(a) the processor, or sub-processor, of the Personal Data for and on behalf of the Client as necessary for the provision of the Service to the Client and, to the extent allowed by law, for the Permitted Business Purposes:&nbsp;</p> <p>(i) where the Client acts as a controller, Veriff acts as a processor;</p> <p>(ii) where the Client acts as a processor on behalf of another controller, Veriff acts as a sub-processor;</p> <p>unless processing is allowed or mandated by the law of the European Union, any European Union member state or any other applicable law to which Veriff is subject, in which case Veriff shall act as a controller, to the extent permitted by the law, and inform the Client before processing the Personal Data, unless Veriff is legally not allowed to inform the Client.</p> <p>For purposes of the US Data Protection Laws, Veriff will act as a service provider or processor (as defined in US Data Protection Laws), as applicable, in its performance of its obligations pursuant to the Agreement and this DPA.</p> <p>2.3. Regarding the personal data of the Parties’ representatives, each Party shall be individually and separately responsible for complying with the obligations that apply to it as a separate and independent data controller under Data Protection Laws.&nbsp;</p>