Data Processing Addendum

The following terms have the meanings set out below for purposes of this DPA. Any capitalized terms not defined in this DPA have the meanings given in the Agreement.

• Affiliate means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity, where "control" refers to the power to direct or cause the direction of the subject entity, whether through ownership of voting securities, by contract or otherwise.
• Applicable Data Protection Laws means the privacy, data protection and data security laws and regulations applicable to Provider's Processing of Personal Data under the Agreement, including, as and to the extent applicable, the State Privacy Laws and GDPR.
• Customer-Hosted Environment means a deployment in which Customer (or a third party engaged by Customer) provides, owns or controls the infrastructure on which the Services run or on which Customer Data is stored, including a self-hosted Supabase instance, Customer's own database server, or Customer's own cloud tenancy. Provider does not own, operate or control that infrastructure.
• Provider-Hosted Environment means a deployment in which Provider provides the infrastructure on which the Services run and on which Customer Data is stored, using the Subprocessors identified in Annex 5.
• Controller means the entity that, alone or jointly with others, determines the purposes and means of the Processing of Personal Data, including, as applicable, any "business" or "controller" as such term is defined by the California Consumer Privacy Act (the "CCPA") or other State Privacy Laws.
• Customer Data means information provided or otherwise made available by or on behalf of Customer to Provider for Processing on Customer's behalf to perform the Services.
• Data Subject means the identified or identifiable natural person to whom Personal Data relates.
• EEA means the European Economic Area.
• FADP means the Swiss Federal Act on Data Protection of 25 September 2020 (as amended and in force from 1 September 2023) and any applicable implementing legislation and ordinances, and, to the extent applicable, its predecessor of 19 June 1992.
• FDPIC means the Swiss Federal Data Protection and Information Commissioner.
• GDPR means, as and where applicable to Processing concerned: (i) the General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"); and/or (ii) the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (as amended) ("UK GDPR"), including, in each case, any applicable national implementing or supplementary legislation (e.g., the UK Data Protection Act 2018), and any successor, amendment or re-enactment thereof. References to "Articles" and "Chapters" of, and other relevant defined terms in, the GDPR shall be construed accordingly.
• Information Security Incident means a breach of Provider's security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in Provider's possession, custody or control. Information Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.
• Personal Data means Customer Data that constitutes "personal data," "personal information," or "personally identifiable information" as defined in Applicable Data Protection Laws or information of a similar character regulated thereby, provided that Personal Data does not include such information pertaining to Customer's business contacts who are Customer personnel or such information that Provider receives, collects, or generates independently of the Services and not from or on behalf of Customer.
• Process or Processing means any operation or set of operations which is performed by Provider (or on Provider's behalf) for Customer under the Agreement on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• Processor means the entity that Processes Personal Data on behalf of the Controller, including, as applicable, any "service provider" or "contractor" as those terms are defined by the CCPA.
• Restricted Transfer means the disclosure, grant of access or other transfer of Personal Data to any person located in: (i) in the context of the EEA, any country or territory outside the EEA which does not benefit from an adequacy decision from the European Commission (an "EU Restricted Transfer"); (ii) in the context of the UK, any country or territory outside the UK which does not benefit from an adequacy decision from the UK Government (a "UK Restricted Transfer"); and (iii) in the context of Switzerland, a country or territory outside of Switzerland which does not benefit from an adequacy decision from the Swiss Government (a "Swiss Restricted Transfer"), in each case, which would be prohibited without a legal basis under applicable data protection law (including Chapter V of the GDPR, where applicable).
• SCCs means the standard contractual clauses approved by the European Commission pursuant to implementing Decision (EU) 2021/914.
• Security Measures has the meaning given in Section 4(a) (Provider Security Measures).
• Services means the flow Services as described in the Agreement.
• State Privacy Laws means, collectively, the comprehensive state-specific data privacy laws (and any implementing regulations) currently in effect and applicable to Provider's Processing of Personal Data under the Agreement.
• Subprocessors means Provider's Affiliates and third parties that Provider engages to Process Personal Data in relation to the Services.
• Supervisory Authority means any entity with the authority to enforce Applicable Data Protection Laws, including, (i) in the context of the EEA and the EU GDPR, the meaning given to that term in the EU GDPR; (ii) in the context of the UK and the UK GDPR, the UK Information Commissioner's Office; and (iii) in the context of Switzerland and the FADP, the FDPIC.
• UK Transfer Addendum means the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of the Mandatory Clauses included in Part 2 thereof.

(a) This DPA will remain in effect so long as Provider Processes Personal Data, notwithstanding the expiration or termination of the Agreement.

(b) Processing of Personal Data subject to the GDPR shall be subject to Annex 2 (European Annex).

(c) Processing of Personal Data subject to the State Privacy Laws with respect to which Customer is a Business, Controller, Processor, or Service Provider (as such terms are defined in State Privacy Laws) shall be subject to Annex 3 (State Privacy Laws Annex) to this DPA.

Provider will Process Personal Data only in accordance with Customer's documented instructions to Provider, including as set out in this DPA, the Agreement, any applicable order form(s), and any other written instructions provided by Customer from time to time that are consistent with the Agreement and this DPA. To the extent Customer requests instructions that are outside the scope of the Services or that would require Provider to materially change the Services or undertake additional work not contemplated by the Agreement, the Parties will agree to such instructions in a mutually executed amendment to this DPA or other written agreement. By entering into this DPA, Customer instructs Provider to Process Personal Data to provide the Services and to perform its other obligations and exercise its rights under the Agreement. The Parties agree that the details of Provider's Processing of Personal Data (including the respective roles of the Parties relating to such Processing) are as described in Annex 1 (Data Processing Details) to this DPA.

(a) Provider Security Measures. Provider will implement and maintain technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data as described in Annex 4 (the "Security Measures"), in each case in respect of the components of the Services that Provider operates and controls and as further allocated in Section 4(f) (Deployment models), taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing and the risks to Data Subjects. Provider may update the Security Measures from time to time, including to maintain or improve security or address changes in Applicable Data Protection Laws, so long as the updated measures do not materially decrease the overall protection of Personal Data.

(b) Security compliance by Provider staff. Provider will require that its personnel who are authorized to access Personal Data are subject to appropriate confidentiality obligations.

(c) Information Security Incidents. Provider will notify Customer without undue delay of any Information Security Incident of which Provider becomes aware. In a Customer-Hosted Environment, Provider's notification obligation extends to incidents affecting systems Provider operates and to any Personal Data within Provider's possession or control; Customer is responsible for detecting, investigating and notifying incidents affecting its own infrastructure, and Provider will provide reasonable assistance at Customer's request. Such notifications will describe, to the extent then known, available details of the Information Security Incident, including steps taken to mitigate the potential risks and steps Provider recommends Customer take to address the Information Security Incident. Provider's notification of or response to an Information Security Incident will not be construed as Provider's acknowledgement of any fault or liability with respect to the Information Security Incident. Provider will reasonably cooperate with Customer and take such commercially reasonable steps, to the extent within Provider's control, as may be reasonably requested by Customer and mutually agreed in good faith by the Parties to assist in the investigation of any such Information Security Incident. Customer is solely responsible for complying with notification laws applicable to Customer and fulfilling any third-party notification obligations related to any Information Security Incident. If Customer determines that an Information Security Incident must be notified to any Supervisory Authority, any Data Subject(s), the public or others under Applicable Data Protection Laws, to the extent such notice directly or indirectly refers to or identifies Provider, where permitted by applicable law, Customer agrees to (i) notify Provider in advance, and (ii) in good faith, consult with Provider and consider any clarifications or corrections Provider may reasonably recommend or request to any such notification, which: (a) relate to Provider's involvement in or relevance to such Information Security Incident; and (b) are consistent with applicable laws.

(d) Customer's security responsibilities. Customer agrees that, without limitation of Provider's obligations under this Section 4, Customer is solely responsible for its use of the Services, including (i) making appropriate use of the Services to ensure a level of security appropriate to the risk in respect of the Personal Data; (ii) securing the account authentication credentials, systems and devices Customer uses to access the Services; (iii) securing Customer's systems and devices that Customer provides or makes available for Provider to access in order to provide the Services; and (iv) backing up Personal Data, as applicable.

(f) Deployment models and shared responsibility. The allocation of security responsibility depends on how the Services are deployed for Customer, as recorded in the Agreement or the applicable order form.

(i) Provider-Hosted Environment. Provider is responsible for the Security Measures across the hosting, storage and application layers it operates, and engages the Subprocessors listed in Annex 5 for that purpose.

(ii) Customer-Hosted Environment. Customer is responsible, as between the Parties, for the security, configuration, availability, capacity, patching, network and physical protection, encryption at rest, logging, backup and disaster recovery of the infrastructure it provides, and for administering accounts and access at that infrastructure layer. Provider remains responsible for the application code and configuration it delivers, for the security of its own systems and tooling, for the confidentiality obligations and access controls applying to its personnel, and for Processing Personal Data only on Customer's documented instructions. Provider is not responsible for, and gives no warranty in respect of, the security, availability, integrity or recoverability of infrastructure it does not operate. Where a Security Measure in Annex 4 relates to a layer Customer controls, that measure is Customer's responsibility and Provider's obligation is limited to not undermining it.

(iii) Subprocessors in a Customer-Hosted Environment. The hosting and storage Subprocessors in Annex 5 do not apply to Personal Data that resides solely in Customer's own infrastructure. Any Subprocessor engaged for a particular engagement is identified in the documentation for that engagement.

(iv) Nothing in this Section 4(f) limits Provider's obligations under the remainder of this DPA in respect of Personal Data that Provider actually accesses, receives or stores, including during support, maintenance or migration work.

(e) Customer's security assessment. Customer acknowledges that it has evaluated the Services, the Security Measures and Provider's commitments under this DPA and, based on information made available by Provider, determines that they are adequate to meet Customer's needs, including with respect to any security obligations of Customer under Applicable Data Protection Laws, and provide a level of security appropriate to the risk in respect of the Personal Data.

(a) Data Subject Request assistance. Provider will (taking into account the nature of the Processing of Personal Data) provide Customer with assistance reasonably necessary and technically feasible for Customer to perform its obligations under Applicable Data Protection Laws to fulfill requests by Data Subjects to exercise their rights under Applicable Data Protection Laws ("Data Subject Requests") with respect to Personal Data in Provider's possession or control. Customer will compensate Provider for any such assistance, to the extent such assistance requires work beyond the Services, at Provider's then-current professional services rates, which shall be made available to Customer upon request, and Provider will, upon request, provide Customer with a good-faith estimate of applicable fees.

(b) Customer's responsibility for requests. If Provider receives a Data Subject Request, Provider will (i) promptly notify Customer (unless prohibited by applicable law); and (ii) advise the Data Subject to submit the request to Customer. Customer will be solely responsible for responding to any such request, unless otherwise required by applicable law.

(a) Customer will ensure (and is solely responsible for ensuring) that it has provided all notices to, and obtained all consents and permissions from, third parties (including, without limitation, Data Subjects), and has reserved all necessary rights, in each case, as may be required under Applicable Data Protection Laws for Provider to Process Personal Data as contemplated by the Agreement.

(b) Restricted Data. The following are "Restricted Data": government-issued identification numbers; protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA) or other information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; health insurance information; biometric information; passwords or other credentials for third-party online accounts (other than credentials created for and used solely to access the Services); credentials to any financial accounts; tax return data; payment card information subject to the Payment Card Industry Data Security Standard; personal data of children under the age of 16; and any other information falling within any special categories of data (as defined in Applicable Data Protection Laws).

Except for the categories of Restricted Data that the Services are expressly configured to Process for Customer and that are documented in the Agreement, the applicable order form, or Annex 1 ("Permitted Restricted Data"), Customer represents and warrants that Customer Data does not and will not contain Restricted Data. Where the Services are built to Process Permitted Restricted Data, both Parties acknowledge that Processing is intended, and Section 6(e) applies to it.

(e) Special category and biometric data. Where the Services are configured to Process Permitted Restricted Data, including biometric identifiers such as facial-recognition templates used for staff attendance, employment records such as payroll and leave, or other special category data: (i) Customer is the Controller of that data and determines the purpose for which it is collected; (ii) Customer is responsible for establishing and documenting a lawful basis for that Processing, including any condition required under Article 9 of the GDPR and any consent, notice, retention-schedule or written-policy requirement imposed by applicable biometric privacy laws; (iii) Customer is responsible for giving Data Subjects the notices, and obtaining the consents or authorizations, that those laws require before the data is collected; (iv) the Parties will record the categories concerned, the retention period and any additional safeguards in the documentation for the engagement; and (v) Provider will Process that data only as needed to provide the Services and will apply the Security Measures to it, subject to Section 4(f) where the data resides in a Customer-Hosted Environment.

(c) Customer shall ensure that there is, and will be throughout the term of the Agreement, a valid legal basis for the Processing by Provider of Personal Data in accordance with this DPA and the Agreement (including any and all instructions issued by Customer from time to time in respect of such Processing) as required under all Applicable Data Protection Laws (including, where applicable, Articles 6, 9(2) and/or 10 of the GDPR).

(d) Customer will ensure that all Data Subjects have (i) been presented with all required notices and statements (including as required by Articles 12-14 of the GDPR, where applicable); and (ii) provided all required consents, in each case relating to the Processing by Provider of Personal Data. Where Customer uses the Services to send messages (for example over WhatsApp), Customer is responsible for having the recipient's consent to be contacted where required by law and by the messaging platform's terms.

(a) Consent to Subprocessor engagement. Customer specifically authorizes the engagement of Provider's Affiliates as Subprocessors and generally authorizes Provider to engage third parties as Subprocessors in accordance with this Section 7.

(b) Information about Subprocessors. Information about Subprocessors, including their functions and locations, is available in Annex 5 of this DPA (the "Subprocessor List"). Provider may continue to use those Subprocessors already engaged by Provider as of the effective date of this DPA.

(c) Requirements for Subprocessor engagement. When engaging any Subprocessor, Provider will enter into a written contract with such Subprocessor containing data protection obligations not less protective than those in this DPA with respect to Personal Data to the extent applicable to the nature of the services provided by such Subprocessor. Provider shall remain responsible for the performance of all obligations subcontracted to the Subprocessor and shall be liable for all acts and omissions of the Subprocessor to the same extent as Provider would have been had it performed the Processing itself.

(d) Opportunity to object to Subprocessor changes. When Provider engages any new Subprocessor after the effective date of this DPA, Provider will notify Customer of the engagement (including the name and location of the relevant Subprocessor and the activities it will perform) by updating the Subprocessor List and providing written notice (including by email) to Customer's designated contact for Services-related communications, or by other written means. If Customer objects to such engagement in a written notice to Provider within 15 days after receipt of such notice on reasonable grounds relating to the protection of Personal Data, Customer and Provider will work together in good faith to find a mutually acceptable resolution to address such objection. If the Parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, Customer may, as its sole and exclusive remedy, terminate the Agreement and cancel the Services by providing written notice to Provider and pay Provider for all amounts due and owing under the Agreement as of the date of such termination.

Customer may audit Provider's compliance with its obligations under this DPA up to once per year and on such other occasions as may be required by Applicable Data Protection Laws solely to the extent Customer is legally required to conduct such additional audit or a competent Supervisory Authority with jurisdiction over Customer requires it, in each case upon Customer's written request providing reasonable detail and, where available, supporting documentation of the applicable requirement. Provider will contribute to such audits by providing Customer with the information and assistance reasonably necessary to conduct the audit. If a third party is to conduct the audit, Provider may object to the auditor if the auditor is, in Provider's reasonable opinion, not independent, a competitor of Provider, or otherwise manifestly unsuitable. Such objection by Provider will require Customer to appoint another auditor or conduct the audit itself.

To request an audit, Customer must submit a proposed audit plan to Provider at least two weeks in advance of the proposed audit date and any third-party auditor must sign a customary non-disclosure agreement mutually acceptable to the Parties (such acceptance not to be unreasonably withheld) providing for the confidential treatment of all information exchanged in connection with the audit and any reports regarding the results or findings thereof. The proposed audit plan must describe the proposed scope, duration, and start date of the audit. Provider will review the proposed audit plan and provide Customer with any concerns or questions (for example, any request for information that could compromise Provider security, privacy, employment or other relevant policies). Provider will work cooperatively with Customer to agree on a final audit plan. Nothing in this Section 8 shall require Provider to breach any duties of confidentiality.

If the controls or measures to be assessed in the requested audit are addressed in a SOC 2 Type 2, ISO, NIST or similar audit report performed by a qualified third-party auditor within 12 months of Customer's audit request (including such a report covering a Subprocessor that hosts the relevant Personal Data) and Provider has confirmed there have been no known material changes in the controls audited since the date of such report, Customer agrees to accept such report in lieu of requesting an audit of such controls or measures. The audit must be conducted during regular business hours, subject to the agreed final audit plan and Provider's safety, security or other relevant policies, and may not unreasonably interfere with Provider business activities. Customer will promptly notify Provider of any non-compliance discovered during the course of an audit and provide Provider any audit reports generated in connection with any audit under this Section 8, unless prohibited by Applicable Data Protection Laws. Customer may use the audit reports only for the purposes of meeting Customer's regulatory audit requirements and/or confirming compliance with the requirements of this DPA.

Any audits are at Customer's sole expense. Customer shall reimburse Provider for any reasonable, documented costs (including reasonable internal time expended by Provider and any third parties in connection with any audits or inspections under this Section 8 at Provider's then-current professional services rates, which shall be made available to Customer upon request). Customer will be responsible for any fees charged by any auditor appointed by Customer to execute any such audit.

(a) Subject to Sections 9(b) and 9(c), upon the date of cessation of any Services involving the Processing of Personal Data (the "Cessation Date"), Provider will promptly cease all Processing of Personal Data for any purpose other than for storage and Processing necessary to effect the return, deletion, or anonymization of such Personal Data, or as otherwise permitted or required under this DPA or applicable law.

(b) Subject to Section 9(d), to the extent technically feasible in the circumstances (as determined in Provider's sole discretion), on written request to Provider (to be made within 30 days after the Cessation Date (the "Post-cessation Storage Period")), Provider will, within a commercially reasonable period following receipt of such request, as elected by Customer in such request, either (i) return a complete copy of all Personal Data within Provider's possession to Customer by secure file transfer or other commercially reasonable secure method, promptly following which Provider shall delete or anonymize all other copies of such Personal Data, or (ii) delete or anonymize all Personal Data within Provider's possession.

(c) If, during the Post-cessation Storage Period, Customer does not instruct Provider in writing to either delete or return Personal Data under Section 9(b), Provider will, within a commercially reasonable time after the expiry of the Post-cessation Storage Period, either (at its option) delete or anonymize all Personal Data then within Provider's possession, custody or control to the fullest extent technically feasible in the circumstances.

(d) Provider may retain Personal Data to the extent permitted or required by applicable law, for no longer than such applicable law requires, provided that Provider will (i) maintain the confidentiality of all such Personal Data and protect it in accordance with the Security Measures, (ii) Process such Personal Data only as necessary for the purpose(s) specified in the applicable law permitting or requiring such retention, and (iii) delete or anonymize such Personal Data once it is no longer permitted or required to be retained under applicable law.

(a) Provider will not use Personal Data to train, fine-tune, develop, or improve any artificial intelligence or machine learning model, whether Provider's own or a third party's, unless (i) such use is reasonably necessary to provide the Services in accordance with Customer's documented instructions, or (ii) expressly authorized by Customer in writing.

(b) Provider will prohibit its Subprocessors, including any AI model providers, from using Personal Data for their own model training, fine-tuning, development, or improvement purposes, except as expressly authorized by Customer in writing.

(c) If the Services involve automated decision-making that produces legal or similarly significant effects on Data Subjects, Provider will: (i) disclose the existence of such processing to Customer; (ii) to the extent reasonably available to Provider, provide meaningful information about the logic involved without requiring disclosure of Provider's trade secrets or confidential information; and (iii) reasonably cooperate with Customer, as required by Applicable Data Protection Laws, to enable Data Subjects to exercise applicable rights under such laws relating to automated decision-making. Whether the Services perform such processing depends on what Customer has asked Provider to build. In Provider's standard configuration, AI features draft, suggest and summarize for review by Customer's personnel and do not decide anything on their own. Where an engagement includes processing that materially affects an individual, such as automated attendance capture that feeds a payroll or disciplinary process, the Parties will record it in the documentation for that engagement and Customer remains responsible for the human review, challenge and appeal routes that Applicable Data Protection Laws require.

(a) Except as expressly modified by this DPA, the terms of the Agreement remain in full force and effect. Notwithstanding anything in the Agreement or any order form entered in connection therewith to the contrary, the Parties acknowledge and agree that Provider's access to Personal Data does not constitute part of the consideration exchanged by the Parties in respect of the Agreement. Notwithstanding anything to the contrary in the Agreement, any notices required or permitted to be given by Provider to Customer under this DPA may be given (i) in accordance with any notice clause of the Agreement; (ii) to Customer's contact details for data protection set out in Annex 1; (iii) to Provider's primary points of contact with Customer; or (iv) to any email address designated by Customer in writing for the purpose of receiving Services-related communications or alerts. Customer is solely responsible for ensuring that such email addresses are valid.

(b) Provider agrees to cooperate in good faith with Customer to consider any amendments that may be reasonably necessary to address compliance with the Applicable Data Protection Laws.

(c) Provider may, on written notice, vary this DPA solely to the extent necessary to maintain compliance with Applicable Data Protection Laws from time to time, provided that any such variation will not materially reduce the protections afforded to Personal Data or materially increase Customer's obligations under this DPA without Customer's written agreement, and may include varying or replacing the SCCs in accordance with Paragraph 3.4 (Adoption of new transfer mechanism) of Annex 2 (European Annex).

(d) To the extent permitted by Applicable Data Protection Laws and the SCCs (if and as they apply), the total aggregate liability of either Party to the other Party, however arising, under or in connection with this DPA and the SCCs (if and as they apply) will under no circumstances exceed any limitations or caps on, and will be subject to any exclusions of, liability and loss agreed by the Parties in the Agreement; provided that nothing in this Section 11(d) will affect any person's liability to Data Subjects under the third-party beneficiary provisions of the SCCs (if and as they apply).

(e) In the event of any conflict or inconsistency between (i) this DPA and the Agreement, this DPA will prevail, or (ii) any SCCs entered into pursuant to Paragraph 3 of Annex 2 (European Annex) and this DPA and/or the Agreement, the SCCs shall prevail in respect of the Restricted Transfer to which they apply.

Provider / data importer details

• Name: Inference AI Labs Inc.
• Address: 440 North Barranca Avenue, Covina, California 91723, United States
• Contact details for data protection: Privacy team, team@takeflow.io
• Provider activities: Provision of the flow workflow automation platform, including a hosted workspace, messaging inbox, lead and job tracking, and AI-assisted drafting features.
• Role: Processor (or Subprocessor, as applicable)

Customer / data exporter details

• Name: The entity or other person who is a counterparty to the Agreement
• Customer's address: As provided in Customer's account or order form
• Customer's contact details for data protection: The account owner's email address, unless Customer notifies Provider of a different contact
• Customer activities: Customer's activities relevant to this DPA are the use and receipt of the Services under and in accordance with, and for the purposes anticipated and permitted in, the Agreement as part of its ongoing business operations.
• Role: Controller or Processor (as applicable)

Processing details

Categories of Data Subjects: Relevant Data Subjects include any Data Subjects whose Personal Data Customer causes Provider to Process in connection with the Services, including Customer's customers, leads and other end-users, and Customer's personnel (including employees and contractors) and other business contacts or representatives of Customer.

Categories of Personal Data: Relevant Personal Data includes any categories of Personal Data Customer causes Provider to Process as part of the provision of the Services, including:

• Personal details, for example any information that identifies the Data Subject, including name, phone number, email address and postal address.
• Communications, for example the content of WhatsApp and other messages exchanged between Customer and its contacts through the Services, and notes Customer's personnel record about those contacts.
• Commercial details, for example vehicles, jobs, bookings, pickups, quotes and invoices associated with a Data Subject.
• Authentication details, for example usernames, passwords, and authentication tokens used to access the Services.
• Technological details, for example internet protocol (IP) addresses, unique identifiers and numbers (including unique identifiers in tracking cookies or similar technology), pseudonymous identifiers, imprecise location data, application activity data, and device IDs and addresses.

Sensitive categories of data: None by default. Restricted Data, which includes "sensitive data" (as defined in Clause 8.7 of the SCCs), must not be submitted to the Services unless it is Permitted Restricted Data under Section 6(b), meaning the Services have been expressly built to Process it for Customer and the categories are documented for that engagement. Where they are, they are listed in the documentation for that engagement and may include biometric identifiers used for attendance, and employment records such as payroll and leave.

Additional safeguards for sensitive data: As recorded for the relevant engagement, and as required by Section 6(e), including a documented lawful basis, Data Subject notices and consents obtained by Customer, a defined retention period, and access restricted to personnel who need it.

Frequency of transfer: Ongoing, as initiated by Customer in and through its use, or use on its behalf, of the Services.

Nature of the Processing: Processing operations required in order to provide the Services and perform Provider's obligations in accordance with the Agreement and this DPA.

Purpose of the Processing: As necessary to provide the Services as initiated by Customer in its use thereof, and to comply with Customer's documented instructions as permitted under and in accordance with the terms of this DPA and the Agreement.

Duration of Processing / retention period: For the period determined in accordance with the Agreement and this DPA, including Section 9 of this DPA.

Transfers to (sub)processors: Transfers to Subprocessors are as, and for the purposes, described from time to time in the Subprocessor List (Annex 5).

1. Processing of Personal Data

1.1 Where Provider receives an instruction from Customer that, in its reasonable opinion, infringes the GDPR, Provider shall inform Customer.

1.2 Customer acknowledges and agrees that any instructions issued by Customer with regards to the Processing of Personal Data by or on behalf of Provider pursuant to or in connection with the Agreement shall be in strict compliance with the GDPR and all other applicable laws.

2. Data protection impact assessment and prior consultation

2.1 Provider, taking into account the nature of the Processing and the information available to Provider, shall provide reasonable assistance to Customer, at Customer's cost, upon Customer's written request, to the extent reasonably necessary and technically feasible, with any data protection impact assessments and prior consultations with Supervisory Authorities as may be required of Customer under Article 35 or Article 36 of the GDPR, in each case solely in relation to Processing of Personal Data by Provider.

2.2 Except to the extent prohibited by applicable law, Customer will be fully responsible for all time spent by Provider (at Provider's then-current professional services rates) in Provider's provision of any cooperation and assistance provided to Customer under Paragraph 2.1, and shall on demand reimburse Provider for any such costs incurred by Provider.

3. Restricted Transfers

3.1 EU Restricted Transfers. To the extent that any Processing of Personal Data under this DPA involves an EU Restricted Transfer from Customer to Provider, the Parties shall comply with their respective obligations set out in the SCCs, which are hereby deemed to be (a) populated in accordance with Part 1 of Attachment 1 to this Annex 2; and (b) entered into by the Parties and incorporated by reference into this DPA.

3.2 UK Restricted Transfers. To the extent that any Processing of Personal Data under this DPA involves a UK Restricted Transfer from Customer to Provider, the Parties shall comply with their respective obligations set out in the SCCs (as varied by the UK Transfer Addendum), which are hereby deemed to be (a) varied to address the requirements of the UK GDPR in accordance with the UK Transfer Addendum and populated in accordance with Part 2 of Attachment 1 to this Annex 2; and (b) entered into by the Parties and incorporated by reference into this DPA.

3.3 Swiss Restricted Transfers. To the extent that any Processing of Personal Data under this DPA involves a Swiss Restricted Transfer from Customer to Provider, the Parties shall comply with their respective obligations set out in the SCCs, which are hereby deemed to be (a) varied to address the requirements of the FADP and populated in accordance with Part 3 of Attachment 1 to this Annex 2; and (b) entered into by the Parties and incorporated by reference into this DPA. Nothing in any applicable SCCs (as deemed amended pursuant to this Paragraph 3.3) should be interpreted or construed in such a way as would limit or exclude the rights of Data Subjects under Clause 18(c) of those SCCs to bring legal proceedings before the courts in Switzerland where Switzerland is that Data Subject's place of habitual residence.

3.4 Adoption of new transfer mechanism. Provider may, on notice, vary this DPA and replace the relevant SCCs with (a) any new form of the relevant SCCs or any replacement therefor prepared and populated accordingly to the extent necessary to maintain compliance with Applicable Data Protection Laws, provided that any such replacement does not materially decrease the overall protection of Personal Data under the SCCs; or (b) another valid transfer mechanism, other than the SCCs, that Provider reasonably determines is necessary to maintain compliance with Chapter V of the GDPR for the relevant transfer(s) and that does not materially diminish the data protection safeguards for Personal Data under this DPA.

3.5 Provision of full-form SCCs. In respect of any given Restricted Transfer, if requested of Customer by a Supervisory Authority, Data Subject or further Controller (where applicable), on specific written request (made to the contact details set out in Annex 1; accompanied by suitable supporting evidence of the relevant request), and to the extent required to evidence Customer's compliance with Applicable Data Protection Laws, Provider shall provide Customer within a reasonable time with an executed version of the relevant set(s) of SCCs responsive to the request made of Customer (amended and populated in accordance with Attachment 1 to this Annex 2 in respect of the relevant Restricted Transfer) for countersignature by Customer, onward provision to the relevant requestor and/or storage.

3.6 Operational clarifications. When complying with its transparency obligations under Clause 8.3 of the SCCs, Customer agrees that it shall not provide or otherwise make available, and shall take all appropriate steps to protect, Provider's and its licensors' trade secrets, business secrets, confidential information and/or other commercially sensitive information. Where applicable, for the purposes of Clause 10(a) of Module Three of the SCCs, Customer acknowledges and agrees that there are no circumstances in which it would be appropriate for Provider to notify any third-party controller of any Data Subject Request and that any such notification shall be the sole responsibility of Customer. For the purposes of Clause 15.1(a) of the SCCs, except to the extent prohibited by applicable law and/or the relevant public authority, as between the Parties, Customer agrees that it shall be solely responsible for making any notifications to relevant Data Subject(s) if and as required. The terms and conditions of Section 7 of this DPA apply in relation to Provider's appointment and use of Subprocessors under the SCCs, and any approval by Customer of Provider's appointment of a Subprocessor that is given expressly or deemed given pursuant to that Section 7 constitutes Customer's documented instructions to effect disclosures and onward transfers of Personal Data to such Subprocessor solely in connection with the Services, if and as required under Clause 8.8 of the SCCs. The audits described in Clauses 8.9(c) and 8.9(d) of the SCCs shall be subject to any relevant terms and conditions detailed in Section 8 of this DPA. Certification of deletion of Personal Data as described in Clauses 8.5 and 16(d) of the SCCs shall be provided only upon Customer's written request.

Attachment 1 to Annex 2: Population of the SCCs

Part 1: EU Restricted Transfers. Where the SCCs apply in accordance with Paragraph 3.1, each of the Parties is hereby deemed to have signed the SCCs at the relevant signature block in Annex I to the Appendix to the SCCs. Module Two of the SCCs applies to any EU Restricted Transfer and/or Swiss Restricted Transfer involving Processing of Personal Data in respect of which Customer is a Controller in its own right; Module Three applies where Customer is itself acting as a Processor on behalf of any other person. For each Module: the optional "Docking Clause" in Clause 7 is not used; in Clause 9, Option 2 (General Written Authorisation) applies and the minimum advance notice period for the addition or replacement of Subprocessors is the period set out in Section 7(d) of this DPA (currently 15 days), and Option 1 and Annex III to the Appendix are not used; in Clause 11, the optional language is not used; in Clause 13, all square brackets are removed and all text therein is retained; in Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland; and for the purposes of Clause 18, any dispute arising from the SCCs shall be resolved by the courts of Ireland. Annex I to the Appendix is populated with the corresponding information in Annex 1 of this DPA, with Customer as "data exporter" and Provider as "data importer". The competent supervisory authority is the authority of the EU Member State in which Customer is established; where Customer is not established in an EU Member State and Article 3(2) of the GDPR applies, it is the authority of the Member State in which Customer's EU representative is based or, where none is appointed, the Member State notified in writing to Provider's data protection contact in which the relevant Data Subjects are located. Annex II to the Appendix is populated by reference to Section 4 of this DPA and Annex 4 (Security Measures); when Provider engages a Subprocessor under the SCCs, Provider shall enter into a binding contractual arrangement that imposes data protection obligations which, in substance, meet or exceed the relevant standards required under the SCCs and this DPA, including in respect of appropriate technical and organizational security measures, notification of Information Security Incidents to Provider, return or deletion of Personal Data, and the engagement of further Subprocessors.

Part 2: UK Restricted Transfers. Where relevant in accordance with Paragraph 3.2, the SCCs also apply in the context of UK Restricted Transfers as varied by the UK Transfer Addendum. As permitted by Section 17 of the UK Transfer Addendum, the Parties agree that Tables 1, 2 and 3 to the UK Transfer Addendum are deemed populated with the corresponding details set out in Annex 1 of this DPA and Part 1 above; Table 4 is completed by the box labelled "Data Importer" being deemed to have been ticked; and the Parties agree to be bound by the Mandatory Clauses of the UK Transfer Addendum. In relation to any UK Restricted Transfer, any reference in this DPA to the SCCs shall be read as a reference to those SCCs as so varied.

Part 3: Swiss Restricted Transfers. Where applicable in accordance with Paragraph 3.3, the SCCs also apply in the context of Swiss Restricted Transfers with the following terms deemed to have the following substituted meanings: "GDPR" means the FADP; "European Union", "Union" and "Member State(s)" each mean Switzerland; and "supervisory authority" means the FDPIC. In relation to any Swiss Restricted Transfer, any reference in this DPA to the SCCs shall be read as a reference to those SCCs as so varied.

For purposes of this Annex 3, the terms "business," "controller," "processor," "commercial purpose," "sell," "share," "service provider" and "contractor" shall have the respective meanings given thereto in the applicable State Privacy Laws, and "personal information" shall mean Personal Data to the extent it constitutes "personal information" or "personal data" (or a similar term) governed by the State Privacy Laws.

It is the Parties' intent that with respect to any personal information, Provider is a service provider, contractor and/or processor, as applicable under the State Privacy Laws. Provider (a) acknowledges that personal information is disclosed by Customer only for limited and specified purposes described in the Agreement; (b) will comply with applicable obligations under the State Privacy Laws and shall provide the same level of privacy protection to personal information as is required by the State Privacy Laws; (c) agrees that Customer has the right to take reasonable and appropriate steps to help to ensure that Provider's Processing of personal information is consistent with Customer's obligations under the State Privacy Laws; (d) will notify Customer in writing of any determination made by Provider that it can no longer meet its obligations under the State Privacy Laws; and (e) agrees that Customer has the right, upon reasonable notice, including under the preceding clause, to take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.

Provider will not (a) sell or share any personal information; (b) retain, use or disclose any personal information for any purpose other than for the specific purpose of providing the Services, including retaining, using, or disclosing the personal information for a commercial purpose other than the provision of the Services, or as otherwise permitted by the State Privacy Laws; (c) retain, use or disclose the personal information outside of the direct business relationship between Provider and Customer; or (d) combine personal information received under the Agreement with personal information (i) received from or on behalf of another person, or (ii) collected from Provider's own interaction with any Data Subject to whom such personal information pertains, except as and to the extent permitted by the State Privacy Laws and necessary as part of Provider's provision of the Services. Provider hereby certifies that it understands its obligations under this Annex 3 and will comply with them.

Giving Customer notice of Subprocessor engagements in accordance with Section 7 of this DPA will satisfy Provider's obligation under the State Privacy Laws to give notice of and an opportunity to object to such engagements. Customer may conduct audits, in accordance with Section 8 of this DPA, to help ensure that Provider's use of personal information is consistent with Provider's obligations under the State Privacy Laws.

The Parties acknowledge that Provider's retention, use and disclosure of personal information authorized by Customer's instructions documented in the Agreement and this DPA are integral to Provider's provision of the Services and the business relationship between the Parties.

Provider maintains the following technical and organizational measures in respect of the components of the Services it operates. Read this annex together with Section 4(f) (Deployment models): in a Provider-Hosted Environment the infrastructure-level controls below (physical security, network security, encryption at rest, backup and recovery) are delivered through Provider's hosting Subprocessors, whose own audit reports are available on request; in a Customer-Hosted Environment those same controls are Customer's responsibility for the infrastructure Customer provides, and the measures below apply to Provider's own systems, personnel and the application Provider delivers.

• Organizational management and personnel with assigned responsibility for the development, implementation and maintenance of Provider's information security program.
• Audit and risk assessment procedures for the purposes of periodic review and assessment of risks to Provider's organization, monitoring and maintaining compliance with Provider's policies and procedures, and reporting the condition of its information security and compliance to internal senior management.
• Data security controls which include, at a minimum, logical segregation of data between customer workspaces, restricted (role-based) access and monitoring, and utilization of commercially available industry-standard encryption technologies (or materially equivalent safeguards) for Personal Data when transmitted over public networks or at rest.
• Logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions (e.g., granting access on a need-to-know and least-privilege basis, use of unique user IDs and appropriate authentication credentials for all users, and periodic review and revoking/changing access promptly when employment terminates or changes in job functions occur).
• Password controls designed to manage and control password strength, expiration and usage, including prohibiting users from sharing passwords and requiring that Provider maintain password controls for its employees that are consistent with generally accepted industry standards and appropriate to the risk, including minimum password length and/or use of multi-factor authentication as appropriate, and passwords not being stored in readable format on Provider's computer systems.
• System audit or event logging and related monitoring procedures to proactively record user access and system activity.
• Physical and environmental security of data centers, server room facilities and other areas containing Personal Data designed to protect information assets from unauthorized physical access, manage, monitor and log movement of persons into and out of the facilities, and guard against environmental hazards such as heat, fire and water damage.
• Operational procedures and controls to provide for the secure configuration, monitoring and maintenance of technology and information systems, including secure disposal of systems and media in accordance with commercially reasonable industry standards to render all information or data contained therein unreadable and, to the extent technically feasible, unrecoverable prior to final disposal or release from Provider's possession.
• Change management procedures and tracking mechanisms designed to test, approve and monitor all material changes to Provider's technology and information assets that may affect the security of Personal Data.
• Incident management procedures designed to allow Provider to investigate, respond to, mitigate, and provide notifications in accordance with this DPA regarding events related to Provider's technology and information assets.
• Network security controls designed to protect systems from intrusion and limit the scope of any successful attack, including the use of firewalls and network segmentation, and intrusion detection and/or prevention, monitoring, and traffic and event correlation procedures.
• Vulnerability assessment, patch management and threat protection technologies, and scheduled monitoring procedures designed to identify, assess, mitigate and protect against identified security threats, viruses and other malicious code.
• Business resiliency/continuity and disaster recovery procedures designed to maintain service and/or recovery from foreseeable emergencies or disasters.

Customer approves Provider's engagement of the following Subprocessors to provide services pursuant to the Agreement. Provider will update this list, and notify Customer, in accordance with Section 7 of this DPA.

Two qualifications apply. First, not every Subprocessor is used on every engagement: the Subprocessors actually engaged for Customer, including any AI, analytics, email, messaging or printing provider specific to Customer's build, are those identified in the documentation for that engagement. Second, in a Customer-Hosted Environment the hosting and storage Subprocessors below do not Process Personal Data that resides solely in Customer's own infrastructure.