APPENDIX [ D ] to [ Contract / Agreement] Version 1.2: COMMISSION DECISION 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of  personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the  Council, as amended. Supplementary details of how data is backed up  (add any relevant details): Supplementary details of security settings used  (add any relevant details): This Appendix forms part of the Clauses and must be completed by the parties. Appendix 2 to the Standard Contractual Clauses Description of the technical and organisational security measures implemented by the data  importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached):  ☐ We choose the most appropriate secure settings for our devices and software Most hardware  and software will need some level of set-up and configuration in order to provide effective protection. ☐ We use firewalls to protect our internet connection This will be your first line of defence against  an intrusion from the internet.  Supplementary details of firewalls used  (add any relevant details): Supplementary details of how access to your system is controlled  (add any relevant details): Supplementary details of antivirus and malware protection used  (add any relevant details): Supplementary details of how software and devices are kept up to date  (add any relevant details,  including details of the software packages, cloud services and devices you use in processing the  personal data transferred, and how you keep those updated): ☐ We regularly backup our data  Regular backups of your most important data will ensure it can be  quickly restored in the event of disaster or ransomware infection.  ☐ We keep our software and devices up-to-date Hardware and software needs regular updates to  fix bugs and security vulnerabilities.  ☐ We protect ourselves from viruses and other malware? Anti-virus products can regularly scan  your network to prevent or detect threats.  ☐ We control who has access to your data and services Restrict access to your system to users  and sources you trust.  ☐  Other (please provide details of other types of processing):  þ  Erasing data, including destruction and deletion  þ  Returning data to the data exporter or data subject  ☐  Sharing data, including disclosure, dissemination, allowing access or otherwise making available