV Personnel incurred prior to the Effective Date.

5.3 Fixed Performance Fee

5.3.1 Upon the achievement of each milestone event by NV set forth below (each, an “Operational Milestone”), and subject to clause 5.3.2, Company shall pay to NV the corresponding milestone-based fee (the “Operational Milestone Fee”) in accordance with the payment schedule set out below:

Operational Milestone	Operational Milestone Fee	Criteria for demonstrating achievement of Operational Milestone	Estimated timeline for completion of Operational Milestone
Build-up and transfer of wet lab capable of conducting the wet-lab services described in Phase 4 of Schedule 2 (Scope of Services) (“First Operational Milestone”)	SAR Twenty million (20,000,000.00)	[***]	[***]
Accreditation of wet lab and dry lab, with stand-alone Accreditation for Company (“Second Operational Milestone”)	SAR Twenty million (20,000,000.00)	[***]	[***]

5.3.2 In the event NV fails to achieve either Operational Milestone within the corresponding timeline set forth above, and such failure is due to NV’s or NV’s Affiliates’ failure to perform the applicable NV Services for a reason within NV’s control, Company shall have the right to reduce the Operational Milestone Fee corresponding to such Operational Milestone by:

(a) fifteen percent (15%) if such Operational Milestone is achieved more than three (3) months following the corresponding estimated timeline for completion set forth above; and

6 

(b) an additional fifteen percent (15%) if such Operational Milestone is achieved more than six (6) months following the corresponding estimated timeline for completion set forth above.

The Parties agree that failure to meet any Operational Milestone for any of the following reasons shall not be deemed to be within NV’s control:

(i) any negligent acts or omissions taken by Company or any of its Affiliates in relation to the KSA Facility under this Agreement;

(ii) changes to Applicable Law;

(iii) any actions by any Governmental Authority or Regulator in relation to the KSA Facility; or

(iv) any Force Majeure Event.

5.3.3 NV shall only be entitled to submit an Invoice for the applicable Operational Milestone Fee for each Operational Milestone after the corresponding criteria for achievement of such Operational Milestone has been achieved. Any dispute as to the achievement of the relevant criteria shall be dealt with in accordance with clause 33.2 of this Agreement.

5.3.4 Upon the achievement by Company of each milestone event set forth below (each, a “Commercial Milestone”), Company shall pay to NV the corresponding milestone-based fee (the “Commercial Milestone Fee”, and together with the Operational Milestone Fee, the “Fixed Performance Fee”) in accordance with the payment schedule set out below:

Commercial Milestone	Commercial Milestone Fee
Company achieving an annual Net Revenue of SAR Two hundred million (200,000,000.00)	SAR Forty million (40,000,000.00)
Company achieving an annual Net Revenue of SAR Three hundred million (300,000,000.00)	SAR Forty million (40,000,000.00)
Company achieving an annual Net Revenue of SAR Four hundred and sixty million (460,000,000.00)	SAR Forty million (40,000,000.00)

Each Commercial Milestone Fee will be payable only one time and upon the later of: (a) achievement of the applicable Commercial Milestone; and (b) achievement of the Second Operational Milestone. The Commercial Milestone Fee will be paid within sixty (60) days of the achievement of the later of clause (a) or (b).

5.3.5 With respect to any Commercial Milestone, NV shall only be entitled to submit an Invoice for the applicable Commercial Milestone Fee for such Commercial Milestone after the corresponding criteria for achievement of such Commercial Milestone has

7 

been achieved in accordance with clause 5.3.4. Any dispute as to the achievement of the relevant criteria shall be resolved in accordance with clause 33.2 of this Agreement.

5.3.6 Subject to any termination for cause by Company under clause 19.2, Company’s obligation to pay the Commercial Milestone Fees shall survive the expiration or earlier termination of this Agreement and shall be paid to Company when such Commercial Milestone has been achieved; provided that if any Commercial Milestone is not achieved by the tenth (10^th) anniversary of the date of expiration or termination of this Agreement, NV shall no longer be entitled to receive any such unpaid Commercial Milestone Fee and Company’s obligations with respect to the payment thereof shall terminate.

5.3.7 NV shall invoice Company on a monthly basis (each, an “Invoice”) for an amount equal to:

(a) the Project Consultation Fee incurred by NV for the preceding month; and

(b) any Fixed Performance Fees payable to NV for the preceding month,

together with time sheets and details of actual costs and expenses incurred for the applicable NV Personnel to evidence that the amounts so invoiced by NV are accurate. Each Invoice shall comply with local VAT requirements (either in KSA or Germany).

5.3.8 Subject to clause 5.3.10, Company shall pay to NV all undisputed amounts set forth in an Invoice within thirty (30) days of Company’s receipt of the Invoice.

5.3.9 All payments of the Project Consultation Fees from Company to NV shall be payable in Euros (EUR). All payments of the Fixed Performance Fees from Company to NV shall be payable in Saudi Arabian Riyals (SAR). The Fees shall be paid by wire transfer in immediately available funds into such bank account nominated by NV to Company in writing prior to the relevant payment of the Fees. Company shall be liable for all bank charges relating to such wire transfers for the Fees.

5.3.10 Company may withhold payment of any part of an Invoice that it disputes in good faith. Company and NV will establish a working level committee and a process to address any dispute that Company has about an Invoice. Company shall pay any undisputed portion of an Invoice as provided in this clause 5. If a Dispute about an Invoice is not resolved within thirty (30) days of Company’s receipt of the Invoice, then it will be resolved pursuant to the Dispute resolution procedures set out in clause 33.2 of this Agreement.

5.3.11 Company may set-off any amounts due from NV or its Affiliates to Company pursuant to any agreement between Company and NV or its Affiliates, against any charges or expenses payable by Company to NV or its Affiliates. For the avoidance of doubt, any set-off shall not impact the obligations of a Party under clause 6.

5.3.12 If any undisputed payment due to NV under this Agreement is not paid by the applicable due date, NV may charge Company interest on any outstanding amount of such payment, accruing as of the original due date, at an annual rate equal to the prime rate (as reported in The Wall Street Journal (U.S. edition)) plus one percentage point (1%) or the maximum rate allowable by Applicable Law, whichever is less.

8 

6. TAXES

6.1 Without prejudice to the generality of clause 6.2 below, the Fees payable in accordance with this Agreement shall be exclusive of any additional Taxes, levies or fees that may apply to the provision of the NV Services. Any such Taxes, levies or fees shall be payable in addition to, and at the same time and in the same manner as, the Fees against provision by NV to Company of an invoice for the same; provided that Company shall only be responsible for withholding taxes if NV does not have a permanent establishment in KSA. Any additional Taxes shall not include any taxes, levies or fees applicable to NV for a taxable presence in KSA relating to a permanent establishment for corporation income tax. Any Taxes relating to the permanent establishment of NV shall be solely borne by NV and not Company.

6.2 All amounts, monetary or otherwise, expressed under this Agreement which (in whole or in part) constitute the consideration for any supply for VAT purposes by NV are deemed to be exclusive of any VAT which is chargeable on that supply, and accordingly if VAT is or becomes chargeable on any supply made by NV to any Party under this Agreement and NV is required to account to the relevant tax authority for VAT on that supply, Company must pay to NV (in addition to and at the same time as paying any other consideration for such supply, or at the point the VAT becomes due to be paid or accounted for by NV if earlier) an amount equal to the amount of that VAT (and NV must promptly provide an appropriate VAT invoice to Company where so required to by Applicable Law). In this clause 6.2, references to “NV” shall include reference to a relevant Affiliate of NV. NV shall provide a valid tax invoice to Company.

6.3 In relation to any supply made by NV (or a relevant Affiliate) to Company under this Agreement, if reasonably requested by Company, NV must promptly provide Company with details of NV’s (or the relevant Affiliate’s) VAT registration and such other information as is reasonably requested in connection with Company’s VAT reporting requirements in relation to such supply.

6.4 The following provisions shall apply should any payment in respect of any Fees from Company to NV be subject by Applicable Law to any deduction or withholding on account of Tax:

6.4.1 The Tax Deduction will be made in the minimum amount permitted by Applicable Law and Company shall account to the relevant tax authority for the same, in full and within all applicable time limits; provided that any late payment fees or penalties associated with Company’s failure to comply with this clause 6.4.1 shall be borne solely by Company.

6.4.2 Company shall provide evidence, reasonably satisfactory to NV, of the Tax Deduction and any relevant payment to a tax authority on written request from NV to Company.

6.4.3 NV shall (or shall procure that a relevant Affiliate shall), on written request from Company, provide a declaration of Tax residence on the prescribed forms and obtain certification by the relevant taxation authority in order to confirm the applicability and availability of any reduced rate of withholding on account of Tax, pursuant to the provisions of any relevant double taxation treaties or otherwise.

6.4.4 If a Tax Deduction is required by Applicable Law to be made by Company in relation to any payment in respect of the Fees, the amount of the payment due from Company shall be increased to an amount which (after making any Tax Deduction) leaves an amount equal to the payment which would have been received if no Tax Deduction had been required.

9 

6.4.5 If Company has been obliged to make an increased payment under clause 6.4.4 in respect of a Tax Deduction and NV determines that:

(a) a Tax Credit is attributable to that payment, or to the relevant Tax Deduction; and

(b) that NV (or a relevant Affiliate) has obtained and utilized that Tax Credit,

then NV shall pay to Company an amount (or procure the payment by the relevant Affiliate of an amount to Company) which NV determines will leave it (or the relevant Affiliate), after that payment, in the same after-Tax position as it would have been had no increased payment under clause 6.4.4 been required to be made by Company.

6.5 Company shall report and pay VAT directly to the relevant KSA tax authority to the extent that the amounts charged by NV to Company under this Agreement are subject to VAT under the Applicable Laws of KSA. Notwithstanding any other provision of this clause 6 or this Agreement, in relation to any Taxes that NV may incur related to the registration of NV as a permanent establishment in KSA, NV shall notify Company of such Taxes, comply with any requirements under Applicable Law and follow all necessary compliance and registration requirements. NV shall bear any associated costs including any Taxes, fines or penalties from a Governmental Authority, or Regulatory Authority.

7. Standards

7.1 Operating Standards

NV shall ensure that the NV Services are provided:

7.1.1 as soon as reasonably possible upon commencement of this Agreement in accordance with, and given the nature and extent of the relevant NV Services as described in, Schedule 2 (Scope of Services), with a goal of assisting Company to operate the KSA Facility in a manner that achieves provision of services substantially similar to those provided at the NV Facility and similar sized global biodatabanks;

7.1.2 using substantially similar levels of skill and care used by NV and its Affiliates in the NV Facility and in a professional manner, by properly trained and qualified NV Personnel;

7.1.3 in accordance with:

(a) the KSA Facility License;

(b) Good Laboratory Practice with respect to NV Services relating to laboratory services;

(c) Good Industry Practice with respect to all other NV Services;

(d) Schedule 3 (Personal Data and Information Security);

(e) Schedule 4 (Staffing and Secondment); and

(f) other reasonable Company policies as notified by Company reasonably in advance from time to time in writing.

7.2 Observance of Islamic Tradition

10 

NV hereby:

7.2.1 acknowledges that society in KSA is based on Islamic beliefs, conventions, customs and traditions; and

7.2.2 to the extent any NV Personnel are visiting the premises at the KSA Facility or any other Company facility, NV will direct them to comply with reasonable policies regarding such beliefs, conventions, customs and traditions, as accepted in writing by NV to be applicable hereunder.

8. COOPERATION

8.1 Each Party shall:

8.1.1 cooperate in good faith with the other Party and subject to clause 14 of this Agreement, make such information available to the other Party so as to enable such Party to perform its obligations under this Agreement, where such information is in its possession and is disclosable, within the time periods specified herein or, where no time period is specified, within a reasonable time period; and

8.1.2 act in a cooperative manner in dealing with the other Party in connection with this Agreement.

8.2 With respect to Company’s professional advisors, or other third parties engaged by or on behalf of Company:

8.2.1 NV shall provide commercially reasonable cooperation required by Company’s professional advisors, or other third parties engaged by or on behalf of Company, in connection with the performance of the NV Services and shall use all Commercially Reasonable Efforts to perform its obligations under this Agreement in a manner that does not materially obstruct, disrupt or delay the performance of services or works by such professional advisors, or other third parties engaged by or on behalf of Company. NV and any NV Personnel shall consult with any such professional advisors and other third parties as necessary in connection with the provision of relevant NV Services.

8.2.2 Company shall require its professional advisors and other third parties engaged by or on behalf of Company in connection with the operation of the KSA Facility to provide commercially reasonable cooperation with NV and use all Commercially Reasonable Efforts to perform their obligations in a manner that does not materially obstruct, disrupt or delay the provision of NV Services by NV. Company shall use Commercially Reasonable Efforts to require such professional advisors and other third parties to consult with NV as necessary in connection with the performance of relevant NV Services.

8.3 Each Party shall promptly notify the other Party in writing if it becomes aware of an act or omission of a professional advisor or third-party supplier engaged by Company which may cause a material problem or delay in providing the NV Services. In such a case, each Party shall to the extent it is reasonably able, work with the other Party and such professional advisor or third-party supplier to prevent, resolve or circumvent such problem or delay, at Company’s sole cost and expense.

11 

9. NV Personnel

NV agrees to use Commercially Reasonable Efforts to make available certain categories of NV Personnel to Company in accordance with Schedule 4 (Staffing and Secondment).

10. Data Protection AND CYBERSECURITY

10.1 To the extent NV or Company collects, stores, hosts or otherwise processes Personal Data in connection with this Agreement, NV and Company shall comply with Applicable Data Protection Laws.

10.2 To the extent NV collects, stores, hosts or otherwise processes Personal Data on behalf of Company in connection with the performance of the NV Services set out in Schedule 2 (Scope of Services) as a data processor (as defined in the GDPR), the data processing clauses set forth in Schedule 3 (Personal Data and Information Security) shall apply and Part B of Schedule 3 (Personal Data and Information Security) shall also apply to the extent NV collects, stores, hosts or otherwise processes Personal Data on behalf of Company as a data processor and such processing is subject to the KSA PDPL.

10.3 To the extent that the performance of the NV Services set out in Schedule 2 (Scope of Services) entail data processing operations which do not qualify as a controller-to-processor relationship under Article 28 of the GDPR, the Parties undertake to negotiate in good faith and enter into any further data protection related agreement to the extent such an agreement is necessary to comply with the GDPR and/or any other Applicable Data Protection Laws, such as the KSA PDPL, prior to the commencement of the respective NV Services.

10.4 The Parties further agree to negotiate in good faith modifications to this Agreement, including Schedule 3 (Personal Data and Information Security), if changes are required for the Parties to continue to process Personal Data as contemplated by this Agreement in compliance with Applicable Data Protection Laws or to address the legal interpretation of Applicable Data Protection Laws, including: 

10.4.1 to comply with the KSA PDPL, including any guidance issued by a Regulatory Authority;

10.4.2 to comply with applicable international Personal Data transfer requirements; and

10.4.3 to obtain authorisation or approval from a Regulatory Authority prior to transferring Personal Data outside of the relevant jurisdiction if such authorisation or approval is required.

10.5 To the extent NV collects, stores, hosts or otherwise processes Personal Data on behalf of Company in connection with the performance of the NV Services set out in Schedule 2 (Scope of Services), NV shall comply with the cybersecurity requirements set forth below:

10.5.1 Notify Company without undue delay and in any event within 48 hours of becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, such Personal Data;

10.5.2 Reasonably comply with Company organisational policies and procedures regarding cybersecurity, as provided to NV in writing and in advance from time to time; and

10.5.3 Process such Personal Data in accordance with laws relating to cybersecurity and cloud computing, including as issued by Regulatory Authorities such as the National Cybersecurity Authority and the Communications, Space and Technology Commission.

12 

11. Term

11.1 This Agreement shall come into effect on the Effective Date, and, unless terminated earlier in accordance with clause 19 of this Agreement, shall remain in full force and effect for a period of ten (10) years so long as the Joint Venture Agreement has not been terminated (the “Term”) or shall terminate simultaneously with the Joint Venture Agreement (it being understood that each NV Service, and NV’s obligations with respect thereto, shall terminate upon the earlier of:

11.1.1 the expiration of the Term;

11.1.2 termination of this Agreement; and

11.1.3 completion of such NV Service based on objective criteria, including as applicable, with respect to Accreditation, or the end of the applicable time periods set forth on Schedule 2 (Scope of Services)).

12. Representations and Warranties

12.1Each Party represents, warrants and undertakes to the other Party that:

12.1.1 it has the capacity, power and authority to enter into this Agreement;

12.1.2 the persons executing this Agreement have been duly authorized to do so;

12.1.3 once duly executed, this Agreement shall constitute its legal, valid and binding obligations and shall not violate the terms of any other agreement or judgement or court order to which it is bound;

12.1.4 it shall comply in all material respects with all Applicable Laws in the course of performing its obligations and exercising its rights under this Agreement; and

12.1.5 in the performance of its obligations under this Agreement, it will not take any action that causes either Party to violate or otherwise become exposed to penalties under any ABC Laws or Applicable Export Control or Economic Sanctions Programs.

12.2 NV represents, warrants and undertakes to Company that:

12.2.1 as of the Effective Date, NV Personnel:

(a) have not been debarred or subject to debarment or, to NV’s knowledge, convicted of a crime for which a person could be debarred before a Regulatory Authority under Applicable Law; or

(b) to NV’s knowledge, have not ever been under indictment for a crime for which a person could be debarred under such Applicable Law.

12.2.2 to NV’s knowledge, as of the Effective Date, there are no pending, and NV and/or its Affiliates have not received written notice threatening any adverse Claims against NV or its Affiliates that would have a material impact on NV’s ability to provide the NV Services;

12.2.3 as of the Effective Date, NV has furnished or made available to Company or its agents or representatives all material information that is responsive to diligence requests from Company and its agents or representative and is in NV’s or any of its Affiliates’ possession concerning the NV Services (including material information relating to

13 

the safety or efficacy of such NV Services and all material regulatory filings, permits and approvals);

12.2.4 as of the Effective Date, NV and its Affiliates have conducted all research and development, clinical and laboratory services in accordance in all material respects with all Applicable Laws; and

12.2.5 any regulatory filing filed by NV or its Affiliates with respect to the NV Services prior to the Effective Date, such as with the NV Facility’s CAP/CLIA certification, and regulatory permits and approvals obtained prior to the Effective Date were true and accurate in all material respects.

13. Intellectual Property Rights

13.1 Nothing in this Agreement shall operate to transfer ownership of or grant a license to:

13.1.1 any Intellectual Property Rights belonging to either Party or any of such Party’s Affiliates, including, without limitation:

(a) any Intellectual Property Rights belonging to a Party or any of its Affiliates on or prior to the Effective Date, including, without limitation, any Know-How that is included in the NV Services;

(b) any Intellectual Property Rights in any items which are developed or acquired by a Party or any of its Affiliates independently of this Agreement; or

(c) any Intellectual Property Rights developed or acquired by a Party or any of its Affiliates in performing its obligations under this Agreement,

it being understood that any license to any such Intellectual Property Rights required for the provision or receipt of the NV Services is addressed in the Technology Transfer and Intellectual Property License Agreement.

14. Confidential information

14.1 Each Party (the “Recipient”) acknowledges that it may receive Confidential Information that has been created, discovered or developed by the other Party (the “Provider”).

14.2 The Recipient undertakes to the Provider to:

14.2.1 hold all Confidential Information which it obtains in relation to this Agreement in strict confidence and will take all necessary measures to preserve the confidentiality of the Confidential Information;

14.2.2 not disclose, or authorize the disclosure of, Confidential Information to any third party other than pursuant to clauses 14.4 or 14.6;

14.2.3 not use, or authorize anyone to use, Confidential Information for any purpose other than the performance of its obligations pursuant to this Agreement, or the exercise of its rights or receipt of any benefits under this Agreement; and

14.2.4 promptly notify the Provider of any suspected or actual unauthorized use or disclosure of Confidential Information for which the Recipient is responsible and of which the Recipient becomes aware and promptly take all Commercially Reasonable Efforts that Recipient may require in order to prevent, stop or remedy the unauthorized use or disclosure.

14 

14.3 To the extent NV is the Recipient of Company Confidential Information, NV undertakes to:

14.3.1 Remove such Confidential Information from NV systems at the end of the NV Services; provided that such removal does not violate or otherwise conflict with Applicable Law;

14.3.2 Process such Confidential Information in accordance with Company organisational policies and procedures regarding cybersecurity, as provided to NV in writing and in advance from time to time; and

14.3.3 Process such Confidential Information in accordance with KSA laws relating to cybersecurity and cloud computing, including as issued by Regulatory Authorities such as the National Cybersecurity Authority and the Communications, Space and Technology Commission, to the extent applicable.

14.4 The Recipient may disclose Confidential Information to its Affiliates and its and their respective officers, directors, employees, contractors, advisors and auditors, but only to the extent, and provided, that such persons:

14.4.1 need to know the Confidential Information disclosed to them;

14.4.2 have been informed of the confidential nature of the Confidential Information and the purpose for which it may be lawfully used; and

14.4.3 comply with the terms of this clause 14 of this Agreement in respect of the Confidential Information disclosed to them.

14.5 Clause 14.1 shall not apply to Confidential Information to the extent that:

14.5.1 such Confidential Information has been placed in the public domain other than through the fault of the Recipient;

14.5.2 such Confidential Information was at the time of receipt, publicly available;

14.5.3 such Confidential Information has been independently developed without reference to the Confidential Information, as established by independent evidence; or

14.5.4 the Provider has approved in writing the particular use or disclosure of the Confidential Information.

14.6 The Recipient also may disclose Confidential Information if, and solely to the extent that, it is required to do so by any Governmental Authority or Regulator or otherwise as required by Applicable Law. Where Recipient is required to disclose Confidential Information relating to itself in accordance with this clause 14.6, it shall:

14.6.1 to the extent that it is able to do so and is not prohibited by Applicable Law, notify the Provider in writing as soon as practicable upon becoming aware of the obligation to disclose, prior to such disclosure; and

14.6.2 to the extent it is able to do so, cooperate with the Provider in avoiding or limiting the disclosure to that portion of the Confidential Information which it is legally required to furnish and obtaining assurances as to confidentiality from the body to whom the Confidential Information is to be disclosed.

14.7 Where a Party collects, processes, stores or hosts Company Data or NV Data, it shall comply with the provisions of Schedule 3 (Personal Data and Information Security).

15 

14.8 Subject to the express provision of this clause 14, each Party shall maintain and shall procure that its Affiliates and contractors maintain the confidentiality of the existence and terms of the negotiations between the Parties and of this Agreement and of the services provided pursuant to this Agreement and any other Project Document. Each Party shall not and shall procure that each of its Affiliates and contractors and subcontractors shall not, issue any press release or other public statement relating to the existence or content of this Agreement or any other Project Document without the prior written approval of the other Party.

14.9 Subject to requirements under Applicable Law, the obligations with respect to Confidential Information shall survive the termination or expiry of this Agreement and shall apply for five (5) years from such termination or expiration of this Agreement.

14.10 Subject to the requirements set forth in clause 14.4, either Party shall be able to disclose any materials relating to the provision or receipt of the NV Services or this Agreement to investors for the purpose of evaluation of such Party.

15. Indemnities

15.1 NV shall defend, indemnify and hold harmless Company and its respective employees, personnel, consultants, agents, contractors and subcontractors (each a “Company Indemnitee”), during the Term and, solely to the extent arising within the applicable statute of limitations period allowed under Applicable Law, thereafter in respect of any Indemnified Losses to the extent the same are assessed against, or incurred by, a Company Indemnitee in respect of the following:

15.1.1 any Claims, fines or other penalty imposed by a court or Regulatory Authority on a Company Indemnitee to the extent directly caused by NV’s material breach of this Agreement;

15.1.2 any Claims, fines or other penalty imposed by a court or Regulatory Authority on a Company Indemnitee related to the NV Services to the extent directly caused by NV’s gross negligence or Wilful Misconduct;

15.1.3 any Claims brought against a Company Indemnitee arising out of or in connection with a material breach by NV in relation to the performance of the NV Services other than Claims directly caused by Company’s or its Affiliates’ gross negligence, fraud or Wilful Misconduct;

15.1.4 any Claims brought against a Company Indemnitee in respect of death or bodily injury occurring in the performance of the NV Services for which it is finally determined by a court of competent jurisdiction that NV is legally liable or responsible;

15.1.5 any Claims brought against a Company Indemnitee in respect of any damage, loss or destruction of any real or tangible property owned by Company occurring in the performance of the NV Services for which it is finally determined by a court of competent jurisdiction that NV is legally liable or responsible for that damage, loss or destruction;

15.1.6 any Claims brought against a Company Indemnitee arising out of failure of NV to comply with its obligations to provide payment or benefits to any NV Personnel;

15.1.7 any Claims brought against a Company Indemnitee arising out of, or in connection with, any acts of fraud, fraudulent misrepresentation or theft by NV;

16 

15.1.8 any Claims brought against a Company Indemnitee arising out of, or in connection with, any material breach by NV of any ABC Laws in the performance of this Agreement; and

15.1.9 any Claims brought against a Company Indemnitee arising out of a breach by NV of its obligations under clause 14 of this Agreement.

15.2 For the purpose of interpreting clause 15.1, any reference to an act or omission of NV shall also include relevant acts or omissions of any NV Personnel, NV’s Affiliates, subcontractors of NV (pursuant to clause 21.1 of this Agreement) and their relevant personnel.

15.3 Company shall defend, indemnify and hold harmless NV and its respective employees, personnel, consultants, agents, contractors and subcontractors (each a “NV Indemnitee”), during the Term and, solely to the extent arising within the applicable statute of limitations period allowed under Applicable Law, thereafter, in respect of any Indemnified Losses to the extent the same are assessed against, or incurred by a NV Indemnitee in respect of the following:

15.3.1 any Claims, fines or other penalty imposed by a court or Regulatory Authority on a NV Indemnitee to the extent directly caused by Company’s material breach of this Agreement;

15.3.2 any Claims, fines or other penalty imposed by a court or Regulatory Authority on a NV Indemnitee to the extent directly caused by Company’s gross negligence or Wilful Misconduct;

15.3.3 any Claims brought against an NV Indemnitee arising out of or in connection with a material breach by Company of this Agreement other than Claims directly caused by NV’s or its Affiliates’ gross negligence, fraud or Wilful Misconduct;

15.3.4 any Claims brought against a NV Indemnitee in respect of death or bodily injury occurring in the context of this Agreement for which it is finally determined by a court of competent jurisdiction that Company is legally liable or responsible;

15.3.5 any Claims brought against a NV Indemnitee in respect of any damage, loss or destruction of any real or tangible property occurring in the context of this Agreement for which it is finally determined by a court of competent jurisdiction that Company is legally liable or responsible for that damage, loss or destruction;

15.3.6 any Claims brought against a NV Indemnitee arising out of, or in connection with, any acts of fraud, fraudulent misrepresentation or theft by Company;

15.3.7 any Claims brought against a NV Indemnitee arising out of, or in connection with, any material breach by Company of any ABC Laws in the performance of this Agreement; and

15.3.8 any Claims brought against a NV Indemnitee arising out of a breach by Company of its obligations under clause 14 of this Agreement.

15.4 For the purpose of interpreting clause 15.3, any reference to an act or omission of Company shall also include relevant acts or omissions of any Company Personnel, Company’s Affiliates, subcontractors of Company and their relevant personnel.

15.5 Upon a third party threatening or bringing a Claim in respect of which a Party has a legal obligation to indemnify pursuant to this Agreement, the Indemnitee shall notify the Indemnitor as soon as reasonably practicable upon becoming aware of the Claim (it being understood that any failure to so notify the Indemnitor of such Claim shall not relieve the Indemnitor of its

17 

indemnification obligations except to the extent the Indemnitor is adversely prejudiced by such failure) and:

15.5.1 the Indemnitor shall, at its own expense, defend the Claim and have sole control of the conduct of the defence and settlement of the Claim; provided, that the Indemnitee shall have the right to:

(a) where appropriate, participate in any defence and settlement, such participation to be at the Indemnitor’s own cost and in any event the Indemnitor shall remain in control of the conduct of the defence;

(b) review the terms of any settlement and approve any wording which relates to an admission of liability on the part of the Indemnitee, the payment of any consideration by Indemnitee or which the Indemnitee reasonably believes may impact the Indemnitee’s reputation and may veto any such proposed settlement in respect of the Indemnitee and any such settlement or admission (including its terms) shall be subject to confidential treatment by both Parties; and

(c) join the Indemnitor as a defendant in legal proceedings arising out of the Claim.

15.5.2 the Indemnitee shall:

(a) not make any admissions (except under compulsion of Applicable Law), agree to any settlement or otherwise compromise the defence or settlement of the Claim without the prior written approval of the Indemnitor; and

(b) give, at the Indemnitor’s request and cost, all reasonable assistance in connection with the defence and settlement of the Claim.

15.5.3 If the Indemnitor does not elect to defend the Claim or does not, following such election, actively defend the Claim, then:

(a) the Indemnitee shall have the right to defend or settle the Claim in the manner it considers appropriate, at the cost of the Indemnitor (including in respect of any Indemnified Losses for which the Indemnitor is liable pursuant to the indemnity given under clause 15 and reasonable legal costs); and

(b) the Indemnitor shall give, at Indemnitee’s request, all reasonable assistance in connection with the conduct of the defence and settlement of the Claim at the cost of the Indemnitor.

15.6 This clause 15 shall remain in full force and effect notwithstanding any termination or expiry of this Agreement.

15.7 Notwithstanding anything to the contrary, in no event shall Company be entitled to recover from NV under both this Agreement and any other Project Document for the same Losses.

16. Limitation of Liability

16.1 Nothing in this Agreement shall exclude or limit the liability of either NV Group or Company Group for:

16.1.1 fraud (including fraudulent misrepresentation);

16.1.2 death or personal injury due to gross negligence;

18 

16.1.3 Wilful Misconduct; or

16.1.4 any other liability which cannot be excluded or limited by Applicable Law.

16.2 Subject to clauses 16.1, 16.3 and 16.4 each of NV Group and Company Group:

16.2.1 shall only be liable for direct loss arising in relation to a breach of this Agreement; and

16.2.2 shall not be liable for any loss of profits, loss of business opportunity, or any indirect or consequential loss arising under or in relation to this Agreement whether as a result of breach of contract, tort (including negligence), breach of statutory duty or otherwise.

16.3 Except for a Claim for breach of an obligation to pay amounts due pursuant to this Agreement and subject to clauses 16.1 and 16.2, each Party’s total aggregate liability to the other Party and its Affiliates, whether based on an action or Claim in contract, tort (including negligence), breach of statutory duty or otherwise arising out of, or in relation to, this Agreement shall be limited to ten million Euros (€10,000,000.00).

16.4 Each Party acknowledges its general duty to reasonably mitigate any Losses incurred in relation to this Agreement and, in any case, each Party shall reasonably mitigate any Losses incurred by it in relation to this Agreement.

16.5 Each Party shall be relieved from liability for not performing its directly affected obligations (other than payment obligations not under Dispute) pursuant to this Agreement if, and to the extent a Force Majeure Event occurs, in which case relief shall be provided pursuant to clause 17.

16.6 This clause 16 shall remain in full force and effect notwithstanding any termination or expiry of this Agreement.

17. Force Majeure

17.1Neither Party shall be liable for failure or delay in performing any of its obligations (other than any payment obligations) under or pursuant to this Agreement if such failure or delay is due to any cause whatsoever outside its reasonable control and which by the exercise of due diligence such Party is unable to prevent or overcome, including: 

17.1.1 acts of God;

17.1.2 flood, fire, earthquake or explosion;

17.1.3 war, invasion, hostilities (whether war is declared or not), terrorist threats or acts, riot or other civil unrest;

17.1.4 Applicable Law;

17.1.5 government actions, embargoes, Sanctions or blockades in effect on or after the date of this Agreement;

17.1.6 action by any Governmental Authority or Regulator (including regulatory changes); provided, that the Party relying on the government act or omission as a reason for delay in performance did not, directly or indirectly, procure or induce such government act or omission;

19 

17.1.7 national emergency;

17.1.8 pandemics or epidemics; and

17.1.9 strikes, labour stoppages, or other industrial disturbances,

(each a “Force Majeure Event”) and the affected Party shall be relieved from its liability hereunder during the period of such Force Majeure Event and the other Party may terminate this Agreement in accordance with clause 19 if such Force Majeure Event continues for more than one hundred and eighty (180) days. The affected Party shall, in any event, use reasonable endeavours to avoid or mitigate the effect of such events so as to recommence performance of their obligations as soon as reasonably possible following the Force Majeure Event no longer applying.

18. Insurance

18.1 Subject to the last sentence of this clause 18.1, NV undertakes that NV will obtain, pay for, and maintain during the Term, at its own expense, and to the extent the same is available on commercially reasonable terms, a policy or policies of insurance in line with Applicable Law, Good Industry Practice and standards applicable to an operator of laboratory services and a biodatabank of similar size from reputable insurance providers in connection with the NV Services and the NV Personnel. The requirements stated in this clause 18.1 shall not be construed in any way as a limit to NV’s liability under this Agreement or as constituting any waiver by Company of any of its rights or remedies under this Agreement. Company acknowledges that NV may meet these obligations by self-insuring against such risks.

18.2 NV shall provide written notice to Company prior to any material modification, cancellation or non-renewal of any such policies, as is consistent with the relevant policy provisions.

18.3 If there is Loss, damage or other event that requires notice or other action under the terms of any insurance coverage specified in clause 18.1, NV shall be solely responsible for taking such action.

18.4 Subject to the last sentence of this clause 18.4, Company undertakes to obtain, pay for, and maintain during the Term, at its own expense, and to the extent the same is available on commercially reasonable terms a policy or policies of insurance (including professional indemnity, third party liability, property and cybersecurity insurance) from reputable insurance providers in connection with the KSA Facility and Company Personnel pursuant to this Agreement. The insurance shall cover Company against potential liabilities under or in relation to this Agreement; provided, that the requirements stated in this clause 18.4 shall not be construed in any way as a limit to Company’s liability under this Agreement or as constituting any waiver by NV of any of its rights or remedies under this Agreement. NV acknowledges that Company may meet these obligations by self-insuring against such risks.

18.5 Company shall provide written notice to NV prior to any material modification, cancellation or non-renewal of any such policies, as is consistent with the relevant policy provisions.

18.6 If there is Loss, damage or other event that requires notice or other action under the terms of any insurance coverage specified in clause 18.4, Company shall be solely responsible for taking such action.

18.7 Each of Company’s and NV’s obligations specified in this clause 18 shall not limit or expand in any way the other liabilities and obligations assumed by Company and NV, respectively, under this Agreement.

20 

19. Termination

19.1 Termination for Convenience

Company may terminate this Agreement or any affected part of the NV Services for any reason by giving nine (9) months’ prior written notice to NV; provided that Company may not send any notice terminating this Agreement pursuant to this clause 19.1 prior to two and a half (2.5) years from the Effective Date.

19.2 Termination for Cause by Company

Company may terminate this Agreement with immediate effect by written notice to NV if:

19.2.1 NV is in material breach of any of its obligations under this Agreement and either that breach is not capable of remedy or, if the breach is capable of remedy, NV has failed to remedy such breach within sixty (60) days (unless a shorter remedy period applies hereunder) after receiving written notice requiring it to remedy the relevant breach; provided that, no event of default shall be deemed to have occurred hereunder if such breach cannot reasonably be cured within such sixty (60) day period and NV has commenced and is diligently pursuing such cure within such sixty (60) day period, in which case NV shall have an additional period of time (not to exceed one hundred and twenty (120) days after receipt of written notice of such default) to cure such default and Company may not terminate this Agreement during such period;

19.2.2 NV Abandons the provision of the NV Services and NV has failed to remedy such Abandonment within forty-five (45) days after receiving written notice requiring it to remedy such Abandonment;

19.2.3 NV is unable to pay its debts as they fall due or an order is made or a resolution passed for the administration, winding-up or dissolution of NV (other than for the purposes of a solvent amalgamation or reconstruction) or an administrative or other receiver, manager, liquidator, administrator, trustee or similar officer is appointed over all or any substantial part of the assets of NV;

19.2.4 NV or any of its Affiliates providing NV Services hereunder is in material breach of clause 26 or 27;

19.2.5 NV enters into or proposes any composition or arrangement with its creditors generally or anything analogous to the foregoing occurs in the Netherlands;

19.2.6 NV ceases to be authorized to exist as a legal entity under Applicable Law; or

19.2.7 there is an NV Change of Control (as defined in the Joint Venture Agreement).

19.3 Termination for Cause by NV

NV may terminate this Agreement with immediate effect by written notice to Company if:

19.3.1 Company is in material breach of any of its obligations under this Agreement and either that breach is not capable of remedy or, if the breach is capable of remedy, Company has failed to remedy such breach within sixty (60) days (unless a shorter remedy period applies hereunder) after receiving written notice requiring it to remedy the relevant breach; provided that, no event of default shall be deemed to have occurred hereunder if such breach cannot reasonably be cured within such sixty (60) day period and Company has commenced and is diligently pursuing such cure within such sixty (60) day period, in which case Company shall have an additional period

21 

of time (not to exceed one hundred and twenty (120) days after receipt of written notice of such default) to cure such default and NV may not terminate this Agreement during such period;

19.3.2 notwithstanding clause 19.3.1, Company fails to pay any undisputed amounts due under this Agreement within thirty (30) Business Days of written demand by Formal Notice to Company for such payment or Company fails to pay any Disputed amount within thirty (30) Business Days of such Disputed payments being agreed;

19.3.3 Company is unable to pay its debts as they fall due, or an order is made, or a resolution passed for the administration, winding-up or dissolution of Company (otherwise than for the purposes of a solvent amalgamation or reconstruction), or an administrative or other receiver, manager, liquidator, administrator, trustee or similar officer is appointed over all or any substantial part of the assets of Company;

19.3.4 Company or any of its Affiliates is in material breach of clause 26 or 27;

19.3.5 Company enters into or proposes any composition or arrangement with its creditors generally or anything analogous to the foregoing occurs in KSA; or

19.3.6 Company ceases to be authorized to exist as a legal entity under Applicable Law.

19.4 Cross-Termination

This Agreement will terminate automatically upon termination of the Joint Venture Agreement.

19.5 Termination without need for Judicial Order

If a Party terminates this Agreement pursuant to this clause 19, such Party shall be entitled to do so without first obtaining judgment from the courts of KSA or any other competent authority.

19.6 Consequence of Expiry or Termination

19.6.1 Upon expiry or termination, as the case may be, of this Agreement, NV shall:

(a) comply with its obligations under clause 14;

(b) promptly deliver to Company, upon its request, any outstanding deliverables prepared by NV in the context of its provision of the NV Services under this Agreement and that are in NV’s possession or under NV’s control; provided, that Company has paid to NV all outstanding Fees (except to the extent Disputed in good faith) that are payable on or prior to the date of such expiry or termination;

(c) subject to the terms of the Technology Transfer and Intellectual Property License Agreement and licenses granted thereunder, promptly return to Company, any Company Confidential Information and any other assets or property of Company, in each case, then in possession of NV held or maintained by NV as of the effective date of such termination or expiration; provided, however, that NV may continue to retain a copy of Company Confidential Information and use it as permitted under clause 14; and

(d) subject to the terms of the Technology Transfer and Intellectual Property License Agreement, stop using, or allowing the use of, any of Company’s trademarks, logos, devices, symbols, brands or other similar items (whether registered or unregistered) used by or licensed to NV.

22 

19.6.2 Upon expiry or termination, as the case may be, of this Agreement, Company shall:

(a) immediately pay to NV all outstanding Fees (except to the extent Disputed in good faith) payable prior to the date of such expiry or termination;

(b) subject to the terms of the Technology Transfer and Intellectual Property License Agreement, promptly return to NV, any NV Confidential Information and any other assets or property of NV, in each case, then in possession of Company held or maintained by Company as of the effective date of such termination or expiration; provided, however, that Company may continue to retain a copy of Company Confidential Information and use it as permitted under clause 14;

(c) subject to the terms of the Technology Transfer and Intellectual Property License Agreement, stop using, or allowing the use of, any of NV’s trademarks, logos, devices, symbols, brands or other similar items (whether registered or unregistered) used by or licensed to Company; and

(d) comply with its obligations under clause 14.

19.7 Transition

19.7.1 NV shall ensure that, upon termination (other than any termination for cause by NV pursuant to clause 19.3) or expiry of this Agreement, a transfer of the NV Services to Company shall take place in accordance with the Transition Plan. No later than twelve (12) months prior to the expiry of this Agreement or as soon as reasonably practicable upon the issuance of a notice of termination (other than as a result of the expiry of this Agreement), the Parties shall agree on a transition plan (the “Transition Plan”) outlining the particulars of all responsibilities and obligations of NV and Company in relation to the transition of the NV Services to Company in accordance with Good Industry Practice, as applicable.

19.7.2 Company shall pay reasonable costs and expenses in connection with the Transition Plan which shall be mutually agreed by the Parties in advance, provided that NV shall be required to pay all costs and expenses incurred by NV (including Project Consultation Fees) in connection with the Transition Plan in the event Company terminates this Agreement pursuant to clauses 19.2.1-19.2.6.

19.8 Survival

19.8.1 Termination or expiry of this Agreement (howsoever occasioned) shall not affect any accrued rights or liabilities of either Party, nor shall it affect the coming into force or the continuance in force of any provision of this Agreement which is expressly or by implication intended to come into force or continue in force on or after termination.

19.8.2 The following clauses, and provisions referred to by such clauses, shall survive termination or expiry of this Agreement together with any other provisions which by their nature are expressed to survive expiry or termination or are intended or required to give effect to the expiration or termination of this Agreement: clauses 1 (Definitions; Interpretations; Conflicts); 5.3.4-5.3.12 (Commercial Milestones and Payment Terms) (provided that such clauses shall only survive with respect to any outstanding Fees and any other amounts due from Company to NV under this Agreement that are payable for periods prior to the date of such expiry or termination but have not been paid to NV yet or in connection with NV’s performance of the Transition Plan and any outstanding unpaid Commercial Milestones subject to clause

23 

5.3.6); 13 (Intellectual Property Rights), 14 (Confidential Information), 15 (Indemnity), 16 (Limitation of Liability), 19.6-19.8 (Termination), 20 (Notices) and 33 (Governing Law; Arbitration and Jurisdiction), and the applicable provisions of Schedule 1 (Defined Terms and Interpretation).

20. Notices

20.1 Any communication to be given in connection with this Agreement shall be in writing and if such communication is a Formal Notice shall either be delivered by hand or courier to a Party’s registered office (or such other address as it may notify to the other Party for such purpose) or by email as follows:

to Company at:	to NV at:
GENOMICS INNOVATIONS COMPANY LIMITED Building No. 3936, 6651 Al Nakheel District, Postal Code 12382, RGNB3936, Riyadh, Kingdom of Saudi Arabia	CENTOGENE N.V. Am Strande 7, 18055 Rostock, Germany
Marked for the attention of:	Marked for the attention of:
[***] email:[***]	Chief Legal Officer email: [***]
	With a copy, which shall not constitute notice, to: [***]
	And with a copy, which shall not constitute notice, to: Chief Financial Officer email: [***]

20.2 A communication sent according to clause 20.1 shall be deemed to have been received:

20.2.1 if delivered by hand, on written acknowledgment or receipt by an officer or an employee of the receiving Party;

20.2.2 if delivered by courier, on production of evidence from the relevant courier that the notice was successfully delivered; or

20.2.3 if by email, upon transmission to the correct email address as specified; provided, that a hard copy is sent by post as soon as reasonably practicable thereafter to the address set out in clause 20.1.

If, under the preceding provisions of this clause 20.2, a communication would otherwise be deemed to have been received outside normal business hours in the place of receipt, being 9:00 a.m. to 4:00 p.m. on a Business Day, it shall be deemed to have been received at 9:00 a.m. on the next Business Day.

24 

20.3 A Party may notify the other Party of a change to its name or address or email address for the purposes of clause 20.1; provided, that such notification shall only be effective on:

20.3.1 the date specified in the notification as the date on which the change is to take place; or

20.3.2 if no date is specified or the date specified is less than five (5) Business Days after the date on which notice is deemed to have been served, the date falling five (5) Business Days after notice of any such change is deemed to have been given.

21. Assignment and Subcontracting

21.1 The Parties acknowledge and agree that NV shall assume full responsibility to Company for the provision of the NV Services under this Agreement, subject to the terms and conditions of this Agreement. Accordingly, NV may not subcontract any of its obligations under this Agreement without prior written consent from Company (not to be unreasonably withheld, conditioned or delayed); provided that NV may subcontract all or any of its obligations under this Agreement to any Affiliate of NV without Company’s prior written consent. NV shall assume full liability and responsibility for any subcontractor’s compliance with the terms of this Agreement as if this Agreement were made between Company and such subcontractor. For the avoidance of doubt, any and all obligations of NV under this Agreement may be subcontracted to Centogene GmbH.

21.2 Neither Party is permitted to assign, sub-license, create a charge over or otherwise dispose of any of its rights or transfer or otherwise dispose of any of its obligations under this Agreement without the prior written consent of the other Party (not to be unreasonably withheld, conditioned or delayed); provided that either Party is permitted to assign, sub-license, create a charge over or otherwise dispose of any of its rights or transfer or otherwise dispose of any of its obligations under this Agreement:

21.2.1 to any Affiliate; or

21.2.2 in relation to its right to receive payment under this Agreement, as collateral to any financial institution providing financing to such Party or any of such Party’s Affiliates,

in each case without the prior written consent of the other Party.

22. Costs

Except as otherwise set forth in this Agreement, each Party shall pay the costs and expenses incurred by it in connection with preparation, review, negotiation and execution of this Agreement.

23. Audit

23.1 NV shall (and shall procure that its subcontractors, vendors, Affiliates, and all NV Personnel) maintain and keep accurate and complete reports, instructions, plans, receipts, drawings, accounts, records and all other documents that relate to the NV Services or Fees, or that relate to or are referred to in this Agreement (collectively, the “Records”), in accordance with accounting practices consistent with Good Industry Practice and Applicable Law, until the expiry of five (5) years after the expiry of the Term or termination of this Agreement.

23.2 Company (and any of Company’s Regulators, agents or professional advisors) shall have the right to audit NV’s compliance with this Agreement on giving at least ten (10) days’ written notice to NV, unless such audit is required:

25 

23.2.1 for reasons of actual or suspected fraud, criminal activity or failure to comply with Applicable Law;

23.2.2 by a Regulator; or

23.2.3 for reasons of actual or suspected non-compliance by NV with any material data security obligations under Schedule 3 (Personal Data and Information Security),

in which case such audits may be at any time.

23.3 Any audit conducted pursuant to this clause 23 must be made by an independent professional firm chosen or appointed by Company and reasonably acceptable to NV who enters into a reasonable non-disclosure agreement with NV. All audit activities must be conducted during normal business hours, without disruption to normal business activities and the materials to be reviewed may be redacted to protect privacy, legally privileged information and otherwise as is reasonable in light of Applicable Law and contractual obligations. Company shall be responsible for costs and expenses related to the audit. No Record may be audited more than one time.

24. Language

24.1 This Agreement shall be executed in English.

24.2 Any notice (including, without limitation, a Formal Notice) given in connection with this Agreement shall be in English.

24.3 Any other document provided by a Party in connection with this Agreement shall be in English.

25. Cooperation with Regulators

Each Party shall at all times provide reasonable cooperation with any Regulatory Authority in connection with the NV Services and provide all such reasonable assistance as such other Party may require in dealing with Regulatory Authorities as is relevant to the NV Services.

26. Anti-Bribery and Corruption

26.1 Neither Party, nor any of its Affiliates shall accept or give any commission or gift or other financial benefit or inducement from or to any person or party in connection with its rights and obligations under this Agreement and shall ensure that its employees, agents and subcontractors shall not accept or give any such commission, gift, benefit or inducement, and shall immediately notify the other Party of any such commission, gift, benefit or inducement which may be offered.

26.2 Each Party, its Affiliates and their Affiliated Persons shall be solely responsible for complying, have to their best knowledge complied, and shall comply, with ABC Laws and have to their best knowledge not taken and shall not take or fail to take any actions, which act or omission would subject the other Party or its Affiliates to liability under ABC Laws.

26.3 Each Party and its Affiliates shall implement and maintain an effective and appropriate internal control system and a compliance program for the prevention of bribery and corruption, money laundering and other crimes.

26.4 In the event that a Party (a “Notified Party”) reasonably believes that it has (or any of its Affiliates have) violated, or is in violation of, any ABC Laws, including without limitation if the Notified Party has received any correspondence or notice from a Regulator that the Notified Party has breached, may potentially breach or is in breach of, any ABC Laws, then the Notified

26 

Party is required to promptly notify the other Party of such breach. The Notified Party agrees to provide all reasonable assistance with respect to any audit or investigation by a Regulator (or any similar body) into whether a violation of any ABC Law has occurred by the Notified Party and the nature and extent of such violation.

27. Export Control and Sanctions

The Parties agree not to use or otherwise export or re-export anything exchanged or transferred between them pursuant to this Agreement except as authorized by Applicable Laws and the laws of the jurisdiction in which it was obtained. In particular, but without limitation, items and services exchanged may not be exported or re-exported into any Sanctioned Countries. By entering into this Agreement, each Party represents and warrants that they are not located in a Sanctioned Country or on any sanctioned persons list. Each Party also agrees that they will not use any item or service exchanged for any purposes prohibited by Applicable Law, including, without limitation, the development, design, manufacture or production of missiles, or nuclear, chemical or biological weapons. In the event either Party becomes aware of any suspected violations of this clause 27 that Party will promptly inform the other Party of such suspected violations, and the Parties shall cooperate with one another in any subsequent investigation and defence, be they civil or criminal.

28. Further Assurance

Each Party shall do and execute, or arrange for the doing and executing of, each necessary act, document and thing reasonably within its power to implement and give effect to this Agreement.

29. Required Consents

29.1NV will provide Company with commercially reasonable assistance as is reasonably requested by Company in order for Company to obtain and maintain the relevant approvals, licenses and consents with respect to the provision of NV Services and the KSA Facility.

29.2 Each Party shall obtain and maintain during the Term of this Agreement any permits, licenses or registrations, approvals and no-objections, required for the provision or receipt, as applicable, of the NV Services and the performance of its other obligations under this Agreement; provided, however, that notwithstanding any other provision to the contrary in this Agreement, Company acknowledges that NV will be providing the NV Services without establishing any licensed presence in KSA. Company acknowledges it is not a breach of this Agreement that NV does not establish any such presence or obtain any license in KSA.

30. Rights of Third Parties

30.1A person who is not a party to this Agreement shall not have any right to enforce any term of this Agreement.

30.2 The rights of the Parties to terminate, rescind or agree to any variation, waiver or settlement under this Agreement is not subject to the consent of any person that is not a party to this Agreement.

31. Waiver and Variation

31.1 A failure or delay by a Party to exercise any right or remedy provided under this Agreement, whether by conduct or otherwise, shall not constitute a waiver of that or any other right or remedy, nor shall it preclude or restrict any further exercise of that or any other right or remedy. No single or partial exercise of any right or remedy provided under this Agreement, whether

27 

by conduct or otherwise, shall preclude or restrict the further exercise of that or any other right or remedy.

31.2 A waiver of any right or remedy under this Agreement shall only be effective if given in writing and signed by the Party against whom the waiver would be enforced and shall not be deemed a waiver of any subsequent breach or default.

31.3 No variation or amendment of this Agreement shall be valid unless it is in writing and duly executed by or on behalf of all of the Parties to this Agreement. Unless expressly agreed in writing, no variation or amendment shall constitute a general waiver of any other provision of this Agreement, nor shall it affect any rights or obligations under or pursuant to this Agreement which have already accrued up to the date of variation or amendment, and the rights and obligations under or pursuant to this Agreement shall remain in full force and effect, except and only to the extent that they are varied or amended in accordance with this clause 31.

32. Severability

Where any provision of this Agreement is or becomes illegal, invalid or unenforceable in any respect, then such provision shall be deemed to be severed from this Agreement and, if possible, replaced with a lawful provision which, as closely as possible, gives effect to the intention of the Parties under this Agreement and, where permissible, that shall not affect or impair the legality, validity or enforceability in that, or any other, jurisdiction of any other provision of this Agreement.

33. Governing Law; ARBITRATION AND JURISDICTION

33.1 Governing Law

This Agreement shall be governed and construed in accordance with the laws of the Kingdom.

33.2 Jurisdiction

33.2.1 In the event of any dispute, difference, claim, controversy or question between Company and NV, directly or indirectly arising at any time under, out of, in connection with or in relation to this Agreement (or the subject matter of this Agreement) or any term, condition or provision hereof, including any of the same relating to the existence, validity, interpretation, construction, performance, enforcement and termination of this Agreement (a “Dispute”), Company and NV shall first endeavor to settle such Dispute by good faith negotiation. The Parties agree, save as otherwise agreed in writing by Company and NV, that the negotiations shall not exceed three (3) months from the date of the start of such negotiations.

33.2.2 Notwithstanding the provisions of clause 33.2.1 above, any Dispute arising out of, or in connection with, this Agreement shall be finally administered by the Saudi Centre for Commercial Arbitration (“SCCA”) in accordance with its Arbitration Rules. The arbitration shall be conducted by an arbitration tribunal consisting of three (3) independent arbitrators, none of whom shall have any relationship or competitive interests with any of the Parties or any of their Affiliates. Company shall appoint one (1) arbitrator, NV shall appoint one (1) arbitrator and the SCCA shall appoint one (1) arbitrator. The arbitration shall take place in the English language and the seat shall be at the SCCA, in Riyadh, the Kingdom. Judgment for any award rendered may be entered in any court having jurisdiction or an application may be made to such court for a judicial recognition of the award or an order of enforcement thereof, as the case may be. Nothing in this clause shall preclude any Party from seeking provisional measures to secure its rights from any court having jurisdiction or where

28 

any assets of the other Party may be found. The arbitration proceedings contemplated by this clause and the content of any award rendered in connection with such proceeding shall be kept confidential by the Parties.

34. Entire Agreement

34.1 This Agreement and the Project Documents set out the entire agreement and understanding between the Parties in respect of the subject matter of this Agreement and supersede all prior agreements and understandings, both oral and written, between the Parties with respect to the subject matter hereof and thereof.

34.2 Each Party acknowledges that it is not relying on, and shall have no remedies in respect of, any undertakings, representations, warranties, promises or assurances (whether made innocently or negligently) that are not set forth in this Agreement.

34.3 Nothing in the preceding sub clause limits or excludes any liability for fraud or fraudulent concealment.

35. Counterparts

This Agreement or any amendment agreed to pursuant to clause 31.3 may be executed in any number of counterparts, each of which shall be deemed to be an original, and all of which, when taken together, shall constitute one and the same instrument.

[Signature Page Follows]

29 

IN WITNESS WHEREOF, this Agreement has been executed by the Parties by their duly authorized representatives on the Effective Date.

Signed by Kim Stratton for and on behalf of CENTOGENE N.V.	) ) ) ) )	/s/ Kim Stratton
Signed by Miguel Coego for and on behalf of CENTOGENE N.V.	) ) ) ) )	/s/ Miguel Coego
Signed by Jeremy Panacheril for and on behalf of GENOMICS INNOVATIONS COMPANY LIMITED	) ) ) ) )	/s/ Jeremy Panacheril

30 

Schedule 1

DEFINED TERMS AND INTERPRETATION

Part 1 – Defined Terms

In this Agreement:

“Abandon” or “Abandonment” means the material failure of NV to provide all or a material part of the NV Services for a continuous and consecutive period of forty-five (45) Business Days or more, other than any material non-performance due to:

(a) non-payment by Company of the Fees that are due in accordance with the terms of this Agreement; or

(b) occurrence of a Force Majeure Event;

“ABC Laws” means all laws and regulations applicable to the Parties and this Agreement, that relates to bribery or corruption or money laundering, including (without limitation):

(a) the Saudi Arabian Anti-Bribery Law promulgated by royal decree number M/36 dated 26/12/1412H (corresponding to 27 June 1992) and the Saudi Arabian Anti-Money Laundering Law promulgated by royal decree number M/20 dated 5/2/1439H (corresponding to 25 October 2017);

(b) the US Foreign Corrupt Practices Act of 1977, as amended, and the rules and regulations issued thereunder; and

(c) the UK Bribery Act 2010, as each may be amended or re-enacted from time to time.

“Accreditation” means the CAP Laboratory Accreditation from the College of American Pathologists (“CAP”) and the Clinical Laboratory Improvement Amendments (“CLIA”) certification, or, in the event Company is unable to obtain such accreditation or certification, as applicable, due to regulatory changes arising after the Effective Date, an equivalent internationally recognized accreditation or certification, as applicable, as mutually agreed by the Board of Directors, and “Accredited” shall be construed accordingly;

“Affiliate” means any person, now or in the future, directly Controlling, Controlled by or under direct or indirect Common Control of a Party. For the avoidance of doubt, for purposes of this Agreement, when used in connection with Company, the term “Affiliate” will not include NV, and when used in connection with NV, the term “Affiliate” will not include Company;

“Affiliated Persons” means a relevant Party and its Affiliates’ officers, directors, employees, agents or representatives, or any of its stockholders, principals or owners (including ultimate beneficial owners) acting on its behalf or in its interests;

“Agreement” has the meaning set out in the preamble of this Agreement;

“Applicable Data Protection Laws” means any and all laws, statutes, rules and regulations relating to the privacy, security, protection, access, collection, storage, transmission, disclosure, exchange or other processing of Personal Data, including, but not limited to, the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the German Federal Data Protection Act (Bundesdatenschutzgesetz), the provisions of the German Genetic Diagnostics Act (Gendiagnostikgesetz), the Kingdom National Data Management Office’s Interim Regulations on Personal Data Protection, the Kingdom Ministry of Health’s Guidelines for Informed Consent, and the Kingdom Personal Data Protection Law (issued pursuant to Royal Decree M/19 of 9/2/1443H (corresponding to 16 September 2021) and any relevant

31 

implementing regulations issued pursuant to the Kingdom Personal Data Protection Law (“KSA PDPL”)), in each case as amended or updated from time to time;

“Applicable Export Control” or “Economic Sanctions Programs” means all applicable national and international export controls, Sanctions laws, regulations and programs;

“Applicable Law” means any of the following, to the extent that it applies to a Party:

(a) any laws, statute, directive, order, enactment, regulation, bylaw, ordinance or subordinate legislation in force from time to time; but subject to any written waivers granted by any Governmental Authority;

(b) any binding court order, judgment or decree;

(c) any applicable industry code, policy or standard enforceable by law;

(d) any applicable direction, statement of practice, policy, rule or order that is set out by a Regulatory Authority that is binding on the Parties; and

(e) the ABC Laws, Applicable Data Protection Laws and the Applicable Export Control or Economic Sanctions Programs;

“Approved Employment Contract” has the meaning set out in Schedule 4 (Staffing and Secondment) clause 3.2 of this Agreement;

“Approved Policy” means a policy of Company approved in accordance with the terms of the Joint Venture Agreement;

“Approved Seconded Personnel” has the meaning set out in Schedule 4 (Staffing and Secondment) clause 3.2 of this Agreement;

“Board of Directors” means the Board of Directors of Company from time to time;

“Business Day” means any day other than a Friday, Saturday or public holiday in KSA or Germany;

“Business Plan” means the Initial Business Plan set out in Schedule 7 of the Joint Venture Agreement;

“Claim” means any claims, demands, suits, proceedings or actions by any Governmental Authority, Regulatory Authority or a third party (in either case, not being connected to or related to the relevant Indemnitee);

“Clauses” has the meaning set out in Schedule 3 (Personal Data and Information Security) Part A clause ‎1.1 of this Agreement;

“Commercial Milestone” has the meaning set out in clause 5.3.4 of this Agreement;

“Commercial Milestone Fee” has the meaning set out in clause 5.3.4 of this Agreement;

“Commercially Reasonable Efforts” means taking such steps and performing in such a manner as a similarly situated company would undertake where such company was acting in a determined, prudent and reasonable manner to achieve the particular result for its own benefit;

“Company” has the meaning set out in the preamble of this Agreement;

“Company Confidential Information” means Confidential Information of Company;

“Company Data” means all Personal Data which relates to Company Personnel;

32 

“Company Group” means Company and its Affiliates;

“Company Indemnitee” has the meaning set out in clause 15.1 of this Agreement;

“Company Personnel” means any employees, officers, directors, consultants, contractors or agents employed or engaged by Company or its Affiliates, but excluding any NV Personnel seconded to Company;

“Company Representative” has the meaning set out in clause 4.6 of this Agreement;

“Confidential Information” means information that is marked, designated or otherwise identified as ‘confidential’ or which by its nature is clearly confidential. Confidential Information includes (without limitation) any information concerning the technology, technical processes, samples, studies, findings, inventions, ideas, business processes, procedures, business affairs, financial affairs and finance of Company Group or NV Group, as the case may be; provided that Confidential Information shall not include any Personal Data which is addressed separately in Schedule 3 (Personal Data and Information Security) of this Agreement. Company’s or NV’s security procedures are also included within the definition of Confidential Information. Confidential Information may take the form of documents, technical specifications, unpublished patent specifications, data, drawings, plans, processes, photographs, databases, computer software in disk, cassette, tape or electronic form and data storage or memory in, and items of, computer hardware; or oral descriptions, demonstrations or observations, and Confidential Information includes (without limitation) information which is supplied to, stored by, processed or marked for destruction by, NV Group to Company Group, or by Company Group to NV Group;

“Construction Completion” has the meaning set out in clause 1.1.3(b)(ii) of Schedule 2 of this Agreement;

“Control” (including the terms “Controlling”, “Controlled by” and “under Common Control”), means in relation to any person (being the “Controlled Person”), being:

(a) entitled to exercise, or control the exercise of (directly or indirectly) more than fifty percent (50%) of the voting power at any general meeting of the shareholders, members or partners or other equity holders (and including, in the case of a limited partnership, of the limited partners of) in respect of all or substantially all matters falling to be decided by resolution or meeting of such persons;

(b) entitled to appoint or remove:

(i) directors on the Controlled Person’s board of directors or its other governing body (or, in the case of a limited partnership, of the board or other governing body of its general partner) who are able (in the aggregate) to exercise more than fifty percent (50%) of the voting power at meetings of that board or governing body in respect of all or substantially all matters;

(ii) any managing member of such Controlled Person; and/or

(iii) in the case of a limited partnership, its general partner; or

(c) entitled to exercise a dominant influence over the Controlled Person (otherwise than solely as a fiduciary) by virtue of the provisions contained in its constitutional documents or pursuant to an agreement with other shareholders, partners or members of the Controlled Person;

“Data Protection Impact Assessment” has the meaning set out in clause 7.3.1 of Schedule 3 (Personal Data and Information Security) of this Agreement;

33 

“Dispute” has the meaning set out in clause 33.2.1 of this Agreement;

“Effective Date” has the meaning set out in the preamble of this Agreement;

“Fees” has the meaning set out in clause 5.1.1 of this Agreement;

“First Operational Milestone” has the meaning set out in clause 5.3.1 of this Agreement;

“Fixed Performance Fee” has the meaning set out in clause 5.3.4 of this Agreement;

“Force Majeure Event” has the meaning set out in clause 17 of this Agreement;

“Formal Notices” means:

(a) notices invoking, or relating to, Dispute resolution or any litigation between the Parties;

(b) notices given in connection with a Force Majeure Event pursuant to clause 17 of this Agreement;

(c) a change to the contact details specified in clause 20.1 of this Agreement; or

(d) any other notices stated in this Agreement to be a Formal Notice;

“Good Industry Practice” means the degree of skill, diligence, prudence and foresight and standard of care which would ordinarily be expected to be observed by a duly qualified, skilled and experienced professional engaged in the same or similar type of undertaking as that of NV in providing the NV Services;

“Good Laboratory Practice” means international ethical and scientific quality standards, practices, methods and procedures conforming to Applicable Law and international health industry practice and exercising that degree of skill, care, diligence, prudence and foresight which would reasonably and ordinarily be expected from a duly qualified, skilled, efficient and experienced laboratory service provider providing laboratory services in connection with a facility of a size and capacity comparable to the KSA Facility;

“Governmental Authority” means any federal, emirate, state, provincial or municipal government or political subdivision thereof, a governmental or quasi-governmental ministry, legislative body, agency, authority, board, bureau, commission, government-controlled corporation or entity, department, instrumentality or public body, or any court, administrative tribunal or public utility that has jurisdiction over the Party or matter in question;

“Indemnified Losses” means:

(a) any amounts awarded by a court or tribunal of competent jurisdiction or arbitrator to a third party;

(b) any amounts paid in settlement to a third party;

(c) any interest awarded by a court of competent jurisdiction or arbitrator in respect of the above; and

(d) reasonable costs of investigation, litigation, settlement and external legal fees (on a solicitor-client basis) and disbursements and administrative costs directly incurred by the Indemnitee in respect of a Claim;

“Indemnitee” means a Party relying on an indemnity pursuant to this Agreement;

34 

“Indemnitor” means a Party providing an indemnity pursuant to this Agreement;

“Intellectual Property Rights” means any and all rights available under patent, copyright, industrial design, trade secret law or any trademarks, service marks, trade names or other statutory provision or common law doctrine with respect to designs, formulas, algorithms, procedures, methods, techniques, ideas, Know-How, programs, subroutines, tools, inventions, creations, improvements, works of authorship, other similar materials, and all recordings, graphs, drawings, reports, analyses, other writings, and any other embodiment of the foregoing, in any form, whether or not specifically listed herein, which may subsist in any part of the world, in each case whether registered or unregistered and including all applications for, and renewals or extensions of, such rights for their full term;

“Invoice” has the meaning set out in clause 5.3.7 of this Agreement;

“Joint Venture Agreement” has the meaning set out in the preamble to this Agreement;

“Kingdom” or “KSA” means the Kingdom of Saudi Arabia;

“Know-How” has the meaning set out in the Technology Transfer and Intellectual Property License Agreement;

“KSA Biodatabank” means national KSA data registries, biodatabank and genetic data including in relation to rare and neurodegenerative diseases that is Controlled by Company;

“KSA Facility” means the facility for the establishment and maintenance of the KSA Lab and the KSA Biodatabank;

“KSA Facility License” means the license issued by the Saudi Food and Drug Authority authorizing the KSA Facility to provide services in Riyadh, KSA;

“KSA Lab” means a laboratory facility to be located in Riyadh, the Kingdom, and operated in accordance with Applicable Law with the intention that it becomes an Accredited, globally recognized, commercially driven genomics wet and dry lab;

“Laboratory Services Agreement” has the meaning set out in the preamble of this Agreement;

“Lawful Export Measures” has the meaning set out in Schedule 3 (Personal Data and Information Security) Part B clause 2.3 of this Agreement;

“Licensed Other Personnel” has the meaning set out in clause 1.1.2 of Schedule 4 (Staffing and Secondment) of this Agreement;

“Licensed Personnel” means laboratory or clinical professionals that are employees of NV or parties contracted by NV;

“Licensed Seconded Personnel” has the meaning set out in clause 1.1.1 of Schedule 4 (Staffing and Secondment) of this Agreement;

“Losses” means all Claims (whether or not successful, compromised or settled), actions, proceedings, liabilities, demands, judgments (asserted or established in any jurisdiction) and any and all losses, damages (including interest), any amounts paid in settlement (including interest) of a Claim, costs, expenses (including reasonable legal, investigative, administrative or professional costs and expenses incurred in disputing or defending any of the foregoing), Taxes, fines or penalties;

“Net Revenue” means the revenue of Company less any customer discounts or allowances including:

35 

(a) credits or allowances given to customers for rejections or returns of a product or service;

(b) sales taxes, excise taxes and use taxes, on the production, importation, use or sale of such product or service;

(c) freight, postage, shipping and insurance charges allowed or paid for delivery of the products or service, to the extent included in the gross sales price;

(d) cash discounts given by Company or any of its Affiliates or its or their permitted sublicensees in the ordinary course of the business;

(e) chargebacks, rebates, administrative fee arrangements, reimbursements, and similar payments to wholesalers and other distributors, buying groups, health care insurance carriers, pharmacy benefit management companies, health maintenance organizations, other institutions or health care organizations or other customers;

(f) amounts due to third parties on account of rebate payments or other price reductions provided, based on sales by Company or its Affiliates or sublicensees to any Governmental Authorities or Regulators;

(g) other specifically identifiable amounts that have been credited against or deducted from gross sales of products and services, and which are substantially similar to those credits and deductions listed above; and

any other permitted deductions in accordance with International Financial Reporting Standards (“IFRS”) not set out in (a)-(g) above;

“Non-Licensed Other Personnel” has the meaning set out in clause 1.1.4 of Schedule 4 (Staffing and Secondment) of this Agreement;

“Non-Licensed Personnel” means employees of NV or parties contracted by NV other than Licensed Personnel;

“Non-Licensed Seconded Personnel” has the meaning set out in clause 1.1.3 of Schedule 4 (Staffing and Secondment) of this Agreement;

“Notified Party” has the meaning set out in clause 26.4 of this Agreement;

“NV” has the meaning set out in the preamble of this Agreement;

“NV Confidential Information” means Confidential Information of NV;

“NV Data” means all Personal Data which relates to NV Personnel;

“NV Facility” has the meaning set out in the preamble of this Agreement;

“NV Group” means NV and its Affiliates;

“NV Indemnitee” has the meaning set out in clause 15.3 of this Agreement;

“NV Personnel” means employees, officers, directors, consultants, contractors and agents engaged wholly or partly by NV (or any of its Affiliates), including Licensed Seconded Personnel, Licensed Other Personnel, Non-Licensed Seconded Personnel, Non-Licensed Other Personnel, from time to time, including the NV Representative and any Approved Seconded Personnel, to provide the NV Services;

36 

“NV Representative” has the meaning set out in clause 3.3.1 of this Agreement;

“NV Services” has the meaning set out in clause 3.1 of this Agreement;

“OFAC” means the U.S. Department of the Treasury’s Office of Foreign Assets Control;

“Operational Milestone” has the meaning set out in clause 5.3.1 of this Agreement;

“Operational Milestone Fee” has the meaning set out in clause 5.3.1 of this Agreement;

“Other Personnel” means those Licensed Personnel and Non-Licensed Personnel that perform NV Services for Company other than Seconded Personnel;

“Party” or “Parties” have the meaning set out in the preamble of this Agreement;

“Personal Data” has the meaning given to it in Applicable Data Protection Laws;

“Personal Data Breach” has the meaning set out in clause 6.4.1 of Schedule 3 (Personal Data and Information Security) of this Agreement;

“Project Consultation Fee” has the meaning set out in clause 5.2 of this Agreement;

“Project Documents” means, collectively, this Agreement, the Joint Venture Agreement, the Technology Transfer and Intellectual Property License Agreement and the Laboratory Services Agreement;

“Provider” has the meaning set out in clause 14.1 of this Agreement;

“Recipient” has the meaning set out in clause 14.1 of this Agreement;

“Records” has the meaning set out in clause 23.1 of this Agreement;

“Regulator” or “Regulatory Authority” means any national, regional, state or local regulatory agency, department, bureau, commission, council or other Governmental Authority whose review and/or approval is necessary for performing clinical and/or laboratory services in the applicable regulatory jurisdiction and granting regulatory approvals or having regulatory or supervisory authority over a Party or a Party’s assets, resources or business, or over the NV Services;

"SAR” means Saudi Arabian Riyals;

“Sanctioned Countries” means, at any time, a country or territory that is itself the target of comprehensive Sanctions (as of the date of this Agreement, Cuba, Iran, North Korea, Syria, the Crimea region of Ukraine, the so-called Donetsk People’s Republic, and the so-called Luhansk People’s Republic);

“Sanctions” means economic or financial sanctions or trade embargoes imposed, administered or enforced from time to time by the United States, the European Union or any member state thereof, the United Kingdom, the United Nations or any governmental institution or agency of any of the foregoing, including OFAC or the United States Department of State, the United Kingdom’s Office of Financial Sanctions Implementation or His Majesty’s Treasury or the United Nations Security Council;

“SCCA” has the meaning given in clause 33.2.2 of this Agreement;

“Second Operational Milestone” has the meaning set out in clause 5.3.1 of this Agreement;

37 

“Seconded Personnel” means those Licensed Personnel or Non-Licensed Personnel that are seconded to Company from time to time, including any Approved Seconded Personnel;

“Shareholders” means any person to whom one or more shares may be transferred or issued from time to time in accordance with the Joint Venture Agreement, and “Shareholder” means any of them;

“Staffing Plan” has the meaning set out in clause 1.2 of Schedule 4 (Staffing and Secondment) of this Agreement;

“Tax” means all forms of taxation and statutory, governmental, state, federal, provincial, local, government or municipal charges, duties, imposts, contributions, levies, VAT, withholdings or other liabilities in the nature of taxation wherever chargeable and whether of KSA or any other jurisdiction (including, for the avoidance of doubt, social security contributions in KSA and Germany and corresponding obligations elsewhere) and any penalty, fine, surcharge, interest, charges or costs relating to it or them;

“Tax Credit” means a credit against, relief or remission for, or repayment of, any Tax;

“Tax Deduction” means any amount which Company is required by Applicable Law to deduct or withhold on account of Tax from any payment by Company to NV (or a relevant Affiliate) in respect of any Fees;

“Technology Transfer and Intellectual Property License Agreement” has the meaning set out in the recitals of this Agreement;

“Term” has the meaning set out in clause 11 of this Agreement;

“Third Party Service Provider” means a third-party entity engaged by Company (other than NV, any of its Affiliates or any NV Personnel) to provide Third Party Services;

“Third Party Services” means any services which NV and Company agree in advance in writing are Third Party Services for the purposes of this Agreement;

“Transition Plan” has the meaning set out in clause 19.7.1 of this Agreement;

“VAT” means:

(a) any Tax imposed in relation to the Unified Agreement for Value Added Tax for the Co-operation Council for the Arab States of the Gulf;

(b) any other Tax of a similar nature, imposed in a member state of the Co-operation Council for the Arab States of the Gulf; or

(c) any other similar Taxes imposed anywhere in the world; and

“Wilful Misconduct” means conduct that is unreasonable, deliberate and carried out by a Party in the knowledge that it will result in significant injury or damage to the other Party.

38 

Part 2 - Interpretation

In this Agreement:

(a) any reference to “Schedule” or “Annex”, unless the context otherwise requires, is a reference to the relevant schedule or annex of and to this Agreement, and any reference to a “clause”, “section” or “paragraph”, unless the context otherwise requires, is a reference to a clause in this Agreement, a section or paragraph in the relevant Schedule and a paragraph in the relevant Annex, respectively;

(b) the clause, section and paragraph headings and the contents page in this Agreement are included for convenience purposes only and shall not affect the interpretation of this Agreement;

(c) use of the singular in this Agreement includes the plural and vice versa;

(d) any reference to a Party or the Parties means a party or the parties to this Agreement, including their successors in interest and permitted assigns;

(e) any reference to “persons” includes natural persons, companies, corporations, partnerships, limited liability companies, firms, associations, organisations, Governmental Authorities, foundations and trusts (in each case, whether or not having separate legal personality);

(f) any reference to a date refers to the Gregorian calendar;

(g) any reference to a statute, statutory provision or subordinate legislation shall, except where the context otherwise requires, be construed as referring to such legislation as amended and in force from time to time and to any legislation which re-enacts or consolidates (with or without modification) any such legislation;

(h) unless otherwise defined, terms used in the healthcare industry or other relevant business context shall be interpreted in accordance with their generally understood meaning in that industry or business context;

(i) any phrase introduced by the terms “including”, “include”, “in particular” or any similar expression shall be construed as illustrative and shall not limit the sense of the words preceding those terms;

(j) any reference to “writing” or “written” includes email (but not faxes), save with respect to Formal Notices, where service in accordance with clause 20 of this Agreement is required; and

(k) any reference to any agreement or other instrument shall, except where expressly provided to the contrary, include any amendment, restatement, amendment and restatement, modification, variation or novation (in whole or in part) to such agreement or other instrument.

39 

Schedule 2

[***] 

40 

Schedule 3

PERSONAL DATA AND INFORMATION SECURITY

PART A - GDPR Data Processing Clauses

1. PURPOSE AND SCOPE

1.1 The purpose of these Data Processing Clauses (the “Clauses”) is to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data.

1.2 The controllers and processors listed in Annex I have agreed to these Clauses in order to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679.

1.3 These Clauses apply to the processing of Personal Data as specified in Annex II.

1.4 Annexes I to V are an integral part of the Clauses.

1.5 These Clauses are without prejudice to obligations to which the controller is subject by virtue of Regulation (EU) 2016/679.

1.6 These Clauses do not by themselves ensure compliance with obligations related to international transfers in accordance with Chapter V of Regulation (EU) 2016/679.

2. INTERPRETATION

2.1 Where these Clauses use the terms defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

2.2 These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

2.3 These Clauses shall not be interpreted in a way that runs counter to the rights and obligations provided for in Regulation (EU) 2016/679 or in a way that prejudices the fundamental rights or freedoms of the data subjects.

3. HIERARCHY

3.1 In the event of a contradiction between these Clauses and the provisions of the Project Documents, these Clauses shall prevail. In the event of a contradiction between these Clauses, the provisions of the Project Documents and the standard contractual clauses attached to this Schedule with respect to the transfer of Personal Data to a third country, the standard contractual clauses shall prevail.

4. DOCKING CLAUSE

4.1 Any entity that is not a Party to these Clauses may, with the written agreement of all the Parties, accede to these Clauses at any time as a controller or a processor by completing the Annexes and signing Annex I.

4.2 Once Annex I has been completed and signed as set forth in clause 4.1, the acceding entity shall be treated as a Party to these Clauses and have the rights and obligations of a controller or a processor, in accordance with its designation in Annex I.

41 

4.3 The acceding entity shall have no rights or obligations resulting from these Clauses from the period prior to becoming a Party.

5. DESCRIPTION OF PROCESSING

5.1 The details of the processing operations, in particular the categories of Personal Data and the purposes of processing for which the Personal Data is processed on behalf of the controller, are specified in Annex II.

6. OBLIGATIONS OF THE PARTIES

6.1 Instructions

6.1.1 The processor shall process Personal Data only on documented instructions from the controller, unless required to do so by Union or Member State law to which the processor is subject. In this case, the processor shall inform the controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. Subsequent instructions may also be given by the controller throughout the duration of the processing of Personal Data. These instructions shall always be documented.

6.1.2 The processor shall immediately inform the controller if, in the processor’s opinion, instructions given by the controller infringe Regulation (EU) 2016/679 or the applicable Union or Member State data protection provisions.

6.2 Purpose Limitation

The processor shall process the Personal Data only for the specific purpose(s) of the processing, as set out in Annex II, unless it receives further instructions from the controller.

6.3 Duration of the Processing of Personal Data

Processing by the processor shall only take place for the duration specified in Annex II.

6.4 Security of Processing

6.4.1 The processor shall at least implement the technical and organisational measures specified in Annex III to ensure the security of the Personal Data. This includes protecting the data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to the data (a “Personal Data Breach”). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks involved for the data subjects.

6.4.2 The processor shall grant access to the Personal Data undergoing processing to members of its personnel only to the extent strictly necessary for implementing, managing and monitoring of this Agreement. The processor shall ensure that persons authorized to process the Personal Data received have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

6.5 Sensitive Data

If the processing involves Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex

42 

life or sexual orientation, or data relating to criminal convictions and offences (sensitive data), the processor shall apply specific restrictions and/or additional safeguards.

6.6 Documentation and Compliance

6.6.1 The Parties shall be able to demonstrate compliance with these Clauses.

6.6.2 The processor shall deal promptly and adequately with inquiries from the controller about the processing of data in accordance with these Clauses.

6.6.3 The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations that are set out in these Clauses and stem directly from Regulation (EU) 2016/679. At the controller’s request, the processor shall also permit and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or an audit, the controller may take into account relevant certifications held by the processor.

6.6.4 The controller may choose to conduct the audit by itself or mandate an independent auditor. Audits may also include inspections at the premises or physical facilities of the processor and shall, where appropriate, be carried out with reasonable notice.

6.6.5 The Parties shall make the information referred to in this Clause, including the results of any audits, available to the competent supervisory authority/ies on request.

6.7 Use of Sub-processors

6.7.1 The processor has the controller’s general authorisation for the engagement of sub-processors from an agreed list which is set forth in Annex IV. The processor shall specifically inform in writing the controller of any intended changes of Annex IV through the addition or replacement of sub-processors at least 20 Business Days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned sub-processor(s). The processor shall provide the controller with the information necessary to enable the controller to exercise the right to object.

6.7.2 Where the processor engages a sub-processor for carrying out specific processing activities (on behalf of the controller), it shall do so by way of a contract which imposes on the sub-processor, in substance, the same data protection obligations as the ones imposed on the data processor in accordance with these Clauses. The processor shall ensure that the sub-processor complies with the obligations to which the processor is subject pursuant to these Clauses and to Regulation (EU) 2016/679.

6.7.3 At the controller’s request, the processor shall provide a copy of such a sub-processor agreement and any subsequent amendments to the controller. To the extent necessary to protect business secrets or other Confidential Information, including Personal Data, the processor may redact the text of the agreement prior to sharing the copy.

6.7.4 The processor shall remain fully responsible to the controller for the performance of the sub-processor’s obligations in accordance with its contract with the processor. The processor shall notify the controller of any failure by the sub-processor to fulfil its contractual obligations.

6.7.5 The processor shall agree to a third-party beneficiary clause with the sub-processor whereby - in the event the processor has factually disappeared, ceased to exist in law or

43 

has become insolvent - the controller shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the Personal Data.

6.8 International Transfers

6.8.1 Any transfer of data to a third country or an international organization by the processor shall be done only on the basis of documented instructions from the controller or in order to fulfil a specific requirement under Union or Member State law to which the processor is subject and shall take place in compliance with Chapter V of Regulation (EU) 2016/679.

6.8.2 To the extent that the services provided by processor entail a transfer of Personal Data from NV to Company, the standard contractual clauses attached to this Schedule as Annex V apply.

6.8.3 The controller agrees that where the processor engages a sub-processor in accordance with Clause 6.7 for carrying out specific processing activities (on behalf of the controller) and those processing activities involve a transfer of Personal Data within the meaning of Chapter V of Regulation (EU) 2016/679, the processor and the sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 by using standard contractual clauses adopted by the Commission in accordance with of Article 46(2) of Regulation (EU) 2016/679, provided the conditions for the use of those standard contractual clauses are met.

7. ASSISTANCE TO THE CONTROLLER

7.1 The processor shall promptly notify the controller of any request it has received from the data subject. It shall not respond to the request itself, unless authorized to do so by the controller.

7.2 The processor shall assist the controller in fulfilling its obligations to respond to data subjects’ requests to exercise their rights, taking into account the nature of the processing. In fulfilling its obligations in accordance with 7.1 and 7.2, the processor shall comply with the controller’s instructions.

7.3 In addition to the processor’s obligation to assist the controller pursuant to Clause 7.2, the processor shall furthermore assist the controller in ensuring compliance with the following obligations, taking into account the nature of the data processing and the information available to the processor:

7.3.1 the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of Personal Data (a “Data Protection Impact Assessment”) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;

7.3.2 the obligation to consult the competent supervisory authority/ies prior to processing where a Data Protection Impact Assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk;

7.3.3 the obligation to ensure that Personal Data is accurate and up to date, by informing the controller without delay if the processor becomes aware that the Personal Data it is processing is inaccurate or has become outdated; and

7.3.4 the obligations in Article 32 Regulation (EU) 2016/679.

44 

8. NOTIFICATION OF PERSONAL DATA BREACH

8.1 In the event of a Personal Data Breach, the processor shall cooperate with and assist the controller for the controller to comply with its obligations to notify competent supervisory authorities or affected individuals under Applicable Data Protection Laws.

8.2 Data Breach Concerning Data Processed by the Controller

In the event of a Personal Data Breach concerning data processed by the controller, the processor shall assist the controller:

8.2.1 in notifying the Personal Data Breach to the competent supervisory authority/ies, without undue delay after the controller has become aware of it, where relevant (unless the Personal Data Breach is unlikely to result in a risk to the rights and freedoms of natural persons);

8.2.2 in obtaining the following information which, pursuant to Article 33(3) Regulation (EU) 2016/679, shall be stated in the controller’s notification, and must at least include:

(i) the nature of the Personal Data including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of Personal Data records concerned;

(ii) the likely consequences of the Personal Data Breach; and

(iii) the measures taken or proposed to be taken by the controller to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

8.2.3 in complying, pursuant to Article 34 Regulation (EU) 2016/679, with the obligation to communicate without undue delay the Personal Data Breach to the data subject, when the Personal Data Breach is likely to result in a high risk to the rights and freedoms of natural persons.

8.3 Data Breach Concerning Data Processed by the Processor

In the event of a Personal Data Breach concerning data processed by the processor, the processor shall notify the controller without undue delay after the processor has become aware of the breach. Such notification shall contain, at least:

8.3.1 a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned);

8.3.2 the details of a contact point where more information concerning the Personal Data Breach can be obtained; and

8.3.3 its likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate its possible adverse effects.

45 

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

The Parties shall set out in Annex III all other elements to be provided by the processor when assisting the controller in the compliance with the controller’s obligations under Articles 33 and 34 of Regulation (EU) 2016/679.

9. NON-COMPLIANCE WITH THE CLAUSES AND TERMINATION

9.1 Without prejudice to any provisions of Regulation (EU) 2016/679, in the event that the processor is in breach of its obligations under these Clauses, the controller may instruct the processor to suspend the processing of Personal Data until the latter complies with these Clauses or this Agreement is terminated. The processor shall promptly inform the controller in case it is unable to comply with these Clauses, for whatever reason.

9.2 The controller shall be entitled to terminate this Agreement insofar as it concerns processing of Personal Data in accordance with these Clauses if:

9.2.1 the processing of Personal Data by the processor has been suspended by the controller pursuant to Clause 9.1 and if compliance with these Clauses is not restored within a reasonable time and in any event within one month following suspension;

9.2.2 the processor is in substantial or persistent breach of these Clauses or its obligations under Regulation (EU) 2016/679; or

9.2.3 the processor fails to comply with a binding decision of a competent court or the competent supervisory authority/ies regarding its obligations pursuant to these Clauses or to Regulation (EU) 2016/679.

9.3 The processor shall be entitled to terminate this Agreement insofar as it concerns processing of Personal Data under these Clauses where, after having informed the controller that its instructions infringe applicable legal requirements in accordance with Clause 7.1, the controller insists on compliance with the instructions.

9.4 Following termination of this Agreement, the processor shall, at the choice of the controller, delete all Personal Data processed on behalf of the controller and certify to the controller that it has done so, or return all the Personal Data to the controller and delete existing copies unless Union or Member State law requires storage of the Personal Data. Until the Personal Data is deleted or returned, the processor shall continue to ensure compliance with these Clauses.

46 

PART B - KSA PDPL DATA PROCESSING CLAUSES

1. APPLICATION OF THE CLAUSES

1.1 Where the processing of Personal Data is subject to the KSA PDPL, the Clauses shall apply to such processing and where applicable, references to Regulation (EU) 2016/679 and to relevant Articles of Regulation (EU) 2016/679 in the Clauses shall be interpreted as references to the relevant article of the KSA PDPL and relevant implementing regulations, and references to Union or Member State laws and supervisory authorities or similar terms in the Clauses shall be interpreted as references to Kingdom laws and Kingdom Regulatory Authorities, or similar Kingdom related terms.

1.2 The application of the KSA PDPL and extension of the Clauses to apply to processing of Personal Data subject to the KSA PDPL is supplementary to and in no way replaces or supersedes the processor’s or controller’s rights or obligations under the Clauses.

1.3 When processing Personal Data subject to the KSA PDPL, the processor shall notify the controller and follow the instructions of the controller if it receives a legally binding request from Kingdom authorities, including judicial authorities, for the disclosure of such Personal Data, or is otherwise obliged to disclose such data or becomes aware of any direct access by Kingdom authorities. The processor shall not require the prior consent of a data subject in relation to disclosing Personal Data in accordance with legally binding requests from Kingdom public authorities.

1.4 When processing Personal Data subject to the KSA PDPL, the processor shall notify the controller in writing without undue delay if it becomes aware of any violation of the controller’s instructions or Kingdom laws.

2. TRANSFERS OF PERSONAL DATA

2.1 To the extent that the processor receives, accesses or otherwise transfers Personal Data outside of the Kingdom, the transfer shall comply with Article 29 of the KSA PDPL, including the Regulation on Personal Data Transfers outside the Kingdom, issued pursuant to the KSA PDPL, and in relation to any onward transfer of the Personal Data by the processor to another person, the other person shall comply with the same obligations.

2.2 In particular, the processor shall ensure that:

2.2.1 The transfer shall take place to a jurisdiction which maintains an appropriate level of Personal Data protection (commonly referred to as “adequacy”) as determined by the relevant Regulatory Authority in accordance with Article 29(2)(b) of the KSA PDPL;

2.2.2 The transfer shall not prejudice Kingdom national security or the interests of the Kingdom or violate Kingdom laws;

2.2.3 The transfer shall be limited to the minimum amount of Personal Data necessary; and

2.2.4 The processor shall assist the controller in ensuring compliance with an obligation to carry out a risk assessment of the impact of the envisaged transfer or disclosure of Personal Data outside the Kingdom.

2.3 To the extent the recipient jurisdiction is not considered as adequate under Article 29(2)(b) of the KSA PDPL, the processor shall seek prior approval from the controller prior to transferring the Personal Data outside of the Kingdom and the Parties shall negotiate in good faith modifications to this Schedule 3 in order to put in place a method for allowing the lawful

47 

transfer of Personal Data, which may include the provisions under model transfer terms, or prior registration, licensing or permission from a Regulatory Authority (“Lawful Export Measure”).

2.4 To the extent such Lawful Export Measure requires:

2.4.1 a contract imposing appropriate safeguards on the transfer and processing of such Personal Data (which is not otherwise satisfied by this Schedule);

2.4.2 a description of the processing of Personal Data contemplated under this Schedule; and

2.4.3 a description of technical and organisational measures to be implemented by the data importer,

the Parties agree that Annex V – Standard Contractual Clauses, Annex II - the description of processing activities, and Annex III - the description of technical and organisational measures, shall apply mutatis mutandis for the benefit of such transfer, and in relation to any onward transfer of the Personal Data by that data importer to another person, the other person shall comply with the same importer obligations.

2.5 The controller may in its absolute discretion refuse to give approval to transfer Personal Data outside of the Kingdom where the recipient of Personal Data is not located in the European Union.

48 

ANNEX I OF THE CLAUSES - LIST OF PARTIES

Controller:

Name:

Genomics Innovations Company Limited, a limited liability company organized uder the laws of the Kingdom of Saudi Arabia.

Address / registered office:

Building No. 3936, 6651 Al Nakheel District, 12382 Riyadh, Kingdom of Saudi Arabia

Contact person’s name, position and contact details:

[***]

[***]

Name and contact details of the data protection officer:

[***]

[***]

Signature and accession date: See following Signature Page.

Processor:

Name:

Centogene N.V., a company organized under the laws of the Netherlands.

Address / registered office:

Amsterdam and registered with the Kamer von Koophandel (Netherlands) under 72822872

Contact person’s name, position and contact details:

[***], General Counsel,

[***]

Name and contact details of the data protection officer:

[***], datenschutz nord GmbH, Konsul-Schmidt-Str. 88, 28217 Bremen

Signature and accession date: See following Signature Page.

49 

These Data Processing Clauses have been executed by the Parties on 27 November 2023.

Signed by Kim Stratton for and on behalf of Processor	/s/ Kim Stratton
Signed by Miguel Coego for and on behalf of Processor	/s/ Miguel Coego
Signed by Jeremy Panacheril for and on behalf of Controller	/s/ Jeremy Panacheril

50 

ANNEX II OF THE CLAUSES: DESCRIPTION OF THE PROCESSING

Categories of data subjects whose personal data is processed

- Employees (permanent staff, trainees, temporary workers, freelancers)

- Patients

- Health care professionals

- Suppliers / subcontractors / contact persons

Categories of personal data processed

- Personal master data (name, title, academic degree, date of birth)

- Contact details (email address, phone number, postal address)

- Contract data (contract details, services, customer number)

- Health Data

- Genetic Data

- Biometrical Data

- Billing data and payment information (invoice details, bank details, credit card information)

- Employee data

- Electronic communications data (IP address, internet pages accessed, information on the terminal device, operating system and browser used)

Sensitive data processed (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

- Genetic Data

- Health Data

- Biometrical Data

All Personal Data, including sensitive data, is generally processed with a high level of restriction and safeguards to protect the data, including strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers and additional security measures.

Nature of the processing

Performance of the services set out in SCHEDULE 2 of this Agreement.

Purpose(s) for which the personal data is processed on behalf of the controller

Performance of the services set out in SCHEDULE 2 of this Agreement.

Duration of the processing

The duration of the processing is limited to the term of this Agreement (c.f. clause 11 of this Agreement)

For processing by (sub-) processors, also specify subject matter, nature and duration of the processing

Sub-processor: Centogene GmbH

51 

Subject matter: Provision of NV Services as set out in Schedule 2 (Scope of Services).

Nature of processing: Collection, storage, consultation, use, disclosure by transmission, restriction, deletion and destruction (as applicable).

Duration of processing: Duration of processing is limited to the term of this Agreement

52 

ANNEX III OF THE CLAUSES - TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

See attached.

53 

ANNEX IV OF THE CLAUSES: LIST OF SUB-PROCESSORS

The controller has authorised the use of the following sub-processors:

Name	Address	Contact person’s name, position and cotact details	Description of the processing
Centogene GmbH	Am Strande 7, 18055 Rostock, Germany	[***], CFO [***]	Provision of NV Services as described in this Agreement on Schedule 2 (Scope of Services)

54 

ANNEX V OF THE CLAUSES:

STANDARD CONTRACTUAL CLAUSES

for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, and in accordance with Commission Implementing Decision (EU) 2021/914 of 4 June 2021

55 

MODULE 4: PROCESSOR TO CONTROLLER TRANSFER 

SECTION I

Clause 1

Purpose and scope

(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) for the transfer of personal data to a third country.

(b) The Parties:

(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A. (hereinafter each “data exporter”), and

(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A. (hereinafter each “data importer”)

have agreed to these standard contractual clauses (hereinafter: “Clauses”).

(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.

(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.

Clause 2

Effect and invariability of the Clauses

(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46 (2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.

(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.

Clause 3

Third-party beneficiaries

(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:

(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;

(ii) Clause 8 - Clause 8.1 (b) and Clause 8.3(b);

(iii) Clause 15.1(c), (d) and (e);

56 

(iv) Clause 16(e);

(v) Clause 18.

(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.

Clause 4

Interpretation

(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.

Clause 5

Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6

Description of the transfer(s)

The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

Clause 7 - Optional

Docking clause

[Not applicable]

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 8

Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.

8.1 Instructions

(a) The data exporter shall process the personal data only on documented instructions from the data importer acting as its controller.

57 

(b) The data exporter shall immediately inform the data importer if it is unable to follow those instructions, including if such instructions infringe Regulation (EU) 2016/679 or other Union or Member State data protection law.

(c) The data importer shall refrain from any action that would prevent the data exporter from fulfilling its obligations under Regulation (EU) 2016/679, including in the context of sub-processing or as regards cooperation with competent supervisory authorities.

(d) After the end of the provision of the processing services, the data exporter shall, at the choice of the data importer, delete all personal data processed on behalf of the data importer and certify to the data importer that it has done so, or return to the data importer all personal data processed on its behalf and delete existing copies.

8.2 Security of processing

(a) The Parties shall implement appropriate technical and organisational measures to ensure the security of the data, including during transmission, and protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access (hereinafter “personal data breach”). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature of the personal data, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects, and in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner.

(b) The data exporter shall assist the data importer in ensuring appropriate security of the data in accordance with paragraph (a). In case of a personal data breach concerning the personal data processed by the data exporter under these Clauses, the data exporter shall notify the data importer without undue delay after becoming aware of it and assist the data importer in addressing the breach.

(c) The data exporter shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

8.3 Documentation and compliance

(a) The Parties shall be able to demonstrate compliance with these Clauses.

(b) The data exporter shall make available to the data importer all information necessary to demonstrate compliance with its obligations under these Clauses and allow for and contribute to audits.

Clause 9

Use of sub-processors

[Intentionally Omitted]

Clause 10

Data subject rights

58 

The Parties shall assist each other in responding to enquiries and requests made by data subjects under the local law applicable to the data importer or, for data processing by the data exporter in the EU, under Regulation (EU) 2016/679.

Clause 11

Redress

(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.

Clause 12

Liability

(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.

(b) Each Party shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages that the Party causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter under Regulation (EU) 2016/679.

(c) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.

(d) The Parties agree that if one Party is held liable under paragraph (c), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its / their responsibility for the damage.

(e) The data importer may not invoke the conduct of a processor or sub-processor to avoid its own liability.

Clause 13

Supervision

[Not applicable]

59 

SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES

Clause 14

Local laws and practices affecting compliance with the Clauses

(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.

(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:

(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;

(ii) the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards;

(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.

(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.

(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.

(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).

(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed

60 

otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.

Clause 15

Obligations of the data importer in case of access by public authorities

15.1 Notification

(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:

(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or

(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.

(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.

(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.).

(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.

(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.

61 

15.2 Review of legality and data minimisation

(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).

(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.

(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.

SECTION IV – FINAL PROVISIONS

Clause 16

Non-compliance with the Clauses and termination

(a) The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.

(b) In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).

(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:

(i) the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;

(ii) the data importer is in substantial or persistent breach of these Clauses; or

(iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.

In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.

(d) Personal data collected by the data exporter in the EU that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall immediately be deleted in its entirety, including any copy thereof. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.

62 

(e) Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.

Clause 17

Governing law

These Clauses shall be governed by the law of a country allowing for third-party beneficiary rights. The Parties agree that this shall be the law of Germany.

Clause 18

Choice of forum and jurisdiction

Any dispute arising from these Clauses shall be resolved by the courts of Germany.

63 

APPENDIX

ANNEX I

A. LIST OF PARTIES

Data exporter: Processor, as defined in SCHEDULE 3 ANNEX I to this Agreement

Data importer: Controller, as defined in SCHEDULE 3 ANNEX I to this Agreement

B. DESCRIPTION OF TRANSFER

- access via IT systems

- via email (not sensitive data)

C. COMPETENT SUPERVISORY AUTHORITY

The competent supervisory authority in the EU Member State where the data exporter is established.

64 

Schedule 4

STAFFING AND SECONDMENT

1. Staffing

1.1 Staffing under this Agreement shall consist of the following groups:

1.1.1 Licensed Personnel who are Seconded Personnel (“Licensed Seconded Personnel”);

1.1.2 Licensed Personnel who are Other Personnel (“Licensed Other Personnel”);

1.1.3 Non-Licensed Personnel who are Seconded Personnel (“Non-Licensed Seconded Personnel”); and

1.1.4 Non-Licensed Personnel who are Other Personnel (“Non-Licensed Other Personnel”),

provided that NV Personnel may alternate between such categories.

1.2 Company and NV will develop, and as needed from time to time, and agreed on by the Parties in writing, adjust, staffing plans for NV Personnel that is in compliance with all Applicable Laws (each a “Staffing Plan”), subject to the budgetary approval requirements set forth in the Joint Venture Agreement and in accordance with the Business Plan. A preliminary Staffing Plan is set forth in Exhibit A to this Schedule 4. The Staffing Plan shall be negotiated in good faith following the Effective Date between the Parties and amended as necessary in NV’s reasonable discretion. The Staffing Plan shall include arrangements with respect to the payment of wages, benefits and Taxes (including VAT), in compliance with Applicable Law and in accordance with applicable industry standards, if applicable.

1.3 Company shall cooperate with the NV Personnel to permit them to render the NV Services in accordance with this Agreement and the Staffing Plan.

1.4 Company shall inform NV as soon as reasonably practicable of any action, omission, event or occurrence of which Company becomes aware that may constitute:

1.4.1 a material breach by any NV Personnel of any Approved Policy; or

1.4.2 a clinical or laboratory error attributable to or exacerbated by a NV Personnel.

Failure by Company to so inform NV of any of the matters described above shall not be deemed as a waiver by Company of any of its rights and remedies in connection therewith under this Agreement.

2. Except as expressly set forth herein, none of the provisions of this Agreement shall be construed to have the effect of forming any employment relationship by and between any of the NV Personnel and Company, and each of the NV Personnel shall remain an employee, officer, director, consultant, contractor or agent, as applicable, of NV (or its relevant Affiliate) for all purposes, including remuneration, promotion and career planning.

2.1 NV Personnel

2.1.1 To the extent any NV Personnel are on the premises of the KSA Facility or access Company’s systems, NV shall ensure that such NV Personnel observe and comply with any requirements under Schedule 3 (Personal Data and Information Security) and any Company policies provided by Company to NV reasonably in advance and in writing

65 

and applicable to Company contractors or staff on Company premises or accessing Company systems.

2.1.2 NV shall ensure all NV Personnel are suitably qualified and have the relevant management and experience level required to provide the NV Services. Where NV Personnel are required to have specific qualifications, certifications or levels of experience in accordance with the Staffing Plan and/or Exhibit A to this Schedule 4 (Staffing and Secondment) NV shall use Commercially Reasonable Efforts to ensure that the relevant NV Personnel involved in providing the relevant NV Services to Company comply with such qualifications, certifications or levels of experience.

2.1.3 Subject to the terms of this Schedule 4 (Staffing and Secondment), NV Personnel shall remain under the overall control and supervision of NV at all times during the Term and NV shall be fully responsible for them.

3. SECONDED PERSONNEL

3.1 If Company is not reasonably satisfied with any NV Personnel for any reason, NV shall remove and replace such NV Personnel as soon as reasonably practicable at Company’s reasonable request and such replacement personnel shall otherwise meet the required qualifications, certifications and levels of experience as described in clause 2.1.2 and to the reasonable satisfaction of Company.

3.2 Notwithstanding anything to the contrary herein, no provisions of this Agreement will be construed to have the effect of forming any relationship of employer and employee between Company and any NV Personnel, each of whom shall remain an employee of NV (or its relevant Affiliate) for all purposes, including remuneration, promotion and career planning. Company shall employ Seconded Personnel who the Parties agree in writing from time to time will be employed by Company (the “Approved Seconded Personnel”) pursuant to a KSA employment contract approved by the Parties in writing (each, an “Approved Employment Contract”). Company shall supervise and control the activities of such Approved Seconded Personnel who are employees of Company in a manner consistent with this Agreement.

3.3 NV shall permit Company to employ such Approved Seconded Personnel, and shall permit such Approved Seconded Personnel to perform NV Services also while they are outside the KSA. While in the KSA during each secondment, such Approved Seconded Personnel shall devote substantially all of his or her working time to Company.

3.4 Company will be the sponsor and employer of such Approved Seconded Personnel for KSA immigration and labour law purposes, and will assist such Approved Seconded Personnel in obtaining and maintaining immigration and labour sponsorship as well as any other licenses or authorizations required for their work in connection with this Agreement. It is understood and agreed that Company shall have no liability whatsoever to any person if any Approved Seconded Personnel is unable to obtain a residence visa, work permit, or other license or sponsorship.

3.5 Company shall not enter into any amendments to an Approved Employment Contract or enter into any other agreements with such Approved Seconded Personnel, without the advance written approval of NV, such approval not to be unreasonably withheld or delayed.

3.6 The salary, normal working hours and benefits of any Approved Seconded Personnel shall be as defined and set out in the Approved Employment Contract, except as otherwise agreed between Company and the affected Approved Seconded Personnel.

66 

3.7 Company shall comply with the Approved Employment Contracts, the Approved Policies and applicable KSA laws and regulations that apply to the relevant Approved Seconded Personnel. Company shall not, and shall not require the Approved Seconded Personnel to do anything that shall, breach any provisions of the Approved Employment Contract or the Approved Policies. NV shall direct each Approved Seconded Personnel that the Parties agree will be employed by Company from time to time to comply with such individual’s Approved Employment Contract and the Approved Policies.

4. Compensation of NV Personnel

Except for the Project Consultation Fees directly payable by Company to NV Personnel (as applicable) pursuant to this Agreement, NV shall pay, or cause the appropriate person to pay, all wages and benefits to which the NV Personnel may be entitled.

5. SAFETY

5.1 Company shall maintain a safe and secure premises for all NV Personnel providing the NV Services in KSA and shall not knowingly direct any NV Personnel to engage in conduct or duties that may endanger their safety or security or the safety or security of others. In addition, Company shall take all reasonable steps to ensure a safe and harassment free working environment for NV Personnel. Should Company learn of any safety, security, or harassment related issue, Company shall promptly report such issue to NV and respond timely to correct the issue.

5.2 If at any time NV reasonably determines the safety or security of any NV Personnel is endangered or they are being asked to act contrary to Approved Policies, including NV Personnel being subjected to a harassing environment, NV shall have the right upon reasonable written notice to Company to require that appropriate action be taken to remedy the situation in a timely manner.

67 

EXHIBIT A

[***]