Data Processing Addendum

This Data Processing Addendum (including all Schedules attached hereto, the “DPA”) is incorporated into, and is subject to the terms and conditions of, the Customer Agreement or other written or electronic agreement (“Agreement”) between Prosperous Commerce Inc., a Delaware corporation (d/b/a Hyphenate) (“Hyphenate”) and the entity identified as “Customer” in the Agreement (“Customer”). This DPA applies to the extent Hyphenate’s Processing of Customer Personal Data is subject to the Data Protection Laws. This DPA shall be effective for the term of the Agreement.

1.1. For the purposes of this DPA:

“Customer Personal Data” means the Personal Data described under Schedule 1 to this DPA.

“Data Protection Laws” means all laws relating to data protection and privacy applicable to Hyphenate’s Processing of Customer Personal Data in any jurisdiction where Customer and/or Hyphenate operates, including without limitation European Data Protection Law and the laws and regulations of the United States and its states, as amended from time to time, to the extent applicable to the relevant party.

“Data Subjects” means the individuals identified in Schedule 1.

“European Data Protection Law” means the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and all other privacy and data protection laws of the European Economic Area (“EEA”), and their respective Member States, Switzerland and the United Kingdom (“UK”), including without limitation the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (SI 2019/419) (the “UK GDPR”), and all laws implementing or supplementing the foregoing.

“Personal Data” means any information that reasonably relates, directly or indirectly, to an identified or identifiable Data Subject.

“Processing” (including its cognate “Process”) means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data Processed by Hyphenate or its Subprocessors. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data (such as unsuccessful log-in attempts, pings, port scans, denial of service attacks and other network attacks on firewalls or networked systems) are not Security Incidents.

“Service” or “Services” means the Hyphenate Platform (as defined in the Agreement) together with any related support, implementation and professional services provided by Hyphenate under the Agreement.

“Standard Contractual Clauses” means (i) Module 2 of the Standard Contractual Clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and the Council approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as currently set out at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj (the “EU SCCs”); and (ii) where the UK GDPR applies to a transfer, the EU SCCs as amended by the UK Addendum (the “UK SCCs”).

“UK Addendum” means the International Data Transfer Addendum to the Standard Contractual Clauses issued by the UK Information Commissioner’s Office, in force as of 21 March 2022, available at https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf.

1.2. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement.

2.1. Hyphenate will Process Customer Personal Data on behalf of Customer and in accordance with Customer’s prior written instructions, including any instructions provided through Customer’s use of the Service. Hyphenate is hereby instructed to Process Customer Personal Data to the extent necessary to provide the Service as set forth in the Agreement and this DPA and in accordance with Data Protection Laws. Customer’s documented instructions include the Processing of Customer Personal Data in the United States and in the other locations identified in Schedule 3, including transfers to the Subprocessors listed there, subject to Section 3.

2.2. Hyphenate will inform Customer if, in its opinion, an instruction from Customer infringes the Data Protection Laws, unless it is prohibited from doing so by law on important grounds of public interest.

2.3. The details of Hyphenate’s Processing of Customer Personal Data are described in Schedule 1.

2.4. If applicable laws preclude Hyphenate from complying with Customer’s instructions, Hyphenate will inform Customer of its inability to comply with the instructions, to the extent permitted by law.

2.5. Each of Customer and Hyphenate will comply with their respective obligations under the Data Protection Laws.

2.6. Hyphenate certifies that it will not (a) “sell” (as defined in Data Protection Laws) Customer Personal Data; (b) share or otherwise disclose Customer Personal Data to third parties for targeted advertising purposes; (c) retain, use, or disclose Customer Personal Data for any purpose other than as permitted under this DPA and in accordance with the Agreement; or (d) retain, use, or disclose Customer Personal Data other than in the context of the direct relationship with Customer in accordance with the Agreement and Data Protection Laws.

2.7. To the extent Customer Personal Data is subject to the California Consumer Privacy Act, as amended (“CCPA”), or another United States state privacy law, Hyphenate acts as Customer’s “service provider” or “processor” and, in addition to Section 2.6: (a) Customer discloses Customer Personal Data to Hyphenate only for the limited and specified business purposes of hosting, processing, reconciling, analysing and reporting on Customer’s financial and accounting data, and providing related support, as described in the Agreement and Schedule 1; (b) Hyphenate will not combine Customer Personal Data with personal information it receives from other sources or collects from its own interactions with consumers, except as permitted by the CCPA; (c) Hyphenate will comply with the CCPA and provide the same level of privacy protection as the CCPA requires of Customer; (d) Hyphenate will notify Customer if it determines that it can no longer meet its obligations under the CCPA; (e) Customer may take reasonable and appropriate steps to ensure that Hyphenate uses Customer Personal Data consistently with Customer’s CCPA obligations and, upon notice, to stop and remediate unauthorized use; and (f) Hyphenate will engage any Subprocessor under a written contract that imposes the obligations of this Section 2.7 and will notify Customer of such engagements in accordance with Section 5.

3.1. In the event that Customer is subject to European Data Protection Law and the transfer of Customer Personal Data to Hyphenate would be restricted in the absence of the Standard Contractual Clauses, the parties agree that the Standard Contractual Clauses shall be incorporated into this DPA with Customer as the “data exporter” and Hyphenate as the “data importer.”

3.2. For purposes of the EU SCCs the parties agree that:

3.2.1. In Clause 7, the optional docking clause will not apply;

3.2.2. In Clause 9, Option 2 (general written authorisation) will apply and the time period for prior notice of Subprocessor changes is thirty (30) days, as set forth in Section 5.1 of this DPA;

3.2.3. In Clause 11, the optional language will not apply;

3.2.4. For the purpose of Clause 17, the EU SCCs shall be governed by the laws of Ireland;

3.2.5. For the purpose of Clause 18(b), the parties agree to submit to the jurisdiction of the courts of Ireland;

3.2.6. For Annex I, Section A (List of Parties), (i) the data exporter’s and the data importer’s identity and contact details and, where applicable, information about their respective data protection officer and/or representative in the EEA are those set forth in the Agreement or as otherwise communicated by each party to the other party; (ii) Customer is a controller, and Hyphenate is a processor; (iii) the activities relevant to the data transferred under the EU SCCs relate to the provision of the Services pursuant to the Agreement; and (iv) entering into this DPA shall be treated as each party’s signature of Annex I, Section A, as of the effective date of this DPA;

3.2.7. For Annex I, Section B (Description of Transfer): (i) Schedule 1 to this DPA describes Hyphenate’s Processing of Customer Personal Data; (ii) the frequency of the transfer is continuous (for as long as Customer uses the Services); (iii) Customer Personal Data will be retained in accordance with Clause 8.5 of the EU SCCs and this DPA; (iv) Hyphenate uses Subprocessors to support the provision of the Services.

3.2.8. For Annex I, Section C (Competent Supervisory Authority), the competent supervisory authority identified in accordance with Clause 13 of the EU SCCs is the competent supervisory authority communicated by Customer to Hyphenate. Unless and until Customer communicates a competent supervisory authority to Hyphenate, the competent supervisory authority shall be the supervisory authority of the EU Member State in which Customer is established or, where Customer is not established in the EU, the authority determined in accordance with Clause 13 of the EU SCCs.

3.2.9. For the purposes of Annex II, the data importer has implemented and will maintain appropriate technical and organizational measures to protect the security, confidentiality and integrity of Customer Personal Data as described in Schedule 2.

3.3. For the purposes of the UK Addendum the parties agree that Part 1, Tables 1, 2 and 3 of the UK Addendum will be deemed to be completed with the information set out in the Agreement, this DPA and its Schedules, like the equivalent provisions in the EU SCCs. For the purpose of Part 1, Table 4, the party that may end the UK Addendum in accordance with Section 19 of the UK Addendum is the importer.

3.4. For transfers subject to the Swiss Federal Act on Data Protection (“FADP”), the EU SCCs apply with the following adaptations: (i) references to the GDPR are to be read as references to the FADP insofar as the transfer is subject to the FADP; (ii) the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority insofar as the transfer is subject to the FADP; (iii) references to “Member State” shall not be interpreted to exclude Data Subjects in Switzerland from exercising their rights in their place of habitual residence; and (iv) the EU SCCs also protect the data of legal entities until the entry into force of any revision of the FADP that removes that protection.

4.1. Hyphenate will require its personnel who access Customer Personal Data to commit to protect the confidentiality of Customer Personal Data.

4.2. Hyphenate will implement and maintain appropriate technical and organisational measures, including those described in Schedule 2, designed to ensure a level of security appropriate to the risk and to protect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.

4.3. To the extent required by Data Protection Laws, Hyphenate will provide Customer with reasonable assistance as necessary for the fulfilment of Customer’s obligations under Data Protection Laws to maintain the security of Customer Personal Data.

5.1. Customer agrees that Hyphenate may use the third-party suppliers listed in Schedule 3 to Process Customer Personal Data on its behalf for the provision of the Services under the Agreement (each a “Subprocessor”). Hyphenate will give Customer at least thirty (30) days’ prior notice of any intended addition or replacement of a Subprocessor by updating the Subprocessor list referenced in Schedule 3 (where Customer may subscribe to notifications) and by email to Customer’s designated administrator(s). Customer may object to such a change on reasonable, documented data-protection grounds within fourteen (14) days after notice. In response to Customer’s reasonable objection, the parties will work together in good faith to determine an appropriate resolution; if no resolution is agreed within thirty (30) days, Customer may terminate the affected Order Form on written notice as its sole remedy.

5.3. Hyphenate will engage each Subprocessor under a written contract that imposes data protection obligations no less protective of Customer Personal Data than those in this DPA, to the extent applicable to the services the Subprocessor provides.

5.2. Hyphenate will be liable to Customer for breaches of this DPA caused by its Subprocessors’ acts and omissions as it would be for its own.

Customer is responsible for responding to any Data Subject requests relating to Customer Personal Data (“Requests”). If Hyphenate receives any Requests during the term, Hyphenate will promptly notify Customer and will not respond to the Data Subject other than to confirm that the Request has been forwarded to Customer, unless Customer authorises Hyphenate to do so. Hyphenate will provide Customer with self-service functionality or other reasonable assistance to permit Customer to respond to Requests.

Upon becoming aware of a Security Incident affecting Customer Personal Data, Hyphenate will (i) promptly take measures designed to remediate the Security Incident and (ii) notify Customer without undue delay. Customer is solely responsible for complying with Security Incident notification requirements applicable to Customer. At Customer’s request, Hyphenate will reasonably assist Customer’s efforts to notify Security Incidents to the competent data protection authorities and/or affected Data Subjects, if Customer is required to do so under the Data Protection Laws. Hyphenate’s notice of or response to a Security Incident under this Section 7 will not be an acknowledgement or admission by Hyphenate of any fault or liability with respect to the Security Incident.

Taking into account the nature of the Processing and the information available to Hyphenate, Hyphenate will reasonably assist Customer in conducting data protection impact assessments and consultation with data protection authorities if Customer is required to engage in such activities under applicable Data Protection Laws and such assistance is necessary and relates to the Processing by Hyphenate of Customer Personal Data.

Upon expiration or termination of the last Order Form under which Customer Personal Data was Processed (or of the Agreement, if earlier), Hyphenate will, at Customer’s choice communicated in writing within thirty (30) days thereafter, return Customer Personal Data to Customer through the retrieval mechanism described in the Agreement or delete it, and in either case will delete existing copies within ninety (90) days unless applicable law requires otherwise. If Customer does not communicate a choice within that period, Customer instructs Hyphenate to delete. The parties agree that the certification of deletion described in Clause 8.5 of the EU SCCs (including as incorporated by the UK Addendum), if applicable, shall be provided only upon Customer’s written request. Notwithstanding the foregoing, Hyphenate may retain Customer Personal Data to the extent and for the period required by applicable laws, provided that Hyphenate maintains the confidentiality of all such Customer Personal Data and Processes it only as necessary for the purpose(s) specified in the applicable laws requiring its storage.

10.1. Customer may audit Hyphenate’s compliance with its obligations under this DPA up to once per year. In addition, Customer may perform more frequent audits (including inspections) in the event: (1) Hyphenate suffers a Security Incident affecting Customer Personal Data; (2) Customer has genuine, documented concerns regarding Hyphenate’s compliance with this DPA or the Data Protection Laws; or (3) where required by the Data Protection Laws, including where mandated by regulatory or governmental authorities with jurisdiction over Customer Personal Data. Hyphenate will contribute to such audits by providing Customer or Customer’s regulatory or governmental authority with the information and assistance reasonably necessary to conduct the audit, including any relevant records of Processing activities applicable to the Service, as described below.

10.2. To request an audit, Customer must submit a detailed proposed audit plan to privacy@hyphenate.ai (with a copy to the notice address in the Agreement) at least one month in advance of the proposed audit start date. The proposed audit plan must describe the proposed scope, duration, start date of the audit, and the identity of any third party Customer intends to appoint to perform the audit. Hyphenate will review the proposed audit plan and provide Customer with any concerns or questions (for example, Hyphenate may object to the third party auditor as described in Section 10.3, provide an Audit Report as described in Section 10.4, or identify any requests for information that could compromise Hyphenate confidentiality obligations or security, privacy, employment or other relevant policies). The parties will negotiate in good faith to agree on a final audit plan at least two weeks in advance of the proposed audit start date. Nothing in this Section 10 shall require Hyphenate to breach any duties of confidentiality.

10.3. Hyphenate may object to third party auditors that are, in Hyphenate’s reasonable opinion, not suitably qualified or independent, a competitor of Hyphenate, or otherwise manifestly unsuitable. Customer will appoint another auditor or conduct the audit itself if the parties cannot resolve the objection after negotiating in good faith.

10.4. If the requested audit scope is addressed in a SOC 1 or SOC 2 Type 2 report (SSAE 18 or ISAE 3402), ISO 27001 certification, NIST assessment or similar audit report performed by a qualified third party auditor on Hyphenate’s systems that Process Customer Personal Data (“Audit Reports”) within twelve (12) months of Customer’s audit request, and Hyphenate confirms there are no known material changes in the controls audited, Customer agrees to accept the Audit Report in lieu of requesting an audit of the controls covered by it.

10.5. The audit must be conducted at a mutually agreeable time during regular business hours at the applicable facility, subject to the agreed final audit plan and Hyphenate’s health and safety or other relevant policies, and may not unreasonably interfere with Hyphenate’s business activities.

10.6. Any audits are at Customer’s expense and Customer will promptly disclose to Hyphenate any perceived non-compliance or security concerns discovered during the audit, together with all relevant details.

10.7. The parties agree that the audits described in Clause 8.9 of the EU SCCs (including as incorporated by the UK Addendum), if applicable, shall be performed in accordance with this Section 10.

Customer acknowledges and agrees that Hyphenate may create and derive from Processing related to the Service anonymized and/or aggregated data that does not identify or relate to Customer or any Data Subject (“Analytics Data”), and use, publicize or share with third parties such Analytics Data to improve the Service and for Hyphenate’s other legitimate business purposes in accordance with Data Protection Laws. Hyphenate will not attempt to re-identify Analytics Data, will maintain and use it only in anonymized or aggregated form, and will contractually require any recipient to do the same.

12.1. Each party’s liability towards the other party under or in connection with this DPA will be limited in accordance with the provisions of the Agreement. For clarity, and to the maximum extent permitted by applicable law, the exclusions and limitations of liability in the Agreement apply to each party’s liability to the other party arising under the Standard Contractual Clauses as between the parties, without prejudice to the rights of Data Subjects or supervisory authorities under the Standard Contractual Clauses.

12.2. Customer acknowledges that Hyphenate is reliant on Customer for direction as to the extent to which Hyphenate is entitled to Process Customer Personal Data on behalf of Customer in performance of the Service. Consequently, Hyphenate will not be liable under the Agreement for any claim brought by a Data Subject arising from (a) any action or omission by Hyphenate in compliance with Customer’s instructions or (b) Customer’s failure to comply with its obligations under the Data Protection Laws.

With regard to the subject matter of this DPA, in the event of inconsistencies between the provisions of this DPA and the Agreement, the provisions of this DPA shall prevail. In the event of inconsistencies between the DPA and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail.

Categories of Data Subjects. This DPA applies to Hyphenate’s Processing of Customer Personal Data relating to Customer’s employees, contractors, clients/consumers, and other authorized users of the Service (“Data Subjects”).

Types of Personal Data. The extent of Customer Personal Data Processed by Hyphenate is determined and controlled by Customer in its sole discretion and may include: (a) identity and business contact data of Users and Customer personnel (name, work email address, title, user ID and authentication data); and (b) Personal Data contained in the financial and accounting records that Customer connects or uploads to the Service, such as names, contact details, payment and bank account details and transaction information of Customer’s employees, vendors and customers. Customer will not submit special categories of Personal Data (as defined in the GDPR) unless agreed in writing.

Subject-Matter and Nature of the Processing. Customer Personal Data will be subject to the Processing activities that Hyphenate needs to perform in order to provide the Service pursuant to the Agreement.

Purpose of the Processing. Hyphenate will Process Customer Personal Data for purposes of providing the Service as set out in the Agreement.

Duration of the Processing. Customer Personal Data will be Processed for the duration of the Agreement, subject to Section 9 of the DPA.

Representatives and contacts. Hyphenate’s representative in the EU under Article 27 GDPR is European Data Protection Office (EDPO), Avenue Huart Hamoir 71, 1030 Brussels, Belgium. Hyphenate’s privacy contact is privacy@hyphenate.ai. Customer’s contact details and, where applicable, its data protection officer or representative are as set out in the Order Form or as notified to Hyphenate.

Hyphenate will implement and maintain the security practices and procedures set out in this Schedule 2:

Organizational management and staff responsible for the development, implementation and maintenance of Hyphenate’s information security program.

Periodic review and assessment of risks to Hyphenate’s organization, monitoring and maintaining compliance with Hyphenate’s policies and procedures, and reporting the condition of its information security and compliance to internal senior management as appropriate.

Data security controls which include logical segregation of data, restricted (e.g., role-based) access and monitoring, and use of commercially available and industry standard encryption technologies for Customer Personal Data as appropriate.

Logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions.

Password controls designed to manage and control password strength and password management requirements for assigned Hyphenate credentials as appropriate.

Change management procedures and tracking mechanisms designed to test, approve and monitor changes to Hyphenate’s technology and information assets.

Incident response procedures designed to allow Hyphenate to investigate, respond to, mitigate and notify events related to Hyphenate’s technology and information assets.

Network security controls that provide for the use of enterprise firewalls and intrusion detection systems and other traffic and event correlation procedures designed to protect systems from intrusion and limit the scope of any successful attack, as appropriate.

Business resiliency/continuity and disaster recovery procedures designed to maintain service and/or recovery from foreseeable emergency situations or disasters.

Hyphenate’s current list of Subprocessors engaged to Process Customer Personal Data in connection with the Services is published at https://trust.hyphenate.ai and is incorporated into this DPA by reference. Hyphenate will update that list before engaging any new Subprocessor and will notify Customer in accordance with Section 5 of this DPA. A copy is also available on request to privacy@hyphenate.ai.