Data Processing Addendum

Definitions

1.1 "Data Protection Laws" means all privacy and data-protection laws applicable to Vectra View’s processing of Personal Data under this DPA, including, as applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act and its implementing regulations ("CCPA"), other comprehensive U.S. state privacy laws (collectively, "U.S. State Privacy Laws"), the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"), the EU GDPR as incorporated into United Kingdom law ("UK GDPR"), and the Swiss Federal Act on Data Protection ("FADP"), in each case as amended or replaced. Terms such as controller, processor, data subject, and processing have the meanings given by applicable Data Protection Laws. Under the CCPA, controller includes business, processor includes service provider or contractor, and Personal Data includes personal information.

1.2 "Personal Data" means personal data, personal information, or similar information relating or reasonably linkable to an identified or identifiable natural person or household that is contained in Customer Data and processed by Vectra View on Customer’s behalf under the Agreement.

1.3 "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

1.4 "Standard Contractual Clauses" or "EU SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced from time to time. "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner’s Office under s.119A of the UK Data Protection Act 2018.

1.5 "Subprocessor" means a third party engaged by Vectra View to process Personal Data on Customer’s behalf.

1.6 "Restricted Transfer" means a transfer of Personal Data from the EEA, United Kingdom, or Switzerland to a country not recognized as providing an adequate level of protection where a transfer mechanism is required by applicable Data Protection Laws.

1.7 "Account Data" means personal data relating to Vectra View's own business relationship with Customer, including the names and contact details of Customer's billing, notice, administrative, and support contacts, and records Vectra View maintains to manage that relationship, verify identity, invoice Customer, or comply with applicable law. Account Data is not Personal Data for the purposes of this DPA.

Roles; Scope of Processing

2.1 Roles. As between the Parties, Customer is the controller of Personal Data or, where Customer processes Personal Data on behalf of its Clients, a processor acting on behalf of such Clients; in each case Vectra View is a processor (or subprocessor) acting on Customer’s documented instructions. Customer is responsible for ensuring that its instructions, and where applicable its Clients’ instructions, comply with Data Protection Laws, and that it has provided all notices and obtained all rights and consents required for Vectra View’s processing under the Agreement.

2.2 Instructions. Vectra View will process Personal Data only (a) to provide, secure, and support the Services in accordance with the Agreement; (b) as further documented in Exhibit A; and (c) as otherwise instructed in writing by Customer, unless required otherwise by applicable law, in which case Vectra View will inform Customer of that legal requirement before processing unless legally prohibited from doing so. Vectra View will inform Customer if, in its opinion, an instruction infringes Data Protection Laws and may suspend only the affected processing while the Parties address the instruction. An instruction that goes beyond the scope of the Services, or that requires Vectra View to build or operate functionality not described in an Order Form or an applicable Operational Specification accepted by Vectra View under Schedule B, is subject to the Parties’ agreement on scope and Fees to the extent permitted by Data Protection Laws.

2.3 Restrictions and Specified Business Purposes. Vectra View will process Personal Data only for the limited and specified business purposes described in Exhibit A: providing, hosting, configuring, securing, monitoring, troubleshooting, supporting, and maintaining the Services; communicating with Customer about the Services; and complying with Customer’s documented instructions and applicable law. Vectra View will not sell or share Personal Data as those terms are defined by the CCPA; use Personal Data for targeted or cross-context behavioral advertising; retain, use, or disclose Personal Data outside the direct business relationship with Customer or for a purpose other than the specified purposes; combine Personal Data with personal data received from another source except as expressly permitted by Data Protection Laws and necessary to perform the specified purposes; or use Personal Data to train or fine-tune artificial intelligence or machine learning models.

2.4 De-identified Data. If Vectra View creates de-identified data from Personal Data, it will take reasonable measures to ensure the data cannot be associated with a natural person or household, maintain and use it in de-identified form, not attempt to re-identify it, and contractually require any permitted recipient to comply with comparable restrictions.

2.5 U.S. State Privacy Terms. To the extent U.S. State Privacy Laws apply, Vectra View will provide the same level of privacy protection for Personal Data required of Customer to the extent applicable to a processor, service provider, or contractor; comply with applicable processor obligations; promptly notify Customer if Vectra View determines it can no longer meet those obligations; and grant Customer the right, upon reasonable notice, to take reasonable and appropriate steps to verify compliance and to stop and remediate unauthorized use of Personal Data. Vectra View certifies that it understands the restrictions and obligations imposed by this DPA and will comply with them. Verification will be conducted under Section 8.2. Customer may provide Vectra View verified consumer requests that Vectra View must fulfill, and Vectra View will provide reasonable assistance. Each Subprocessor processing such Personal Data will be bound by terms required by applicable U.S. State Privacy Laws.

2.6 Account Data. Vectra View processes Account Data as a controller for its own legitimate business purposes, including administering the Agreement, invoicing and collecting Fees, providing support, communicating about the Services, and meeting its legal and tax obligations. That processing is governed by Vectra View's privacy notice and applicable Data Protection Laws rather than by this DPA. Vectra View will not process Account Data for any purpose incompatible with those stated here.

Confidentiality; Personnel

3.1 Vectra View will ensure that persons it authorizes to process Personal Data are subject to written or professional obligations of confidentiality and receive appropriate training on the protection of personal data.

Security

4.1 Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks to natural persons, Vectra View will implement and maintain appropriate technical and organizational measures to protect Personal Data, including at minimum the measures described in Exhibit B. Vectra View will not materially reduce the overall security of the Services during a Subscription Term.

Subprocessors

5.1 General Authorization. Customer provides general written authorization for Vectra View to engage Subprocessors, including the Subprocessors listed at https://vectraview.com/resources/policy/subprocessors as of the Effective Date. This is the same published list referenced by Schedule 3 to the Services Terms. Whether the Services Provider's access to Customer Data is governed by this DPA or by the Services Terms and the Services Provider DPA depends on capacity: where the Services Provider accesses Customer Data on Vectra View's behalf to help Vectra View perform its own operation or support obligations, it does so as a Subprocessor of Vectra View under this Section 5.1 and is subject to the same obligations under this DPA. Where the Services Provider instead accesses Customer Data to perform Professional Services for Customer under the Services Terms, such as under a Change Order or new Order Form, that access is governed by the Services Terms and the Services Provider DPA, not this Schedule C, even where the Automation Solution is hosted by Vectra View.

5.2 Changes. Vectra View will update the Subprocessor list and notify Customer by email, at the notice email address stated in the applicable Order Form, at least ten (10) days before a new Subprocessor begins processing Personal Data. Customer may object in writing before that Subprocessor begins processing Personal Data, on reasonable data-protection grounds. The Parties will discuss the objection in good faith, and Vectra View will not permit the objected-to Subprocessor to begin processing Customer's Personal Data while the objection is being resolved. If Vectra View cannot provide a commercially reasonable alternative within a reasonable period, Customer may terminate the affected Services on written notice and receive a pro-rata refund of prepaid, unused Fees for those Services. This is Customer’s sole remedy for a Subprocessor objection, except where applicable law requires otherwise. Vectra View may replace a Subprocessor with less notice where reasonably necessary for security, legal compliance, or continuity of the Services, in which case Vectra View will notify Customer as soon as reasonably practicable and Customer’s objection rights under this Section continue to apply. This sentence does not apply where the Standard Contractual Clauses or applicable Data Protection Laws require the full notice period.

5.3 Flow-Down; Liability. Vectra View will impose on each Subprocessor data protection obligations materially no less protective than those in this DPA to the extent applicable to the services performed, and remains liable for its Subprocessors’ performance to the same extent as if it performed the processing itself.

Data Subject Requests

6.1 Vectra View will, to the extent legally permitted, promptly notify Customer of any request received directly from a data subject relating to Personal Data (including access, correction, deletion, portability, restriction, objection, or opt-out requests) and will direct the data subject to Customer. Taking into account the nature of the processing, Vectra View will provide reasonable assistance, including through the functionality of the Services, to enable Customer to respond to such requests. Customer is responsible for responding, and for any costs of assistance beyond the functionality of the Services to the extent permitted by law.

Personal Data Breach

7.1 Vectra View will notify Customer without undue delay after becoming aware of a Personal Data Breach. Vectra View will provide information reasonably available regarding the nature of the breach, affected data and data subjects, likely consequences where known, measures taken or proposed, and a contact point. Information may be provided in phases as it becomes available. Vectra View will take reasonable steps to contain and remediate the breach, preserve relevant evidence, and reasonably cooperate with Customer’s notification and investigation obligations. Notification or response is not an admission of fault or liability. Responsibility for a breach caused by Customer, an Authorized User, or a Client is allocated under the Agreement, but does not eliminate Vectra View’s notification obligations where Personal Data processed by Vectra View is affected.

Assistance; Audits

8.1 Assistance. Taking into account the nature of the processing and the information available to it, Vectra View will provide reasonable assistance with Customer’s data protection impact assessments and prior consultations with supervisory authorities where required by Data Protection Laws, and, where legally required, with a cybersecurity audit, risk assessment, or automated decision-making technology review Customer must conduct under the CCPA. Assistance available through standard Service functionality or Vectra View’s then-current compliance materials is included in the Fees. Material bespoke assistance may be charged at mutually agreed rates to the extent permitted by law, except to the extent the assistance is required because of Vectra View’s breach of this DPA or a Personal Data Breach caused by Vectra View.

8.2 Audits. Vectra View will make available information reasonably necessary to demonstrate compliance with this DPA, including completed security questionnaires and, when available, summaries of independent audit reports or certifications under appropriate confidentiality restrictions. Customer will first use those materials and remote review where reasonably sufficient. If they are not sufficient under applicable Data Protection Laws, Customer may, at its expense, conduct an audit no more than once in any twelve-month period, except after a Personal Data Breach, on reasonable suspicion of material noncompliance, when required by a supervisory authority, or where mandatory law or the Standard Contractual Clauses require otherwise. An audit requires at least thirty (30) days’ notice where practicable, occurs during business hours without unreasonable disruption, is limited to relevant systems and information, and is subject to confidentiality and security restrictions. Customer may use an independent auditor that is not a direct competitor of Vectra View, unless applicable law or a supervisory authority requires otherwise. Nothing in this Section limits audit rights that cannot be restricted under the Standard Contractual Clauses or applicable law.

Return and Deletion

9.1 Following expiration or termination of the applicable Services, Vectra View will, at Customer’s election communicated during the export period in Section 8.5 of the Agreement, return or delete Personal Data without unreasonable delay and in accordance with Vectra View’s documented retention practices. If Customer does not make an election during that period, Vectra View will delete the Personal Data. Vectra View will delete Personal Data from production systems within thirty (30) days after the end of the export period, and copies in archival backups are overwritten or expire in the ordinary course within ninety (90) days thereafter. On written request, Vectra View will certify completion after deletion from production systems and expiration of the applicable backup-retention cycle. Vectra View may retain Personal Data to the extent required by law or in archival backups that are not used for other purposes and remain protected under this DPA until deleted in the ordinary course. The foregoing backup-retention periods are subject to any shorter deletion requirement imposed by the Standard Contractual Clauses or mandatory Data Protection Laws.

International Transfers

10.1 Transfer Mechanisms. Customer acknowledges that Vectra View’s primary processing operations are in the United States. For a Restricted Transfer, the Parties will rely on the following mechanisms in order of applicability: (a) an adequacy decision or recognized transfer framework covering Vectra View; or (b) the EU Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 (the “EU SCCs”), incorporated by reference. Module Two applies where Customer is a controller and Vectra View is a processor; Module Three applies where Customer is a processor and Vectra View is a subprocessor. Clause 7 (docking) does not apply. Under Clause 9, Option 2 applies with the notice period in Section 5.2. The optional language in Clause 11 does not apply. Under Clauses 17 and 18, Irish law and the courts of Ireland apply. Annexes I and II are completed by the Agreement, the applicable Order Form, and Exhibits A and B. Annex III does not apply because Clause 9, Option 2 (general authorization) applies rather than Option 1 (specific authorization); Vectra View instead maintains the Subprocessor list referenced in Section 5.1 for the general-authorization notice process. Execution of an Order Form that incorporates this DPA constitutes execution of the EU SCCs by both Parties. On Customer’s written request, Vectra View will execute a standalone copy of this DPA and the Standard Contractual Clauses.

10.2 United Kingdom. For Restricted Transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner, version B1.0 in force March 21, 2022 (the “UK Addendum”), is incorporated by reference. Table 1 is completed with the Parties’ information in the Agreement, Order Form, and Exhibit A; Table 2 selects the EU SCCs, modules, and options stated in Section 10.1; Table 3 is completed by Exhibits A and B and the Subprocessor list; and in Table 4, neither Party may end the UK Addendum solely because the UK Information Commissioner issues a revised approved addendum. Mandatory Clauses of the UK Addendum control in a conflict.

10.3 Switzerland. For Restricted Transfers subject to the FADP, the EU SCCs apply with adaptations recognized by the Swiss Federal Data Protection and Information Commissioner: references to the EU GDPR include the FADP to the extent applicable; references to a Member State include Switzerland; individuals in Switzerland may enforce applicable rights in Switzerland; the FDPIC is the competent supervisory authority for processing governed solely by the FADP; and Swiss law and courts apply to transfers governed solely by the FADP to the extent permitted by the EU SCCs.

10.4 Transfer Assessments. Each Party will provide information reasonably requested to support a legally required transfer impact or risk assessment, taking into account the nature of the processing and information available to that Party. Vectra View will notify Customer if it can no longer comply with the applicable transfer mechanism and will cooperate on reasonable supplementary measures or suspension of the affected transfer.

10.5 Public Authority Requests. To the extent legally permitted, Vectra View will promptly notify Customer of a binding request from a public authority for Personal Data. Vectra View will review the legality of the request, challenge it where there are reasonable grounds to do so, seek available interim measures when appropriate, and disclose only the minimum Personal Data legally required. If notice is prohibited, Vectra View will use reasonable efforts to obtain permission to notify Customer and will document its assessment and response as required by the applicable transfer mechanism.

General

11.1 In the event of a conflict, the order of precedence is: (a) the Standard Contractual Clauses and mandatory provisions of the UK Addendum; (b) this DPA; and (c) the Agreement (including Order Forms). Claims between the Parties under this DPA are subject to the limitations and exclusions of liability in the Agreement to the maximum extent permitted by law. Nothing in the Agreement or this DPA limits rights of data subjects or supervisory authorities under the Standard Contractual Clauses or mandatory Data Protection Laws. This DPA terminates automatically upon deletion or return of all Personal Data following termination of the Agreement.

Exhibit A - Details of Processing

Subject Matter, Nature, and Specified Purposes of Processing: Hosting, storage, organization, transmission, analysis, display, support, monitoring, troubleshooting, security, backup, return, and deletion of Personal Data as necessary to provide the Platform, Automation Solutions, and support described in the Agreement and Order Forms. These activities are the limited and specified business purposes for which Customer discloses Personal Data to Vectra View. Duration: The term of the Agreement plus the post-termination export and deletion periods described in the Agreement and this DPA. Categories of Data Subjects: Customer’s and its Clients’ personnel, contractors, and other authorized users; business contacts of Customer, its Clients, and their vendors, in each case to the extent submitted to the Services. Categories of Personal Data: Business contact information, such as name, business email address, job title, employer, and business telephone number; account, authentication, and user identifiers; technical and usage records; and governance, risk, compliance, vendor-management, training, access, and attestation records that may contain personal data. Customer must not submit Restricted Data or other prohibited data identified in Section 3.3 of the Agreement unless an Order Form expressly authorizes it and appropriate safeguards are documented. An Order Form under the Services Terms does not authorize Restricted Data within the Services; Restricted Data for Professional Services is instead governed by the Services Provider DPA. Frequency: Continuous, as initiated by Customer through use of the Services. Data Exporter / Customer: The Customer identified in the applicable Order Form. Address: as stated in the Order Form. Contact for data-protection matters: the Customer Contact identified in the Order Form. Activities relevant to the transfer: use of the Services as controller or processor and submission of Personal Data for the purposes above. Signature and date: the Agreement and applicable Order Form. Data Importer / Processor: Vectra View Technologies Inc., a Delaware corporation. Data-protection contact: legal@vectraview.com. Activities relevant to the transfer: provision of the Services and processing described in this Exhibit A. Signature and date: the Agreement and applicable Order Form. Sensitive Data and Safeguards: Restricted Data is prohibited unless expressly authorized. If authorized, the Order Form must identify the categories and any additional access, encryption, retention, audit, or human-review safeguards. Competent Supervisory Authority (EU SCCs): Determined in accordance with Clause 13 of the EU SCCs; for UK transfers, the UK Information Commissioner; for Swiss transfers, the FDPIC.

Exhibit B - Technical and Organizational Measures

Vectra View maintains a written information security program appropriate to its size, processing activities, and risk profile, including at minimum: (a) encryption of Personal Data in transit and at rest using industry-standard protocols; (b) logical access controls based on least privilege, unique credentials, multi-factor authentication for administrative access, and prompt revocation following role change or termination; (c) logical segregation of customer data designed to prevent one customer's use of the Services from accessing another customer's data, with additional isolation controls that may apply depending on the applicable service configuration; (d) vendor and Subprocessor security management; (e) secure development, testing, change management, and vulnerability-remediation practices for the Platform and Automation Solutions; (f) logging and monitoring of production systems and privileged activity; (g) backup, restoration, and business-continuity procedures appropriate to the Services; (h) incident-response procedures addressing detection, escalation, containment, evidence preservation, remediation, and notification; (i) personnel confidentiality obligations and security awareness training; and (j) periodic risk assessment and review of control effectiveness.