Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the Terms of Service (the "Agreement") entered into by and between Customer (as defined in the Agreement) and Cachd.App, Inc., a Delaware corporation ("Provider", "we", "us", or "our").

This DPA applies when Customer uses the hosted service and Provider processes Customer Personal Data on Customer's documented instructions. Customer enters into this DPA on behalf of itself and, where applicable, its Affiliates. Provider acts as an independent controller for personal data it processes for its own business purposes, including managing Customer's contract and subscription, billing Customer, answering direct inquiries about Provider's own products, service security, and legal compliance. A data field is Customer Personal Data when Provider processes it on Customer's documented instructions, even if the same type of data is also used for Provider's own purposes. This DPA does not cover Provider's own billing and business records, or a self-hosted instance. Terms not defined in this DPA have the meanings given in the Agreement.

1. Definitions

• "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity.
• "Authorized Sub-Processor" means a third-party engaged by Provider who has a need to access Customer Personal Data to enable us to perform our obligations under this DPA or the Agreement, and identified under Section 3.
• "Customer Personal Data" means Personal Data that Customer or its Users provide to the Services, or that Provider generates through Customer's use of the Services, to the extent Provider processes it on Customer's documented instructions. It excludes data Provider processes solely for its own purposes as a controller under the Privacy Policy.
• "Data Protection Laws" means any applicable laws and regulations relating to the use or processing of Personal Data, including: (i) the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"), (ii) the UK GDPR and Data Protection Act 2018, and (iii) the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), in each case as updated, amended or replaced from time to time.
• "Data Subject" means an identified or identifiable natural person whose Personal Data is processed.
• "Personal Data Breach" means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
• "Services" means the hosted Cloud Service and related services provided by Provider under the Agreement.

2. Relationship of the Parties; Processing of Data

For Customer Personal Data processed on Customer's behalf, Customer acts as the controller or processor, as applicable, and Provider acts as the processor or sub-processor. Customer is responsible for the lawfulness of its instructions and for giving any required notices to data subjects.

Provider will process Customer Personal Data only on Customer's documented instructions, including instructions about international transfers, and only to provide the Services described in Exhibit A, unless the law to which Provider is subject requires other processing. In that case, Provider will inform Customer of that legal requirement before processing unless the law prohibits the notice on important grounds of public interest. If Provider believes an instruction violates Data Protection Laws, it will inform Customer unless the law prohibits that notice.

Provider will ensure that people authorized to process Customer Personal Data are bound by confidentiality obligations. Provider will not use Customer Personal Data to train, fine-tune, or improve generalized AI or machine learning models. AI providers may process Customer Personal Data only as needed to provide an AI feature requested by Customer or its Users.

At the end of the Services, Provider will, at Customer's choice, return or delete Customer Personal Data within 60 days, unless applicable law requires its retention. Copies held in routine backups will remain protected under this DPA and be deleted under the applicable backup retention schedule.

Where the CCPA applies and Provider acts as a service provider or contractor, Provider will not sell or share Customer Personal Data, or retain, use, or disclose it outside the specified business purposes and direct business relationship, except as permitted by the CCPA. Provider will not combine Customer Personal Data with information from other sources except as permitted by that law.

3. Authorized Sub-Processors

Customer gives Provider general written authorization to engage only sub-processors identified by legal entity, processing location, and purpose in Exhibit B or in a written schedule provided to Customer. A provider category or trade name alone does not identify an authorized sub-processor. Provider will give Customer the current schedule when Customer accepts this DPA, and the sub-processors listed in that schedule are authorized as of acceptance, subject to Customer's right to object under this Section.

Provider will update the applicable schedule and notify Customer of any new or replacement sub-processor at least fifteen (15) days before giving it access to Customer Personal Data. Customer may object in writing on reasonable data protection grounds to a sub-processor in the initial schedule or a new or replacement sub-processor within ten (10) days of receiving the applicable schedule or notice. If Customer does not object within that period, the sub-processor is authorized under this general authorization. Provider will not give a new or replacement sub-processor access while a timely objection remains unresolved. If the parties cannot resolve a reasonable objection, either party may terminate the affected Services by written notice.

Provider will enter into written agreements with all sub-processors imposing data protection obligations that protect Customer Personal Data to a standard no less protective than this DPA. Provider remains responsible to Customer for each sub-processor's performance of those obligations.

4. Security of Personal Data

Taking into account the state of the art, the costs of implementation, and the risk of varying likelihood and severity for the rights and freedoms of natural persons, Provider shall maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing Customer Personal Data.

Exhibit C describes the application-level measures implemented by the hosted service. Hosting, database, backup, and encryption-at-rest controls depend on the infrastructure provider and production configuration. We will provide the current infrastructure details and available security information on written request.

5. Transfers of Personal Data

Provider and its sub-processors may process Customer Personal Data in the United States and other countries where the hosted service and its providers operate.

Where Data Protection Laws require an additional transfer safeguard, the parties will put the applicable safeguard in place before the transfer. This may include the EU Standard Contractual Clauses with the correct module and completed appendices, or the UK International Data Transfer Agreement or Addendum with its required tables completed. The parties will also complete any transfer risk assessment and add any safeguards required by law. This DPA does not incorporate blank transfer documents or treat them as completed. Provider will make the applicable transfer documents and information available on request.

6. Rights of Data Subjects

Provider shall, to the extent permitted by law, notify Customer if it receives a request from a Data Subject to exercise their rights of access, rectification, erasure, portability, restriction, or objection. Provider will advise the Data Subject to submit their request directly to Customer, and Customer will remain responsible for responding.

Taking into account the nature of processing, Provider will assist Customer with appropriate technical and organizational measures to fulfill Customer's obligations to respond to Data Subject requests.

Taking into account the nature of processing and information available to Provider, Provider will also assist Customer with its obligations concerning security, Personal Data Breaches, data protection impact assessments, and prior consultation with supervisory authorities.

7. Audits and Inspections

Provider shall maintain records sufficient to demonstrate compliance with its obligations under this DPA.

Upon Customer's written request, Provider will make information reasonably necessary to demonstrate compliance available to Customer. Customer may audit Provider's processing of Customer Personal Data, including through a qualified auditor, at reasonable intervals and after reasonable notice. Audits are subject to confidentiality obligations and must not unreasonably disrupt the Services or Provider's operations.

In the event of a Personal Data Breach, Provider shall notify Customer without undue delay after becoming aware of the breach. Provider will share the information available to it that Customer reasonably needs to meet its legal obligations, cooperate in the investigation, and take reasonable steps to contain and remediate the breach.

8. Conflict

In the event of any conflict or inconsistency between the Terms of Service, this DPA, and any executed transfer safeguard, the executed transfer safeguard controls for the transfer it covers, followed by this DPA, then the Terms of Service.

Exhibit A: Details of Processing

Exhibit B: Sub-Processor Schedule

The hosted service can use the providers and provider categories below when the related feature is enabled. This table does not identify every provider's legal entity or processing location. Provider will give Customer the current written schedule with those details and each provider's purpose when Customer accepts this DPA, and will update it under Section 3 before a new or replacement provider accesses Customer Personal Data. Only the providers identified in the current schedule are authorized under Section 3. Contact notices@cachd.app for the current production provider names and processing locations.

Exhibit C: Technical and Organizational Security Measures