Axiad Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Axiad Cloud Services Agreement or Axiad Terms of Use (as applicable, the "Agreement") between Axiad IDS, Inc. ("Axiad") and the customer identified in the Agreement or the applicable Order Form ("Customer"). This DPA applies to all Services under the Agreement, including Axiad Conductor, Axiad Mesh, and Axiad Confirm, to the extent Axiad Processes Personal Data on Customer's behalf. Capitalized terms not defined in this DPA have the meanings given in the Agreement or, if not defined there, in Applicable Data Protection Laws. In the event of a conflict between this DPA and the Agreement with respect to the Processing of Personal Data, this DPA controls.

1. DEFINITIONS

1.1 "Applicable Data Protection Laws" means all laws, regulations, treaties, and governmental requirements applicable to the Processing of Personal Data under the Agreement, as they may be amended or otherwise updated from time to time, including, as applicable: (a) the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its regulations ("CCPA"); (b) other U.S. state privacy laws; (c) U.S. state biometric privacy laws, including the Illinois Biometric Information Privacy Act ("BIPA"); (d) the EU General Data Protection Regulation (EU) 2016/679 ("GDPR"), the GDPR as incorporated into United Kingdom law ("UK GDPR"), and the Swiss Federal Act on Data Protection ("FADP"); and (e) any law regulating automated decision-making or artificial intelligence to the extent it applies to the Processing.

1.2 "Personal Data" means any Customer Data that constitutes "personal information," "personal data," or an equivalent term under Applicable Data Protection Laws and that Axiad Processes on Customer's behalf in connection with providing the Services under the Agreement, including Verification Data (as defined in Schedule C of the Agreement) for Axiad Confirm.

1.3 "Process" and "Processing" mean any operation or set of operations which are performed on Personal Data or on sets of Personal Data, whether or not by automated means. “Process”, “Processes” and “Processed” will be interpreted accordingly.

1.4 "Sub-processor" means any third party engaged by Axiad to Process Personal Data on Axiad's behalf in connection with the Services, including Third Party Service providers.

1.5 "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data Processed by Axiad or its Sub-processors. Security Incident does not include unsuccessful attempts or activities that do not compromise the security of Personal Data.

1.6 "Standard Contractual Clauses" or "SCCs" means (a) the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision (EU) 2021/914 ("EU SCCs"); and (b) the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner ("UK Addendum").

1.7 The terms "Business," "Consumer," "Controller," "Data Subject," "Deidentified," "Processor," "Sell," "Service Provider," "Share," and "Supervisory Authority" have the meanings given under Applicable Data Protection Laws.

2. ROLES AND SCOPE

2.1 Roles. As between the parties, Customer is the Controller or Business (or, where Customer acts on behalf of its own customers, a Processor or Service Provider) and Axiad is the Processor or Service Provider with respect to Personal Data. Axiad Processes Personal Data only on behalf of Customer and in accordance with Customer's documented instructions. Where Customer is itself a Processor, Customer represents that its instructions are authorized by the relevant Controller and Axiad acts as a sub-processor to Customer.

2.2 Details of Processing. The subject matter, duration, nature, and purpose of the Processing, the types of Personal Data, and the categories of Data Subjects for each Service are described in Schedule 1.

2.3 Customer Responsibilities. Customer is responsible for (a) the accuracy, quality, and legality of Personal Data and the means by which Customer acquired it; (b) providing all notices and obtaining all consents and authorizations required under Applicable Data Protection Laws for Axiad to Process Personal Data as contemplated by the Agreement, including the biometric notices and consents described in Schedule C of the Agreement for Axiad Confirm; (c) its instructions to Axiad complying with Applicable Data Protection Laws; and (d) configuring the Services, including retention and access settings, in accordance with its obligations.

3. AXIAD OBLIGATIONS

3.1 Instructions. Axiad shall Process Personal Data only (a) to provide, secure, support, and improve the Services and otherwise perform the Agreement (the "Business Purpose"); (b) in accordance with Customer's documented instructions, which consist of the Agreement, this DPA, Customer's configuration of the Services, and any other written instructions agreed by the parties; and (c) as required by applicable law, in which case Axiad shall inform Customer of the legal requirement before Processing unless the law prohibits such notice. Any improvement of the Services using Personal Data will be performed only on Deidentified data in accordance with Section 5.7 of the Agreement. Axiad shall inform Customer if, in Axiad's reasonable opinion, an violates Applicable Data Protection Laws and may suspend the affected Processing until the instruction is amended.

3.2 U.S. State Law Commitments. With respect to Personal Data subject to the CCPA or another U.S. state privacy law, Axiad shall: (a) not Sell or Share Personal Data; (b) not retain, use, or disclose Personal Data for any purpose other than the Business Purpose, including any commercial purpose other than the Business Purpose, or outside the direct business relationship between the parties; (c) not combine Personal Data with personal information Axiad receives from or on behalf of another person or collects from its own interaction with a Consumer, except as permitted for a Service Provider or Processor under Applicable Data Protection Laws; (d) comply with the obligations applicable to Service Providers and Processors and provide the same level of privacy protection as required of Businesses and Controllers; (e) notify Customer within five (5) business days if Axiad determines it can no longer meet its obligations under Applicable Data Protection Laws; (f) permit Customer, on reasonable notice, to take reasonable and appropriate steps to ensure Axiad uses Personal Data consistently with Customer's obligations and to stop and remediate any unauthorized use; and (g) certify that it understands and will comply with the restrictions in this Section 3.2.

3.3 Confidentiality of Processing. Axiad shall ensure that personnel authorized to Process Personal Data are bound by written confidentiality obligations or are under an appropriate statutory obligation of confidentiality, and have received appropriate training.

3.4 Security. Axiad shall implement and maintain the technical and organizational measures described in Exhibit 2 to the Agreement (Information Security) and Schedule 2 of this DPA, which the parties agree are appropriate to the risk having regard to the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the Processing.

3.5 Biometric Data (Axiad Confirm). Where Axiad Processes biometric identifiers or biometric information in the context of providing Axiad Confirm, Axiad shall, in addition to its other obligations: (a) Process such data solely to perform Verifications and the related fraud-prevention purposes described in Schedule C of the Agreement, and never Sell, lease, trade, or otherwise profit from it; (b) store, transmit, and protect such data using a standard of care at least as protective as that applied to other confidential and sensitive information; (c) permanently destroy such data within the period stated in Section C.6 of the Agreement; (d) not use identifiable biometric data to train, fine-tune, or improve any artificial-intelligence or machine-learning model; and (e) cooperate with Customer in responding to any inquiry or claim under a biometric privacy law relating to the Services.

4. SUB-PROCESSORS

4.1 Authorization. Customer hereby provides general written authorization for Axiad to engage Sub-processors to Process Personal Data, subject to this Section 4. Axiad's current Sub-processors are listed at https://engage.axiad.com/sub-processors (the "Sub-processor List").

4.2 Obligations. Axiad shall impose on each Sub-processor, by written contract, data-protection obligations no less protective than those in this DPA to the extent applicable to the services the Sub-processor provides to or for Axiad and remains liable for each Sub-processor's performance of those obligations.

4.3 Notice and Objection. Axiad shall notify Customer (by email to Customer's designated privacy or administrative contact, or by a subscription mechanism on the Sub-processor List page) at least fifteen (15) days before authorizing any new Sub-processor to Process Personal Data. Customer may object in writing on reasonable, documented data-protection grounds within that period. If Customer objects, the parties will work in good faith to resolve the objection. If the parties are unable to reach a mutually acceptable resolution within thirty (30) days, Customer may, upon prompt written notice to Axiad, terminate the portion of the Agreement relating to the Services affected by such change by providing written notice to Axiad. During any such objection period, Axiad will not use such new Sub-processor to Process any Personal Data for Customer.

4.4 Large Language Model Providers. Axiad's no-training, limited-retention, and data-minimization commitments for Sub-processors that provide large language model or other generative-AI processing are set out in Section 2 of Exhibit 2 to the Agreement and apply to Personal Data.

5. DATA SUBJECT REQUESTS AND ASSISTANCE

5.1 Data Subject Requests. Taking into account the nature of the Processing, Axiad shall provide reasonable assistance to Customer, through the functionality of the Services and appropriate technical and organizational measures, to respond to requests from Data Subjects or Consumers to exercise their rights under Applicable Data Protection Laws (including access, correction, deletion, portability, and objection). If Axiad receives such a request directly, it shall, to the extent legally permitted, promptly forward the request to Customer and shall not respond except to acknowledge receipt and direct the individual to Customer, or on Customer's documented instruction.

5.2 Assessments and Consultations. Axiad shall provide reasonable assistance to Customer, insofar as the relevant information is within Axiad's control, with data-protection impact assessments, risk assessments and prior consultations with Supervisory Authorities, and any artificial-intelligence impact assessment, automated-decision-making risk assessment, or equivalent that Customer is required to perform under Applicable Data Protection Laws in connection with the Services, including by providing the information about AI Features described in Section 4.2 of the Agreement.

5.3 Government Requests. If Axiad receives a legally binding request from a government or law-enforcement authority for disclosure of Personal Data, Axiad shall, unless legally prohibited, promptly notify Customer, redirect the authority to Customer where possible, disclose only the minimum Personal Data required, and challenge the request where Axiad reasonably believes it to be unlawful.

5.4 Costs. Assistance under this Section 5 is provided at no additional charge to the extent it can be satisfied through standard Service functionality or Axiad's existing documentation; Axiad may charge reasonable fees at its then-current rates for assistance beyond that scope, to the extent permitted by Applicable Data Protection Laws.

6. SECURITY INCIDENTS

6.1 Notification. Axiad shall notify Customer of a confirmed Security Incident within the time and with the content required by Section 12 of Exhibit 2 to the Agreement, and shall also include, to the extent then known, the categories and approximate number of Data Subjects and Personal Data records affected, so as to enable Customer to meet its own notification obligations under Applicable Data Protection Laws. Notification will be sent to Customer's designated privacy or administrative contact.

6.2 Response. Axiad shall cooperate with Customer in Customer's own notification and remediation efforts. Axiad shall not notify Data Subjects, regulators, or the public of a Security Incident on Customer's behalf without Customer's prior written consent unless required by law. Axiad's notification is not an acknowledgment of fault, negligence, liability, or breach.

7. INTERNATIONAL TRANSFERS

7.1 Hosting. Axiad hosts the Services and stores Personal Data in the United States, as described in Exhibit 2 to the Agreement.

7.2 EEA, UK, and Swiss Transfers. To the extent Customer transfers Personal Data subject to the GDPR, UK GDPR, or FADP to Axiad in the United States, the parties agree that (a) the EU SCCs are incorporated into this DPA and apply as follows: Module Two (controller to processor) applies where Customer is a Controller and Module Three (processor to processor) applies where Customer is a Processor; Clause 7 (docking) is included; in Clause 9, Option 2 (general authorization) applies with the notice period in Section 4.3 of this DPA; in Clause 11, the optional language is not included; in Clause 13, the Supervisory Authority is that of the EU Member State in which Customer or its EU representative is established; in Clauses 17 and 18, the governing law and courts are those of Ireland; Annex I is completed by Schedule 1 of this DPA and the parties' details in the Agreement; Annex II is completed by Schedule 2 of this DPA; and Annex III is the Sub-processor List; (b) for transfers subject to the UK GDPR, the UK Addendum is incorporated and completed by the information in this Section and the Schedules, with Table 4 permitting either party to end the UK Addendum as set out in Section 19 of the UK Addendum; and (c) for transfers subject to the FADP, the EU SCCs apply with the modifications required by the Swiss Federal Data Protection and Information Commissioner, including references to the FADP and the Commissioner as the competent authority. If Axiad adopts an alternative valid transfer mechanism (such as certification under the EU-U.S. Data Privacy Framework), Axiad may rely on that mechanism and the SCCs will apply only to the extent the alternative mechanism is invalidated.

8. DELETION AND RETURN

8.1 During the Term, Customer may delete Personal Data or export it through the Services as described in Section 5.8 of the Agreement, and Axiad shall delete Personal Data on Customer's documented instruction subject to the retention periods in the applicable Product Schedule. On expiration or termination of the Agreement, Axiad shall make Personal Data available for export during the Export Window under Section 8.4 of the Agreement and shall thereafter delete Personal Data within the period stated in that Section, except (a) Deidentified data retained in accordance with Section 5.7 of the Agreement; (b) Personal Data stored in routine backups, which will be deleted in the ordinary course of Axiad's backup rotation and remains protected by this DPA until deleted; and (c) copies Axiad is required to retain by applicable law, which remain subject to this DPA. Biometric data under Axiad Confirm is destroyed on the shorter schedule stated in Section C.6 of the Agreement. On Customer’s written request, Axiad will certify deletion in writing.

9. AUDITS

9.1 Axiad shall make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits, in accordance with Section 13 of Exhibit 2 to the Agreement (Customer Audit and Assurance), which is incorporated into this DPA. Where the SCCs apply, this Section 9 and Section 13 of Exhibit 2 describe the scope and manner of the audits contemplated by Clause 8.9 of the EU SCCs, without limiting the rights of Data Subjects or Supervisory Authorities under the SCCs.

10. GENERAL

10.1 Duration. This DPA is effective for as long as Axiad Processes Personal Data under the Agreement and survives termination of the Agreement until all Personal Data has been deleted or returned.

10.2 Liability. Each party's liability arising out of or relating to this DPA, including the SCCs, is subject to the exclusions and limitations of liability in Section 7 of the Agreement, except to the extent Applicable Data Protection Laws or the SCCs do not permit such limitation as between the parties. Nothing in this Section limits the rights of Data Subjects under the SCCs.

10.3 Precedence. In the event of conflict, the following order of precedence applies with respect to the Processing of Personal Data: (a) the SCCs, where applicable; (b) this DPA; (c) the Agreement. Except as amended by this DPA, the Agreement remains in full force and effect.

10.4 Governing Law. This DPA is governed by the governing law and dispute-resolution provisions of the Agreement, except to the extent the SCCs or Applicable Data Protection Laws require otherwise.

10.5 Updates. Axiad may update this DPA from time to time to reflect changes in Applicable Data Protection Laws or the Services, provided that no update materially reduces Axiad's obligations to Customer during a then-current subscription term without Customer's written consent.

10.6 Severability. If any court or competent authority decides that any term of this DPA is held to be invalid, unlawful, or unenforceable to any extent, such term will, to that extent only, be severed from the remaining terms, which will continue to be valid to the fullest extent permitted by law.

10.7 Entire Understanding. This DPA and the Agreement set forth the entire understanding and agreement between the parties with respect to the subject matter hereof.

SCHEDULE 1: DETAILS OF PROCESSING

This Schedule 1 describes the Processing for each Service and completes Annex I.B of the EU SCCs where applicable. Only the rows for Services Customer has ordered apply.

Parties (Annex I.A)

Data exporter / Controller: Customer, as identified in the Agreement or Order Form; contact details as stated there. Data importer / Processor: Axiad IDS, Inc., 101 Metro Drive, Suite 560, San Jose, CA 95110; privacy@axiad.com.

Description of Processing (Annex I.B)

Competent Supervisory Authority (Annex I.C)

Determined in accordance with Clause 13 of the EU SCCs as set out in Section 7.2 of this DPA.

SCHEDULE 2: TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

The technical and organizational measures Axiad maintains to protect Personal Data are those set out in Exhibit 2 to the Agreement (Information Security), which is incorporated into this Schedule 2 by reference and completes Annex II of the EU SCCs where applicable. Measures specific to biometric data under Axiad Confirm are set out in Section 3.5 of this DPA and Section C.6 of the Agreement.