Services Provider Data Processing Addendum

Definitions

1.1 "Data Protection Laws" means all privacy and data-protection laws applicable to Services Provider's processing of Personal Data under this DPA, including, as applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act and its implementing regulations ("CCPA"), other comprehensive U.S. state privacy laws (collectively, "U.S. State Privacy Laws"), the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"), the EU GDPR as incorporated into United Kingdom law ("UK GDPR"), and the Swiss Federal Act on Data Protection ("FADP"), in each case as amended or replaced. Terms such as controller, processor, data subject, and processing have the meanings given by applicable Data Protection Laws. Under the CCPA, controller includes business, processor includes service provider or contractor, and Personal Data includes personal information.

1.2 "Personal Data" means personal data, personal information, or similar information relating or reasonably linkable to an identified or identifiable natural person or household that is contained in Customer Data and processed by Services Provider on Customer's behalf under the Agreement.

1.3 "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

1.4 "Standard Contractual Clauses" or "EU SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced from time to time. "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner's Office under s.119A of the UK Data Protection Act 2018.

1.5 "Subprocessor" means a third party engaged by Services Provider to process Personal Data on Customer's behalf.

1.6 "Restricted Transfer" means a transfer of Personal Data from the EEA, United Kingdom, or Switzerland to a country not recognized as providing an adequate level of protection where a transfer mechanism is required by applicable Data Protection Laws.

1.7 "Account Data" means personal data relating to Services Provider's own business relationship with Customer, including the names and contact details of Customer's billing, notice, and administrative contacts, and records Services Provider maintains to manage that relationship, verify identity, invoice Customer, or comply with applicable law. Account Data is not Personal Data for the purposes of this DPA.

Roles; Scope of Processing

2.1 Roles. As between the Parties, Customer is the controller of Personal Data or, where Customer processes Personal Data on behalf of its Clients, a processor acting on behalf of such Clients; in each case Services Provider is a processor (or subprocessor) acting on Customer's documented instructions. Customer is responsible for ensuring that its instructions, and where applicable its Clients' instructions, comply with Data Protection Laws, and that it has provided all notices and obtained all rights and consents required for Services Provider's processing under the Agreement.

2.2 Instructions. Services Provider will process Personal Data only (a) to provide the Professional Services in accordance with the Agreement; (b) as further documented in Exhibit A; and (c) as otherwise instructed in writing by Customer, unless required otherwise by applicable law, in which case Services Provider will inform Customer of that legal requirement before processing unless legally prohibited from doing so. Services Provider will inform Customer if, in its opinion, an instruction infringes Data Protection Laws and may suspend only the affected processing while the Parties address the instruction.

2.3 Restrictions and Specified Business Purposes. Services Provider will process Personal Data only for the limited and specified business purposes described in Exhibit A. Services Provider will not sell or share Personal Data as those terms are defined by the CCPA; use Personal Data for targeted or cross-context behavioral advertising; retain, use, or disclose Personal Data outside the direct business relationship with Customer or for a purpose other than the specified purposes; combine Personal Data with personal data received from another source except as expressly permitted by Data Protection Laws and necessary to perform the specified purposes; or use Personal Data to train or fine-tune artificial intelligence or machine learning models.

2.4 De-identified Data. If Services Provider creates de-identified data from Personal Data, it will take reasonable measures to ensure the data cannot be associated with a natural person or household, maintain and use it in de-identified form, not attempt to re-identify it, and contractually require any permitted recipient to comply with comparable restrictions.

2.5 U.S. State Privacy Terms. To the extent U.S. State Privacy Laws apply, Services Provider will provide the same level of privacy protection for Personal Data required of Customer to the extent applicable to a processor, service provider, or contractor; comply with applicable processor obligations; promptly notify Customer if Services Provider determines it can no longer meet those obligations; and grant Customer the right, upon reasonable notice, to take reasonable and appropriate steps to verify compliance and to stop and remediate unauthorized use of Personal Data. Services Provider certifies that it understands the restrictions and obligations imposed by this DPA and will comply with them. Verification will be conducted under Section 8.2. Customer may provide Services Provider verified consumer requests that Services Provider must fulfill, and Services Provider will provide reasonable assistance. Each Subprocessor processing such Personal Data will be bound by terms required by applicable U.S. State Privacy Laws.

2.6 Account Data. Services Provider processes Account Data as a controller for its own legitimate business purposes, including administering the Agreement, invoicing and collecting Fees, providing support, communicating about the Professional Services, and meeting its legal and tax obligations. That processing is governed by Services Provider's privacy notice and applicable Data Protection Laws rather than by this DPA.

Confidentiality; Personnel

3.1 Services Provider will ensure that persons it authorizes to process Personal Data are subject to written or professional obligations of confidentiality and receive appropriate training on the protection of personal data.

Security

4.1 Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks to natural persons, Services Provider will implement and maintain appropriate technical and organizational measures to protect Personal Data, including at minimum the measures described in Exhibit B. Services Provider will not materially reduce the overall security of the Professional Services during an engagement.

Subprocessors

5.1 General Authorization. Customer provides general written authorization for Services Provider to engage Subprocessors, including the Subprocessors listed at https://vectraview.com/resources/policy/subprocessors as of the Effective Date. This is the same published list referenced by Schedule C to the MSSA. Vectra View Technologies Inc. is a Subprocessor of Services Provider to the extent it hosts, stores, or processes Personal Data in connection with an Automation Solution build, and is subject to the same obligations under this DPA.

5.2 Changes. Services Provider will update the Subprocessor list and notify Customer by email, at the notice email address stated in the applicable Order Form, at least ten (10) days before a new Subprocessor begins processing Personal Data. Customer may object in writing before that Subprocessor begins processing Personal Data, on reasonable data-protection grounds. The Parties will discuss the objection in good faith, and Services Provider will not permit the objected-to Subprocessor to begin processing Customer's Personal Data while the objection is being resolved. If Services Provider cannot provide a commercially reasonable alternative within a reasonable period, Customer may terminate the affected engagement on written notice and receive a pro-rata refund of prepaid, unused Fees. This is Customer's sole remedy for a Subprocessor objection, except where applicable law requires otherwise. Services Provider may replace a Subprocessor with less notice where reasonably necessary for security, legal compliance, or continuity of the Professional Services, in which case Services Provider will notify Customer as soon as reasonably practicable and Customer's objection rights under this Section continue to apply. This sentence does not apply where the Standard Contractual Clauses or applicable Data Protection Laws require the full notice period.

5.3 Flow-Down; Liability. Services Provider will impose on each Subprocessor data protection obligations materially no less protective than those in this DPA to the extent applicable to the services performed, and remains liable for its Subprocessors' performance to the same extent as if it performed the processing itself.

Data Subject Requests

6.1 Services Provider will, to the extent legally permitted, promptly notify Customer of any request received directly from a data subject relating to Personal Data and will direct the data subject to Customer. Taking into account the nature of the processing, Services Provider will provide reasonable assistance to enable Customer to respond to such requests. Customer is responsible for responding, and for any costs of assistance beyond Services Provider's standard functionality to the extent permitted by law.

Personal Data Breach

7.1 Services Provider will notify Customer without undue delay after becoming aware of a Personal Data Breach. Services Provider will provide information reasonably available regarding the nature of the breach, affected data and data subjects, likely consequences where known, measures taken or proposed, and a contact point. Services Provider will take reasonable steps to contain and remediate the breach, preserve relevant evidence, and reasonably cooperate with Customer's notification and investigation obligations. Notification or response is not an admission of fault or liability.

Assistance; Audits

8.1 Assistance. Taking into account the nature of the processing and the information available to it, Services Provider will provide reasonable assistance with Customer's data protection impact assessments and prior consultations with supervisory authorities where required by Data Protection Laws, and, where legally required, with a cybersecurity audit, risk assessment, or automated decision-making technology review Customer must conduct under the CCPA. Material bespoke assistance may be charged at mutually agreed rates to the extent permitted by law, except to the extent the assistance is required because of Services Provider's breach of this DPA or a Personal Data Breach caused by Services Provider.

8.2 Audits. Services Provider will make available information reasonably necessary to demonstrate compliance with this DPA, including completed security questionnaires. Customer will first use those materials and remote review where reasonably sufficient. If they are not sufficient under applicable Data Protection Laws, Customer may, at its expense, conduct an audit no more than once in any twelve-month period, except after a Personal Data Breach, on reasonable suspicion of material noncompliance, when required by a supervisory authority, or where mandatory law or the Standard Contractual Clauses require otherwise. An audit requires at least thirty (30) days' notice where practicable, occurs during business hours without unreasonable disruption, and is limited to relevant systems and information. Nothing in this Section limits audit rights that cannot be restricted under the Standard Contractual Clauses or applicable law.

Return and Deletion

9.1 Following expiration or termination of the applicable engagement, Services Provider will, at Customer's written election, return or delete Personal Data without unreasonable delay. If Customer does not make an election within thirty (30) days, Services Provider will delete the Personal Data. Services Provider will delete Personal Data from production systems within thirty (30) days after that period, and copies in archival backups are overwritten or expire in the ordinary course within ninety (90) days thereafter. Services Provider may retain Personal Data to the extent required by law or in archival backups that are not used for other purposes and remain protected under this DPA until deleted in the ordinary course.

International Transfers

10.1 Transfer Mechanisms. Customer acknowledges that Services Provider's primary processing operations are in the United States. For a Restricted Transfer, the Parties will rely on the following mechanisms in order of applicability: (a) an adequacy decision or recognized transfer framework covering Services Provider; or (b) the EU Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 (the "EU SCCs"), incorporated by reference. Module Two applies where Customer is a controller and Services Provider is a processor; Module Three applies where Customer is a processor and Services Provider is a subprocessor. Clause 7 (docking) does not apply. Under Clause 9, Option 2 applies with the notice period in Section 5.2. The optional language in Clause 11 does not apply. Under Clauses 17 and 18, Irish law and the courts of Ireland apply. Annexes I and II are completed by the Agreement, the applicable Order Form, and Exhibits A and B. Annex III does not apply because Clause 9, Option 2 (general authorization) applies rather than Option 1 (specific authorization); Services Provider instead maintains the Subprocessor list referenced in Section 5.1 for the general-authorization notice process. Execution of an Order Form that incorporates this DPA constitutes execution of the EU SCCs by both Parties.

10.2 United Kingdom. For Restricted Transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner, version B1.0 in force March 21, 2022 (the "UK Addendum"), is incorporated by reference. Table 1 is completed with the Parties' information in the Agreement, Order Form, and Exhibit A; Table 2 selects the EU SCCs, modules, and options stated in Section 10.1; Table 3 is completed by Exhibits A and B and the Subprocessor list; and in Table 4, neither Party may end the UK Addendum solely because the UK Information Commissioner issues a revised approved addendum. Mandatory Clauses of the UK Addendum control in a conflict.

10.3 Switzerland. For Restricted Transfers subject to the FADP, the EU SCCs apply with adaptations recognized by the Swiss Federal Data Protection and Information Commissioner: references to the EU GDPR include the FADP to the extent applicable; references to a Member State include Switzerland; individuals in Switzerland may enforce applicable rights in Switzerland; the FDPIC is the competent supervisory authority for processing governed solely by the FADP; and Swiss law and courts apply to transfers governed solely by the FADP to the extent permitted by the EU SCCs.

10.4 Transfer Assessments. Each Party will provide information reasonably requested to support a legally required transfer impact or risk assessment, taking into account the nature of the processing and information available to that Party. Services Provider will notify Customer if it can no longer comply with the applicable transfer mechanism and will cooperate on reasonable supplementary measures or suspension of the affected transfer.

10.5 Public Authority Requests. To the extent legally permitted, Services Provider will promptly notify Customer of a binding request from a public authority for Personal Data, will review the legality of the request, challenge it where there are reasonable grounds to do so, seek available interim measures when appropriate, and disclose only the minimum Personal Data legally required. If notice is prohibited, Services Provider will use reasonable efforts to obtain permission to notify Customer and will document its assessment and response as required by the applicable transfer mechanism.

General

11.1 In the event of a conflict, the order of precedence is: (a) the Standard Contractual Clauses and mandatory provisions of the UK Addendum; (b) this DPA; and (c) the Agreement (including Order Forms). Claims between the Parties under this DPA are subject to the limitations and exclusions of liability in the Agreement to the maximum extent permitted by law. Nothing in the Agreement or this DPA limits rights of data subjects or supervisory authorities under the Standard Contractual Clauses or mandatory Data Protection Laws. This DPA terminates automatically upon deletion or return of all Personal Data following termination of the Agreement.

Exhibit A — Details of Processing

Subject Matter, Nature, and Specified Purposes of Processing: Receiving, accessing, analyzing, and using Personal Data as necessary to perform the Professional Services described in the Agreement and applicable Order Forms, including automation design and build, implementation, integration, configuration, training, advisory services, and managed governance, risk, and compliance services. These activities are the limited and specified business purposes for which Customer discloses Personal Data to Services Provider. Duration: The term of the applicable Order Form plus the post-termination return and deletion periods described in this DPA. Categories of Data Subjects: Customer's and its Clients' personnel, contractors, and other authorized users; business contacts of Customer, its Clients, and their vendors, in each case to the extent submitted in connection with the Professional Services. Categories of Personal Data: Business contact information, such as name, business email address, job title, employer, and business telephone number; account and authentication identifiers; and information Customer provides in connection with an automation build, implementation, or advisory engagement. Customer must not submit sensitive or special-category personal data unless the applicable Order Form expressly authorizes it and appropriate safeguards are documented. Frequency: Continuous, as necessary to perform the Professional Services. Data Exporter / Customer: The Customer identified in the applicable Order Form. Address: as stated therein. Contact for data-protection matters: the Customer Contact identified in the Order Form. Activities relevant to the transfer: use of the Professional Services as controller or processor and submission of Personal Data for the purposes above. Signature and date: the Agreement and applicable Order Form. Data Importer / Processor: Vectra View LLC, a Delaware limited liability company. Data-protection contact: legal@vectraview.com. Activities relevant to the transfer: provision of the Professional Services and processing described in this Exhibit A. Signature and date: the Agreement and applicable Order Form. Sensitive Data and Safeguards: Sensitive or special-category personal data is prohibited unless expressly authorized. If authorized, the applicable Order Form must identify the categories and any additional access, encryption, retention, or human-review safeguards. Competent Supervisory Authority (EU SCCs): Determined in accordance with Clause 13 of the EU SCCs; for UK transfers, the UK Information Commissioner; for Swiss transfers, the FDPIC.

Exhibit B - Technical and Organizational Measures

Services Provider maintains a written information security program appropriate to its size, processing activities, and risk profile, including at minimum: (a) encryption of Personal Data in transit and at rest using industry-standard protocols; (b) logical access controls based on least privilege, unique credentials, multi-factor authentication for administrative access, and prompt revocation following role change or termination; (c) logical segregation of customer data designed to prevent one customer's data from being accessible in connection with another customer's engagement, with additional isolation and access controls that may apply depending on the applicable service configuration; (d) vendor and Subprocessor security management; (e) secure development and change-management practices for build engagements; (f) logging and monitoring of systems handling Personal Data; (g) backup and business-continuity procedures appropriate to the Professional Services; (h) incident-response procedures addressing detection, escalation, containment, evidence preservation, remediation, and notification; and (i) personnel confidentiality obligations and security awareness training.