DATA PROCESSING ADDENDUM

1.1. Capitalized terms used but not defined within this DPA will have the meaning set forth in the Agreement. The following capitalized terms used in this DPA will be defined as follows:

“Account Data” means authentication, account, billing, and administrative contact information relating to Customer’s Kanawai AI account, including names, business contact details, user IDs, and authentication tokens or credentials used to administer the Customer’s Kanawai AI account, but excluding credentials provisioned by Customer to grant Kanawai AI read-only access to Customer Systems.

“Affiliate” means any entity which, directly or indirectly, Controls, is Controlled by, or is under common Control with the Customer entity executing this Agreement.

“Applicable Data Protection Laws” means all applicable laws, rules, regulations, and governmental requirements relating to the privacy, confidentiality, or security of Personal Data, as they may be amended or otherwise updated from time to time, including (without limitation): the GDPR, Swiss Data Protection Laws and the US Data Protection Laws.

“CCPA” means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended, including its implementing regulations and the California Privacy Rights Act of 2020.

“Controller Purposes” means: (a) monitoring the performance of the Services to identify and repair errors and ensure the security and integrity of the Services; (b) undertaking internal research for technological development, including testing, improving, developing and altering the functionality of the Services and developing new products and services; and (c) administering Company’s relationship with Customer under the Agreement, including maintaining and servicing accounts on the Services.

“Covered Data” means Personal Data that is: (a) provided by or on behalf of Customer to Company in connection with the Services; or (b) obtained, developed, produced or otherwise Processed by Company, its Affiliates, its agents or subcontractors, for the purposes of providing the Services, in each case as further described in Schedule 1.

“Data Subject” means a natural person whose Personal Data is Processed.

“Deidentified Data” means data created using Covered Data that cannot reasonably be linked to such Covered Data, directly or indirectly.

“GDPR” means Regulation (EU) 2016/679 (the “EU GDPR”) or, where applicable, the “UK GDPR”, as defined in section 3 of the Data Protection Act 2018.

“Personal Data” means any data or information that: (a) is linked or reasonably linkable to an identified or identifiable natural person; or (b) is otherwise “personal data”, “personal information”, “personally identifiable information”, or similarly defined data or information under Applicable Data Protection Laws.

“Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means. “Process”, “Processes” and “Processed” will be interpreted accordingly.

“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to (including unauthorized internal access to), Covered Data.

“Services” means the services to be provided by Company to Customer under the Agreement.

“Standard Contractual Clauses” or “SCCs” means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914.

“Sub-processor” means, with respect to any Processing performed by Company as a processor or service provider, an entity appointed by Company to Process Covered Data on its behalf.

“Swiss Data Protection Laws” means the Swiss Federal Act on Data Protection of 25 September 2020 (“FADP”) and the Swiss Data Protection Ordinance of 31 August 2022 (the “Ordinance”), and any new or revised version of these laws that may enter into force for time to time.

“US Data Protection Laws” means all applicable federal and state laws rules, regulations, and governmental requirements relating to data protection, the Processing of Personal Data, privacy and/or data protection in force from time to time in the United States, including (without limitation): the CCPA as amended, including its implementing regulations and the California Privacy Rights Act of 2020), Consumer Data Protection Act (Virginia) (Code of Virginia Title 59.1 Chapter 52 § 59.1-571 et seq.), Colorado Privacy Act (Colorado Revised Statute Title 6 Article 1 Part 13 § 6-1-1301 et seq.), Connecticut Act Concerning Personal Data Privacy and Online Monitoring 2023, Consumer Privacy Act (Utah) (Utah Code § 13-6-101 et seq.), Oregon Consumer Privacy Act (ORS 646A. 570-646A. 589), Texas Data Privacy and Security Act (88(R) HB 4).

“Usage Data” means diagnostic, usage and performance information collected by Company in relation to Customer’s and its authorized users’ use of the Services.

1.2. The terms “controller”, “processor”, “business” and “service provider” have the meanings given to them in the Applicable Data Protection Laws.

The Parties acknowledge and agree that:

1. save as set out in paragraph 3(b), Company acts as a processor or service provider in relation to the Processing of Covered Data under the Agreement and this DPA and Customer acts as a controller or business; and
2. for the purposes of the GDPR and with respect to the Processing of Administration Data and Usage Data for the Controller Purposes, Company acts as a controller.

4.1. The details of the Processing of Personal Data under the Agreement and this DPA (including subject matter, nature and purpose of the Processing, categories of Personal Data and Data Subjects) are described in the Agreement and in Schedule 1 to this DPA.

4.2. Company shall comply with its obligations under Applicable Data Protection Laws. Save with respect to any Processing of Covered Data for the Controller Purposes, Company will only Process Covered Data on behalf of and under the instructions of Customer and in accordance with Applicable Data Protection Laws.

4.3. The Agreement and this DPA shall constitute Customer’s instructions for the Processing of Covered Data. Customer may issue further written instructions in accordance with this DPA. Without limiting the foregoing, Company is prohibited from:

1. selling Covered Data or otherwise making Covered Data available to any third party for monetary or other valuable consideration;
2. sharing Covered Data with any third party for cross-context behavioural advertising;
3. retaining, using, or disclosing Covered Data for any purpose other than for the business purposes specified in the Agreement or as otherwise permitted by Applicable Data Protection Laws;
4. sharing or training or otherwise exploiting Covered Data on or with any third party artificial intelligence system (including any large language model), except as necessary for the provision of Services;
5. retaining, using, or disclosing Covered Data outside of the direct business relationship between the Parties; and
6. except as otherwise permitted by Applicable Data Protection Laws, combining Covered Data with Personal Data that Company receives from or on behalf of another person or persons, or collects from its own interaction with the Data Subject.

4.4. Company will:

1. provide Customer with information to enable Customer to conduct and document any data protection assessments required under Applicable Data Protection Laws;
2. promptly inform Customer if, in its opinion, an instruction from Customer infringes the Applicable Data Protection Laws; and
3. limit access to Covered Data to personnel who have a business need to have access to such Covered Data, and will ensure that such personnel are subject to obligations at least as protective of the Covered Data as the terms of this DPA and the Agreement.

5.1. Customer shall comply with its obligations as a controller, business or equivalent term under the Applicable Data Protection Laws, and shall:

1. provide such information to Data Subjects regarding the Processing of their Covered Data in connection with the Customer’s use of the Services as required under Applicable Data Protection Laws;
2. to the extent required for the lawful Processing of Covered Data under Applicable Data Protection Laws, obtain valid consents from Data Subjects for such Processing in the form required under Applicable Data Protection Laws; and
3. at Customer’s sole discretion, implement appropriate technical and organisational measures to give effect to Data Subject rights under Applicable Data Protection Laws, and shall comply with requests from Data Subjects to exercise their rights under Applicable Data Protection Laws within the timeframe and subject to any exemptions prescribed in the Applicable Data Protection Laws.

6.1. Company may Process Covered Data anywhere that Company, its Affiliates or its Sub-processors maintain facilities, subject to the remainder of this clause 6.

6.2. Customer grants Company general authorisation to engage any of its Affiliates and/or Sub-processors listed in Schedule 4, as amended in accordance with clause 6.4 (the “Authorized Sub-processors”), to Process Covered Data.

6.3. Company shall:

1. enter into a written agreement with each Authorized Sub-processor imposing data protection obligations that, in substance, are no less protective of Covered Data than Company’s obligations under this DPA; and
2. remain liable for each Authorized Sub-processor’s compliance with the obligations under this DPA.

6.4. Company will provide Customer with at least thirty (30) days’ notice of any proposed changes to the Authorized Sub-processors. Customer shall notify Company if it objects to the proposed change to the Authorized Sub-processors (including, where applicable, when exercising its right to object under clause 9(a) of the SCCs) by providing Company with written notice of the objection within thirty (30) days after Company has provided notice to Customer of such proposed change (an “Objection”).

6.5. In the event Customer submits an Objection to Company, Company and Customer shall work together in good faith to find a mutually acceptable resolution to address such Objection. If Company and Customer are unable to reach a mutually acceptable resolution within a reasonable timeframe, which shall not exceed thirty (30) days, Customer may terminate the portion of the Agreement relating to the Services affected by such change by providing written notice to Company, and Company shall provide refund of any unused, pre-paid Fees to Customer relating to the part of the Services terminated in accordance with this clause 6.5 (in addition to any other remedies available to Customer).

7.1. Company will notify Customer without undue delay of any request received by Company from a Data Subject to assert their rights in relation to Covered Data under Applicable Data Protection Laws (a “Data Subject Request”).

7.2. Other than in respect of any Processing of Administration Data and Usage Data for the Controller Purposes, Customer will have sole discretion in responding to the Data Subject Request, and Company shall not respond to the Data Subject Request, save that Company may advise the Data Subject that their request has been forwarded to Customer.

7.3. Company will provide Customer with timely and reasonable assistance as necessary for Customer to fulfil its obligation under Applicable Data Protection Laws to respond to Data Subject Requests.

8.1. Company will implement and maintain appropriate technical and organisational data protection and security measures designed to ensure security of Covered Data, including, without limitation, protection against unauthorized or unlawful Processing and against accidental loss, destruction, or damage of or to Covered Data.

8.2. When assessing the appropriate level of security, Company shall take into account the nature, scope, context and purpose of the Processing as well as the risks that are presented by the Processing, in particular from accidental or unlawful destruction, loss, alteration, un-authorized disclosure of, or access to Covered Data.

8.3. Company will implement and maintain as a minimum standard the measures set out in Schedule 2.

8.4. Company will take appropriate measures to protect and secure Administrative Data and Usage Data to the extent such data can be linked to Customer.

9.1. Company shall notify Customer promptly if Company determines that it can no longer meet its obligations under Applicable Data Protection Laws.

9.2. Customer may take reasonable and appropriate steps to:

1. ensure that Company uses Covered Data in a manner consistent with Customer’s obligations under Applicable Data Protection Laws; and
2. upon reasonable notice, stop and remediate unauthorized use of Covered Data.

9.3. Customer may audit Company’s compliance with this DPA. The Parties agree that all such audits will be conducted:

1. not more than once a year, unless additional audits are required:
   • by a supervisory authority with jurisdiction over Customer’s processing of Covered Data; or
   • to investigate the causes of and remediation following a Security Incident;
2. upon reasonable written notice to Company;
3. only during Company’s normal business hours; and
4. in a manner that does not materially disrupt Company’s business or operations.

9.4. With respect to any audits conducted in accordance with clause 9.3 or 9.4:

1. Customer may engage an independent third-party auditor to conduct the audit on its behalf; and
2. Company shall not be required to facilitate any such audit unless and until the Parties have agreed, in good faith, in writing the scope and timing of such audit, unless required otherwise by applicable law;
3. Customer shall pay any Customer-engaged third-party costs incurred with regards to audits specifically requested by the Customer under this Agreement, and shall procure all reasonable efforts to complete the audit in a timely manner and with minimal impact on day-to-day business of the Company.

9.5. Customer shall promptly notify Company of any non-compliance discovered during an audit.

9.6. The results of the audit shall be Company’s confidential information.

9.7. Company shall provide to Customer upon request, or may provide to Customer in response to any audit request submitted by Customer’s to Company, either of the following:

1. data protection compliance certifications issued by a commonly accepted certification issuer which has been audited by a data security expert, or by a publicly certified auditing company; or
2. such other documentation reasonably evidencing the implementation of the technical and organisational data security measures in accordance with industry standards.

9.8. If an audit requested by Customer is addressed in the documents or certification provided by Company in accordance with paragraph 9.7, and:

1. the certification or documentation is dated within twelve (12) months of Customer’s audit request; and
2. Company confirms that there are no known material changes in the controls audited,

9.9. Customer agrees to accept that certification or documentation in lieu of conducting a physical audit of the controls covered by the relevant certification or documentation, provided, however, that if Customer reasonably believes that certification or documentation is not sufficient to demonstrate Company’s compliance with this DPA, the Customer may still proceed with a physical audit.

10.1. Company shall notify Customer in writing without undue delay, and in any event within seventy-two (72) hours, after becoming aware of any Security Incident.

10.2. Company shall take reasonable steps to contain, investigate, and mitigate any Security Incident, and shall send Customer timely information about the Security Incident, to the extent known to Company or as the information becomes available to Company, including, but not limited to, the nature of the Security Incident, the measures taken to mitigate or contain the Security Incident, and the status of the investigation.

10.3. Company shall provide reasonable assistance with Customer’s investigation of any Security Incidents and any of Customer’s obligations in relation to the Security Incident under Applicable Data Protection Laws, including any notification to Data Subjects or supervisory authorities.

10.4. Company’s notification of or response to a Security Incident under this paragraph 10 shall not be construed as an acknowledgement by Company of any fault or liability with respect to the Security Incident.

11.1. This DPA shall commence on the Effective Date and, notwithstanding any termination of the Agreement, will remain in effect until, and automatically expire upon, Company’s deletion of all Covered Data as described in this DPA.

11.2. Company shall:

1. within thirty (30) days of expiry of the Agreement (the “Retention Period”), provide a copy of all Covered Data in such commonly used format as requested by Customer, or provide a self-service functionality allowing Customer to download such Covered Data; and
2. on expiry of the Retention Period, delete all copies of Covered Data Processed by Company or any Authorized Sub-processors, other than any Administration Data and Usage Data Processed for the Controller Purposes, and will provide confirmation in writing of such deletion to Customer.

11.3. Furthermore, at the Customer’s request, the Company shall promptly delete any relevant Covered Data specified by and/or related to the request made by the Customer, and shall provide confirmation in writing of such deletion to the Customer. For the avoidance of doubt, the Company may discharge its entire obligations under this clause 11.3 by providing a self-service functionality that enables Company to delete its own data.

12.1. The Standard Contractual Clauses shall, as further set out in Schedule 3, apply to the transfer of any Covered Data from Customer to Company, and form part of this DPA, to the extent that:

1. the GDPR or Swiss Data Protection Law applies to Customer when making that transfer; or
2. the Applicable Data Protection Laws that apply to Customer when making that transfer (the “Exporter Data Protection Laws”) prohibit the transfer of Covered Data to Company under this DPA in the absence of a transfer mechanism implementing adequate safeguards in respect of the Processing of that Covered Data, and any one or more of the following applies:
   • the relevant authority with jurisdiction over Customer’s transfer of Covered Data under this DPA has not formally adopted standard data protection clauses or another transfer mechanism under the Exporter Data Protection Laws; or
   • such authority has issued guidance that entering into standard contractual clauses approved by the European Commission would satisfy any requirement under the Exporter Data Protection Laws to implement adequate safeguards in respect of that transfer; or
   • entering into standard contractual clauses approved by the European Commission would reasonably satisfy any requirement under the Exporter Data Protection Laws to implement adequate safeguards in respect of that transfer; or
3. the transfer is an “onward transfer” (as defined in the applicable module of the SCCs).

12.2. The Parties agree that execution of the Agreement shall have the same effect as signing the SCCs.

If Company receives Deidentified Data from or on behalf of Customer, Company shall:

1. take reasonable measures to ensure the information cannot be associated with a Data Subject;
2. publicly commit to Process the Deidentified Data solely in deidentified form and not to attempt to reidentify the information; and
3. contractually obligate any recipients of the Deidentified Data to comply with the foregoing requirements and Applicable Data Protection Laws.

14.1. The Parties hereby certify that they understand the requirements in this DPA and will comply with them.

14.2. The following provisions shall apply with respect to liability:

Notwithstanding the Terms and Conditions, Company’s maximum liability for any breach of this Data Processing Agreement or Applicable Data Protection Laws relating to the Covered Data shall be the greater of (i) three (3) times the annual fees paid by Customer to Company for the Services under the Agreement in the 12 months prior to the act that gave rise to the liability; or (ii) USD 120,000; in each case, whether or not it has been advised of the possibility of such damages and whether or not such losses or damages were otherwise foreseeable. For the avoidance of doubt, this clause 14.2 shall take precedence over any conflicting provisions in the Terms and Conditions or elsewhere in the Agreement.

14.3. The Parties agree to negotiate in good faith any amendments to this DPA as may be required in connection with changes in Applicable Data Protection Laws.