DATA PROCESSING TERMS - 1.0

Oculus and you agree to the following:

1.1 For the purposes of these Data Processing Terms, the following terms have the meaning set out below:

2.1 The terms of these Data Processing Terms shall apply only where and to the extent that Data processed by Oculus as a Processor on behalf of Oculus is subject to the GDPR.

2.2 Oculus shall:

2.2.1 only process Data for the purposes described in Annex A;

2.2.2 implement appropriate technical and organisational measures to protect the Data;

2.2.3 assist you by appropriate technical and organisational measures insofar as this is possible (taking into account the nature of the Processing) to enable you to fulfil any obligations to respond to requests for the exercise of Data Subject rights by a Data Subject under GDPR;

2.2.4 assist you in ensuring compliance with its obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to Oculus;

2.2.5 on termination of the Applicable Developer Terms, delete the Data as soon as reasonably practicable and within a maximum period of 180 days unless EU or EU Member State law requires further storage, provided however that Oculus may keep the Data if necessary to provide other services set forth in the Applicable Developer Terms;

2.2.6 make available to you all information that is reasonably necessary to demonstrate Oculus's compliance with its legal obligations as a Data Processor under Article 28 of the GDPR; and

2.2.7 upon your reasonable written request, and subject to the confidentiality obligations set out in the Applicable Developer Terms (if any), Oculus shall make available to you no more than once in any 12 month period, information regarding Oculus’s compliance with Oculus’s data processing obligation under this Agreement in the form of such third-party certifications and/or audit reports as Oculus may deem appropriate to be carried out as part of Oculus's own internal audit programs.

2.3 You agree that Oculus may subcontract its data processing obligations under these Data Processing Terms to a sub-processor, but only by way of a written agreement with the sub-processor, which imposes obligations on the sub-processor no less onerous than as are imposed on Oculus under these Data Processing Terms. Where the sub-processor fails to fulfil such obligations, Oculus shall remain fully liable to you for the performance of that sub-processor's obligations. You hereby authorize Oculus to engage Facebook Technologies LLC or Facebook Inc. (and other Facebook Companies) as its sub-processor(s). Oculus shall notify you of any additional sub-processor(s) in advance. If you reasonably object to such additional sub-processor(s), you may inform Oculus in writing of the reasons for your objections. If you object to such additional sub-processor(s), you should stop using the Services and providing Data to Oculus.

2.4 Oculus shall notify you without undue delay of the discovery by Oculus of any actual or suspected Personal Data Breach involving the Data. Such notice shall include, at the time of notification or as soon as possible after notification, details of the nature of the breach and number of records affected, the category and approximate number of affected data subjects, anticipated consequences of the breach and any actual or proposed remedies for mitigating the possible adverse effects of the breach.

3.1 In the event of any conflict, these Data Processing Terms shall take precedence over the Applicable Developer Terms and the terms of the Processor SCCs shall take precedence over these Data Processing Terms.

3.2 These Data Processing Terms, in conjunction with the Applicable Developer Terms, constitutes the entire understanding and agreement between you and Oculus with respect to its subject matter.

3.3 These Data Processing Terms shall automatically terminate upon the termination or expiration of the Applicable Developer Terms.

Annex A

This Annex A forms part of the Data Processing Terms and describes the Processing that Oculus will perform on your behalf.

The Data to be Processed concern the following categories of Personal Data (please specify):

• VOIP/audio data and spatial data (with randomized ID)

The Data transferred concern the following special categories of Data (please specify):

• N/A

The Data to be Processed concern the following categories of Data Subjects (please specify):

• Users of your app(s)

The Data will be subject to the following basic Processing activities (please specify):

• to return realistic audio (or spatial audio data) based on the position of users within your app(s);

• to derive metadata from the activity of users within your app(s) (inclusive of zone ID, length of time associated with the zone ID, randomized ID, App ID, bits of audio dropped, latency for zone) which is necessary in order to provide support and/or operate the Services; and

• to anonymize the metadata so that it is no longer Personal Data for the purposes of GDPR. You understand and agree that Oculus may retain such anonymized metadata for its own legitimate purposes, including improvement and development of the Services.

Oculus shall process the Data:

• As necessary to provide support and/or operate the Services under the Applicable Developer Terms or otherwise in accordance with your documented instructions.