European Union Data Act Exhibit

EXHIBIT E: EU DATA ACT

For the purposes of this Exhibit, the following definitions apply:

1. Definitions

"Destination Provider" means a different provider other than CrowdStrike of data processing services of the same service type, or Customer's own on-premises infrastructure.

"Exportable Data" means Customer Data (as defined in Exhibit A of the Agreement) that CrowdStrike can lawfully retrieve, make available to Customer without disproportionate effort beyond simple operations and which is subject to Customer's purchased data retention period under the applicable Order. Exportable Data excludes: (i) CrowdStrike Data; (ii) any CrowdStrike or third party intellectual property or trade secrets, including but not limited to proprietary algorithms, source code, or CrowdStrike threat intelligence reports and insights; (iii) data whose export would compromise the security or functionality of the Products; and (iv) any Customer Data that has been deleted in accordance with Customer's purchased data retention period.

"Switching Process" means the process whereby Customer changes from using CrowdStrike's Offerings to using services of a Destination Provider, including the export and transfer of Exportable Data.

2. Switching Notice And Process
 

         2.1.   Customer may initiate the Switching Process by opening a support case for a “provider switching process” via the Support Portal at https://supportportal.crowdstrike.com , observing a two-month notice period ("Notice Period").
 

        2.2.   During the Notice Period, the parties will coordinate regarding the Switching Process, including identification of available Exportable Data and technical requirements.
 

        2.3.   Customer acknowledges that the availability of Exportable Data is subject to Customer's purchased data retention period under the applicable Order. CrowdStrike has no obligation to retain or provide access to Customer Data beyond such purchased retention period.
 

3. Transitional Period
 

        3.1.   Following the Notice Period, CrowdStrike will provide reasonable assistance to Customer and authorized third parties to facilitate the Switching Process during a transitional period of up to thirty (30) calendar days ("Transitional Period").
 

        3.2.   Customer may request to extend the Transitional Period once, which CrowdStrike and Customer shall discuss in good faith.
 

        3.3.   Throughout the Transitional Period, CrowdStrike will maintain business continuity and technical and organisational standards in accordance with the Agreement.
 

4. Data Retrieval
 

        4.1.   After the Transitional Period, Customer will have up to thirty (30) calendar days to retrieve Exportable Data ("Retrieval Period").
 

        4.2.   CrowdStrike will provide Exportable Data for Customer’s download in a structured and machine-readable format supported by the Products.
 

        4.3.   Customer is solely responsible for importing and implementing Exportable Data into new systems or infrastructure.
 

        4.4.   At the end of the Retrieval Period, CrowdStrike will delete Exportable Data in accordance with Section 7.4 (“Destruction”) of the Agreement and in accordance with its standard data retention practices, except where retention is required by applicable law. Upon Customer’s request, CrowdStrike will provide Customer with written confirmation of destruction in compliance with this provision.
 

5. Customer Obligations
 

Customer shall:
 

        5.1.   Use available self-service export capabilities where possible;
 

        5.2.   Provide reasonable cooperation and technical information necessary for the Switching Process;
 

        5.3.   Comply with all confidentiality obligations under the Agreement;
 

        5.4.    Notify CrowdStrike promptly upon completion of the Switching Process;
 

        5.5.   Continue to pay for the  Offerings at Customer’s agreed then current rates through to the latter of :(i) the current committed Subscription Term; or (ii)  the Notice, Transition and Retrieval Period.

6. Crowdstrike Obligations
 

CrowdStrike shall:
 

        6.1.    Provide clear information about known risks to the Customer’s service continuity;
 

        6.2.   Maintain the technical and organisational measures set out in the Agreement during the Switching Process;
 

       6.3.   Continue providing Offerings under the Agreement during the Notice Period and Transitional Period;
 

        6.4.   Make available documentation regarding Exportable Data and formats supported by Crowdstrike Products for export.
 

7. Switching Charges
 

        7.1.   No additional charges will apply for Customer's use of available standard self-service export capabilities, beyond the fees Customer has agreed to pay for the current committed Subscription Term.
 

        7.2.   CrowdStrike may charge reasonable costs for manual assistance beyond standard export capabilities, calculated at CrowdStrike's then-current professional services rates.
 

8. Payment Obligations And Termination
 

        8.1.   Offerings that are subject to the data processing services under the EU Data Act will terminate upon the earlier of: (a) Customer's written confirmation it has  completed the Switching Process; (b) expiration of the Retrieval Period; or (c) Customer's written request to delete the data processing service without transferring Exportable Data.
 

        8.2.   Notwithstanding termination under this Exhibit, Customer remains liable for all fees and charges under the Agreement, including the full Subscription/Order Term fees. There shall be no refund of any pre-paid fees or relief from fees for Offerings that have been ordered, but not yet invoiced or paid in  full.
 

        8.3.   If Customer has not paid the total fees under applicable Orders, all remaining amounts become immediately due and payable upon termination.
 

9. Disclaimer
 

        9.1.  CrowdStrike's obligations under this Exhibit are subject to:
 

                    9.1.1. Technical feasibility and security requirements;
 

                    9.1.2. Customer's purchased data retention periods;
 

                    9.1.3. Applicable laws and regulations;
 

                    9.1.4. Protection of CrowdStrike's intellectual property rights.
 

        9.2.   CrowdStrike expressly disclaims any and all kinds of liability or warranty, whether express, implied, statutory or otherwise regarding the compatibility or functionality of Exportable Data with Destination Provider systems.

10.  Order of precedence. This Exhibit shall govern and prevail solely with respect to the subject matter herein.