Data Processing Addendum Template

!DOCTYPE html

Globex Inc.

Data Processing Addendum

June 15, 2025

Data Processing Addendum

EffectiveJune 15, 2025

Agreementthe Master Services Agreement dated January 10, 2025

Breach notice48 hours

Controller

Acme Corp

400 Main Street, Springfield, IL 62701

Processor

Globex Inc.

500 Commerce Drive, Suite 300, Columbus, OH 43215

This Data Processing Addendum (the "Addendum") supplements the Master Services Agreement dated January 10, 2025 (the "Agreement") between Acme Corp ("Controller") and Globex Inc. ("Processor") and applies to Personal Data that Processor processes on behalf of Controller under the Agreement.

1. Definitions and Roles

"Personal Data" means any information relating to an identified or identifiable natural person that Processor processes on behalf of Controller under the Agreement. "Data Protection Laws" means all laws that apply to that processing, including, where applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, the California Consumer Privacy Act as amended ("CCPA"), and other U.S. state consumer privacy laws. "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, P

2. Details of Processing

Item

Detail

Subject matter and purpose

customer support analytics and document workflow automation

Duration

the term of the Agreement plus the deletion period in Section 3(g)

Categories of data subjects

Controller's customers, end users, and support contacts

Types of Personal Data

names, business email addresses, phone numbers, support ticket content, and document metadata

Sensitive data

None

Processing location

United States

3. Processor Obligations

Processor shall:

(a) process Personal Data only on Controller's documented instructions, including with regard to international transfers, unless applicable law requires otherwise, in which case Processor will inform Controller of that requirement before processing unless the law prohibits it. The Agreement and this Addendum are Controller's instructions. Processor will promptly inform Controller if, in its opinion, an instruction infringes Data Protection Laws;

(b) ensure that every person authorized to process Personal Data is bound by an appropriate duty of confidentiality;

(c) implement appropriate technical and organizational measures to protect Personal Data, as required by GDPR Article 32, including at least the Safeguards in Section 4;

(d) taking into account the nature of the processing, assist Controller by appropriate technical and organizational measures in responding to requests from individuals exercising their rights under Data Protection Laws, and promptly forward to Controller any such request Processor receives;

(e) assist Controller in meeting its obligations on security, Security Incident notification, data protection impact assessments, and prior consultation with supervisory authorities (GDPR Articles 32 to 36), taking into account the nature of the processing and the information available to Processor;

(f) notify Controller without undue delay, and in any event within 48 hours, after becoming aware of a Security Incident, and provide the information Controller reasonably needs to meet its own notification obligations. Processor's security contact is security+globex@propper.ai;

(g) at Controller's choice, delete or return all Personal Data within 30 days after the services end, and delete existing copies, unless applicable law requires Processor to retain them; and

(h) make available to Controller all information necessary to demonstrate compliance with this Addendum, and allow for and contribute to audits, including inspections, by Controller or an auditor Controller appoints, on reasonable notice and no more than once a year except after a Security Incident or when a regulator requires it.

4. Safeguards

Access control: Role-based access with least privilege and MFA.

Encryption: Encryption in transit and at rest for customer content.

Audit logging: Immutable administrative and document access logs.

5. Subprocessors

Controller gives general written authorization for Processor to engage the subprocessors listed in Schedule B to the Agreement. Processor will give Controller at least 30 days' written notice before adding or replacing a subprocessor, during which Controller may object on reasonable data protection grounds. If the parties cannot resolve the objection, Controller may terminate the affected services without penalty. Processor shall bind each subprocessor by written contract to data protection obligations no less protective than this Addendum, and remains fully liable to Controller for each subpr

6. International Transfers

Processor shall not transfer Personal Data outside the processing location stated in Section 2 except on Controller's documented instructions and in compliance with Data Protection Laws. Where Personal Data subject to the GDPR or UK GDPR is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two, and the UK International Data Transfer Addendum (the "Standard Contractual Clauses") are incorporated into this Addendum by reference, with Controller as data exporter and Processor as data importer. For th

7. U.S. State Privacy Laws

To the extent the CCPA or a similar U.S. state law applies, Processor shall not: (a) sell or share Personal Data, as those terms are defined in the CCPA; (b) retain, use, or disclose Personal Data for any purpose other than the business purposes in Section 2, or outside the direct business relationship between the parties; or (c) combine Personal Data with personal information it receives from other sources, except as the CCPA permits. Processor shall comply with the CCPA and provide the same level of privacy protection the CCPA requires of businesses, and shall notify Controller if it determi

8. Term and General

This Addendum remains in effect for as long as Processor processes Personal Data on behalf of Controller. It is governed by the law that governs the Agreement, except where the Standard Contractual Clauses or Data Protection Laws require otherwise. Each party's liability under this Addendum is subject to the limitations of liability in the Agreement, to the extent Data Protection Laws permit. This Addendum may be signed electronically and in counterparts, each of which is an original.

The parties have signed this Addendum as of June 15, 2025.

Controller

Jane Doe

General Counsel, Acme Corp

Processor

Avery Lee

Chief Information Security Officer, Globex Inc.