Data Processing Addendum

1. Definitions

1.1Capitalised terms not defined in this DPA have the meanings given in the Agreement. In this DPA:

• (a)"Data Protection Laws" means all laws relating to privacy and the processing of personal data that apply to a party in its performance under the Agreement, including, as applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations ("CCPA"), other US state comprehensive privacy laws, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the Indian Digital Personal Data Protection Act, 2023 and the rules made under it ("DPDP Act");
• (b)"Customer Personal Data" means personal data contained in Customer Data that Altrivis processes on behalf of the Customer in providing the Services;
• (c)"controller", "processor", "data subject", "personal data", "processing", "business", "service provider", "data fiduciary", "data processor" and "data principal" have the meanings given in the applicable Data Protection Laws;
• (d)"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data processed by Altrivis or its Sub-processors;
• (e)"Sub-processor" means any third party engaged by Altrivis to process Customer Personal Data; and
• (f)"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914, and "UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

2. Roles and Scope

2.1The Customer is the controller (or business, or data fiduciary) of Customer Personal Data, and Altrivis is its processor (or service provider, or data processor). Where the Customer is itself a processor acting for a third party controller, Altrivis is its sub-processor, and the Customer shall ensure that its instructions are authorised by that controller.

2.2The subject matter, nature, purpose and duration of the processing, and the types of personal data and categories of data subjects, are described in Annex 1.

2.3This DPA does not apply to personal data for which Altrivis is an independent controller, such as Customer account and billing information and website visitor data, which is governed by the Altrivis Privacy Policy.

3. Customer Obligations

3.1The Customer shall: (a) comply with Data Protection Laws in its use of the Services and in its instructions to Altrivis; (b) ensure that it has a lawful basis, and has given all notices and obtained all consents required, for the processing of Customer Personal Data under this DPA; and (c) be responsible for the accuracy and lawfulness of Customer Personal Data.

3.2Employee monitoring and location-based access controls. Where the Customer enables location-based access controls or any other feature that monitors or restricts its Users, the Customer shall be solely responsible for: (a) determining that the use is lawful and proportionate; (b) giving Users any notice required by law, including employee electronic monitoring notices under the laws of New York, Connecticut, Delaware and any other applicable jurisdiction; (c) obtaining any consent required by law; (d) carrying out any data protection impact assessment required under the GDPR or other law; and (e) providing Users with a means to obtain human review of a refusal of access.

3.3Recording. Where recording or transcription features are made available and the Customer or its Users use them, the Customer shall be responsible for giving notice to and obtaining consent from all participants as required by applicable wiretap, eavesdropping and privacy laws.

4. Altrivis Obligations

4.1Instructions. Altrivis shall process Customer Personal Data only on the documented instructions of the Customer, unless required to do otherwise by law, in which case Altrivis shall inform the Customer of that legal requirement before processing, unless the law prohibits it. The Agreement, this DPA, and the Customer's use and configuration of the Services constitute the Customer's complete instructions. Altrivis shall inform the Customer promptly if, in its opinion, an instruction infringes Data Protection Laws.

4.2Confidentiality. Altrivis shall ensure that persons authorised to process Customer Personal Data are bound by written confidentiality obligations or are under an appropriate statutory duty of confidentiality, and receive appropriate training.

4.3Security. Altrivis shall implement and maintain the technical and organisational measures described in Annex 2, which are designed to ensure a level of security appropriate to the risk. Altrivis may update those measures from time to time, provided that the updates do not materially reduce the overall level of protection.

4.4Assistance. Taking into account the nature of the processing and the information available to it, Altrivis shall provide reasonable assistance to the Customer in: (a) responding to requests from data subjects to exercise their rights, including by providing self-service functionality in the Services and by providing data exports on request; (b) carrying out data protection impact assessments and prior consultations with supervisory authorities; and (c) meeting its security and breach notification obligations. If Altrivis receives a request directly from a data subject in relation to Customer Personal Data, it shall redirect the data subject to the Customer and shall not respond except to confirm the redirection, unless authorised by the Customer or required by law.

5. Sub-processors

5.1General authorisation. The Customer gives Altrivis general written authorisation to engage Sub-processors. The Sub-processors engaged at the date of this DPA are listed at www.sphereone.ai/subprocessors.

5.2Obligations. Altrivis shall enter into a written agreement with each Sub-processor imposing data protection obligations that are no less protective of Customer Personal Data than those in this DPA, to the extent applicable to the service provided. Altrivis remains liable to the Customer for the performance of its Sub-processors' obligations.

5.3Changes. Altrivis shall give the Customer at least thirty (30) days' notice of any new Sub-processor, by updating the Sub-processor List and notifying Customers that have subscribed to updates by email. The Customer may object in writing on reasonable data protection grounds within that period. The parties shall then discuss the objection in good faith. If Altrivis cannot offer a reasonable alternative, the Customer may terminate the affected Services on written notice and receive a refund of prepaid fees for the unused period. In an emergency affecting the security or continuity of the Services, Altrivis may replace a Sub-processor on shorter notice.

6. Security Incidents

6.1Altrivis shall notify the Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Security Incident.

6.2The notification shall describe, to the extent then known: (a) the nature of the Security Incident, including the categories and approximate number of data subjects and records concerned; (b) the likely consequences; (c) the measures taken or proposed to address the incident and mitigate its effects; and (d) a contact point for further information. Where information is not available at the time of the first notice, it shall be provided in phases without undue further delay.

6.3Altrivis shall take reasonable steps to contain, investigate and remediate the Security Incident, and shall cooperate with the Customer in meeting its notification obligations to authorities and data subjects. Unless required by law, Altrivis shall not notify authorities or data subjects of a Security Incident affecting Customer Personal Data on the Customer's behalf without the Customer's consent.

6.4Notification of a Security Incident is not an acknowledgement of fault or liability.

7. Audits

7.1Altrivis shall make available to the Customer, on written request, information reasonably necessary to demonstrate compliance with this DPA, which may include summaries of third party audit reports or certifications, when obtained, and responses to reasonable security questionnaires, no more than once in any twelve (12) month period.

7.2Where the information provided is insufficient to demonstrate compliance, or where required by a supervisory authority or by Data Protection Laws, the Customer may carry out an audit, by itself or through an independent auditor bound by confidentiality, on at least thirty (30) days' written notice, during normal business hours, no more than once in any twelve (12) month period (except following a Security Incident), and in a manner that does not unreasonably disrupt Altrivis' operations or compromise the security of other customers' data. The Customer shall bear the costs of the audit.

8. Return and Deletion

8.1On termination of the Agreement, the Customer may export Customer Personal Data as provided in the Agreement. Altrivis shall then delete Customer Personal Data, including copies in derived indexes such as semantic search indexes, within thirty (30) days after the end of the export period, and from backups within fourteen (14) days, unless retention is required by law. On request, Altrivis shall confirm deletion in writing.

9. International Transfers

9.1Altrivis and its Sub-processors may process Customer Personal Data in the United States, India and other countries where Sub-processors are located, as stated in the Sub-processor List.

9.2EEA transfers. To the extent that the Customer's transfer of Customer Personal Data to Altrivis is a restricted transfer under the GDPR, the SCCs are incorporated into this DPA by reference and apply as follows: (a) Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) applies where the Customer is a processor; (b) Clause 7 (docking clause) applies; (c) under Clause 9, Option 2 (general authorisation) applies with the notice period in Clause 5.3 of this DPA; (d) the optional wording in Clause 11 does not apply; (e) under Clause 17, the SCCs are governed by the law of Ireland; (f) under Clause 18, disputes are resolved by the courts of Ireland; and (g) Annexes I and II of the SCCs are completed by Annexes 1 and 2 of this DPA, and the competent supervisory authority is that of the Customer's establishment or of its EU representative.

9.3UK transfers. For restricted transfers under the UK GDPR, the UK Addendum is incorporated by reference, with Table 1 completed by the parties' details in the Agreement, Table 2 by the modules selected in Clause 9.2, Table 3 by Annexes 1 and 2, and in Table 4 both parties may end the UK Addendum as permitted by its Section 19.

9.4Swiss transfers. For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply as stated in Clause 9.2, with references to the GDPR read as references to that Act, the Swiss Federal Data Protection and Information Commissioner as the competent authority, and the term "member state" not interpreted to exclude data subjects in Switzerland from bringing claims in their place of habitual residence.

9.5Onward transfers. Where Altrivis transfers Customer Personal Data to a Sub-processor in a country that does not provide adequate protection, it shall ensure that an appropriate transfer mechanism is in place.

9.6Data Privacy Framework. If Altrivis self-certifies under the EU-US Data Privacy Framework, the UK Extension or the Swiss-US Framework, it may rely on that certification for transfers to it, and the SCCs shall apply only if the certification lapses.

10. US State Law Terms

10.1Where Altrivis processes Customer Personal Data as a service provider or processor under the CCPA or other US state privacy laws, Altrivis: (a) shall not sell or share Customer Personal Data; (b) shall not retain, use or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the business purposes specified in the Agreement, or outside the direct business relationship between Altrivis and the Customer; (c) shall not combine Customer Personal Data with personal data it receives from or on behalf of another person, except as permitted by law; (d) shall comply with, and provide the same level of privacy protection as required by, the CCPA; (e) shall notify the Customer if it determines that it can no longer meet its obligations under the CCPA; and (f) grants the Customer the right, on notice, to take reasonable and appropriate steps to stop and remediate unauthorised use of Customer Personal Data.

10.2Altrivis certifies that it understands and will comply with the restrictions in Clause 10.1.

11. India

11.1Where the Customer is a data fiduciary under the DPDP Act, Altrivis shall process Customer Personal Data as its data processor only under this DPA; shall implement reasonable security safeguards to prevent personal data breach; shall intimate the Customer of any personal data breach without delay so that the Customer may meet its obligations to the Data Protection Board of India and affected data principals; and shall erase Customer Personal Data as required by Clause 8 and on the Customer's instruction where the purpose has been fulfilled.

11.2Where Altrivis engages personnel or Sub-processors in India to process personal data of data principals outside India under this DPA, the parties acknowledge that such processing is carried out under a contract with a person outside India within the meaning of Section 17(1)(d) of the DPDP Act.

12. Liability and General

12.1Each party's liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent that such limitation is prohibited by Data Protection Laws or the SCCs.

12.2In the event of conflict: the SCCs and UK Addendum prevail over this DPA, and this DPA prevails over the Agreement in relation to the processing of Customer Personal Data.

12.3This DPA terminates automatically when Altrivis ceases to process Customer Personal Data. Obligations relating to deletion and confidentiality survive until deletion is complete.

12.4This DPA is governed by the law that governs the Agreement, except where the SCCs or Data Protection Laws require otherwise.

Annex 1: Description of Processing

Annex 2: Technical and Organisational Security Measures

Execution Page (Optional)