1.1. Subject Matter. This Addendum reflects the parties' commitment to abide by Data Protection Laws concerning the Processing of Customer Personal Data in connection with Convex's execution of the Agreement. All capitalized terms that are not expressly defined in this Addendum will have the meanings given to them in the Agreement. If and to the extent language in this Addendum or any of its Exhibits conflicts with the Agreement, this Addendum shall control.

1.2. Duration and Survival. This Addendum will become legally binding upon the effective date of the Agreement Convex will Process Customer Personal Data until the relationship terminates as specified in the Agreement, subject to the exception in section 8 of this Addendum.

2.1. "Customer Personal Data" means Personal Data Processed by Convex on behalf of Customer.

2.2. "Data Protection Laws" means the applicable data privacy, data protection, and cybersecurity laws, rules and regulations to which the Customer Personal Data are subject. "Data Protection Laws" may include, but are not limited to, the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act) ("CCPA"); the EU General Data Protection Regulation 2016/679 ("GDPR") and its respective national implementing legislations; the Swiss Federal Act on Data Protection ("FADP"); the United Kingdom General Data Protection Regulation meaning the GDPR as it is transposed into the legislation of the United Kingdom ("UK GDPR"); the United Kingdom Data Protection Act 2018; and the Virginia Consumer Data Protection Act (in each case, as amended, adopted, or superseded from time to time).

2.3. "Personal Data" has the meaning assigned to the term "personal data" or "personal information" under applicable Data Protection Laws.

2.4. "Process" or "Processing" means any operation or set of operations which is performed on Personal Data or sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.

2.5. "Security Incident(s)" means the breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data attributable to Convex.

2.6. "Services" means the services that Convex performs under the Agreement.

2.7. "Subprocessor(s)" means Convex' authorized vendors and third parties that Process Customer Personal Data.

3.1. Data roles. Each of Customer and Convex acknowledges and agrees that in respect of Customer Personal Data, Customer is a "controller" or "business" and Convex is a "processor" or "service provider" as applicable.

3.2. Documented Instructions. Convex shall Process Customer Personal Data to provide the Services in accordance with the Agreement, this Addendum, any applicable Statement of Work, and any instructions agreed upon by the parties. Convex will, unless legally prohibited from doing so, inform Customer in writing if it reasonably believes that there is a conflict between Customer's instructions and applicable law.

3.3. Authorization to Use Subprocessors. To the extent necessary to fulfill Convex's contractual obligations under the Agreement, Customer hereby authorizes Convex to engage Subprocessors. A current list of Convex's Subprocessors can be found at: https://convex.dev/legal/subprocessors. Customer acknowledges that Subprocessors may further engage vendors.

3.4. Convex and Subprocessor Compliance. Convex shall (i) enter into a written agreement with Subprocessors regarding such Subprocessors' Processing of Customer Personal Data that imposes on such Subprocessors data protection requirements for Customer Personal Data that are consistent with this Addendum; and (ii) remain responsible to Customer for Convex Subprocessors' failure to perform their obligations with respect to the Processing of Customer Personal Data.

3.5. Right to Object to Subprocessors. Where required by Data Protection Laws, Convex will notify Customer about engaging any new Subprocessors that Process Customer Personal Data to the email address associated with Customer's account with Convex. Customer may raise reasonable objections to the new Subprocessor within ten (10) days of the notification. If Customer has legitimate objections to the appointment of any new Subprocessor, the parties will work together in good faith to resolve the grounds for the objection.

3.6. Confidentiality. Any person authorized to Process Customer Personal Data must be subject to a duty of confidentiality, contractually agree to maintain the confidentiality of such information, or be under an appropriate statutory obligation of confidentiality.

3.7. Personal Data Inquiries and Requests. Where required by Data Protection Laws, Convex agrees to provide reasonable assistance and comply with reasonable instructions from Customer related to any requests from individuals exercising their rights in Customer Personal Data granted to them under Data Protection Laws.

3.8. Data Protection Assessment, Data Protection Impact Assessment, and Prior Consultation. Where required by Data Protection Laws, Convex agrees to provide reasonable assistance and information to Customer where, in Customer's judgement, the type of Processing performed by Convex requires a data protection impact assessment, and/or prior consultation with the relevant data protection authorities. Customer shall reimburse Convex for all non-negligible costs Convex incurs in performing its obligations under this Section.

3.9. Demonstrable Compliance. Convex agrees to provide information reasonably necessary to demonstrate compliance with this Addendum upon Customer's reasonable request.

3.10. California Specific Terms. To the extent that Convex's Processing of Customer Personal Data is subject to the CCPA, this Section shall also apply. Customer discloses or otherwise makes available Customer Personal Data to Convex for the limited and specific purpose of Convex providing the Services to Customer in accordance with the Agreement and this Addendum. Convex shall: (i) comply with its applicable obligations under the CCPA; (ii) provide the same level of protection as required under the CCPA; (iii) notify Customer if it can no longer meet its obligations under the CCPA; (iv) not "sell" or "share" (as such terms are defined by the CCPA) Customer Personal Data; (v) not retain, use, or disclose Customer Personal Data for any purpose (including any commercial purpose) other than to provide the Services under the Agreement or as otherwise permitted under the CCPA; (vi) not retain, use, or disclose Customer Personal Data outside of the direct business relationship between Customer and Convex; and (vii) unless otherwise permitted by the CCPA, not combine Customer Personal Data with Personal Data that Convex (a) receives from, or on behalf of, another person, or (b) collects from its own, independent consumer interaction. Customer may: (1) take reasonable and appropriate steps agreed upon by the parties to help ensure that Convex Processes Customer Personal Data in a manner consistent with Customer's CCPA obligations; and (2) upon notice, take reasonable and appropriate steps agreed upon by the parties to stop and remediate unauthorized Processing of Customer Personal Data by Convex.

3.11. Service Optimization. Customer agrees that Convex may: (i) compile aggregated and/or de-identified information which may include Customer Personal Data in connection with providing the Services provided that such information cannot reasonably be used to identify Customer or any data subject to whom Customer Personal Data relates ("Aggregated and/or De-Identified Data"); and (ii) use Aggregated and/or De-Identified Data for its lawful business purposes.

6.1. Cross-Border Transfers of Customer Personal Data. Customer authorizes Convex and its Subprocessors to transfer Customer Personal Data across international borders, including from the European Economic Area, Switzerland, and/or the United Kingdom to the United States.

6.2. EEA, Swiss, and UK Standard Contractual Clauses. If Customer Personal Data originating in the European Economic Area, Switzerland, and/or the United Kingdom is transferred by Customer to Convex in a country that has not been found to provide an adequate level of protection under applicable Data Protection Laws, the parties agree that the transfer shall be governed by Module Two's obligations in the Annex to the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council ("Standard Contractual Clauses") as supplemented by Exhibit A attached hereto, the terms of which are incorporated herein by reference. You agree that the Standard Contractual Clauses, as supplemented, are incorporated by reference and form part of the Agreement. The parties each agree that the execution of the Agreement shall be deemed execution of the Standard Contractual Clauses to the extent that the Standard Contractual Clauses apply hereunder.

10.1. Subject Matter. The subject matter of the Processing is the Services pursuant to the Agreement.

10.2. Duration. The Processing will continue until the expiration or termination of the Agreement.

10.3. Categories of data subjects. As determined by the Customer but may include Customer employees, contractors, and end users who engage with Customer's applications using Convex's Services .

10.4. Nature and Purpose of the Processing. The purpose of the Processing of Customer Personal Data by Convex is the performance of the Services.

10.5. Types of Customer Personal Data. As determined by the Customer by its use of the Services, but may include name, email address and password of the data subjects.

A. List of Parties

Data Exporter: Customer.

Address: As set forth under the applicable Customer's account.

Contact person's name, position, and contact details: Customer's Designated POC.

Activities relevant to the data transferred under these Clauses: The Services.

Role: Controller.

Data Importer: Convex.

Address: As set forth in the Addendum.

Contact person's name, position, and contact details: Convex's Designated POC.

Activities relevant to the data transferred under these Clauses: The Services.

Role: Processor.

B. Description of the Transfer:

Categories of data subjects whose personal data is transferred: The categories of data subjects whose personal data is transferred under the Standard Contractual Clauses including, but not limited to, Customer's employees, contractors, and end users who engage with Customer's applications using Convex's Services.

Categories of personal data transferred: As determined by the Customer by its use of the Services, but may include name, email address and password of the data subjects.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

As determined by the Customer by its use of the Services.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): Continuous for the duration of the Agreement.

Nature of the processing: The Services.

Purpose(s) of the data transfer and further processing: The Services.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: Data importer will retain personal data in accordance with the Addendum.

List of (sub-)processors including location and processing activity: https://convex.dev/legal/subprocessors

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: For the subject matter, nature and duration as identified above.

C. Competent Supervisory Authority: The supervisory authority mandated by Clause 13. If no supervisory authority is mandated by Clause 13, then the Irish Data Protection Commission (DPC), and if this is not possible, then as otherwise agreed by the parties consistent with the conditions set forth in Clause 13.

D. Additional Data Transfer Impact Assessment Questions:

Will data importer process any personal data under the Standard Contractual Clauses about a non-United States person that is "foreign intelligence information" as defined by 50 U.S.C. § 1801(e)? Not to data importer's knowledge.

Is data importer subject to any laws in a country outside of the European Economic Area, Switzerland, and/or the United Kingdom where personal data is stored or accessed from that would interfere with data importer fulfilling its obligations under the Standard Contractual Clauses? For example, FISA Section 702. If yes, please list these laws: As of the effective date of the Addendum, no court has found data importer to be eligible to receive process issued under the laws contemplated by this question, including FISA Section 702, and no such court action is pending.

Has data importer ever received a request from public authorities for information pursuant to the laws contemplated by the question above? If yes, please explain: No.

Has data importer ever received a request from public authorities for personal data of individuals located in European Economic Area, Switzerland, and/or the United Kingdom? If yes, please explain: No.

E. Data Transfer Impact Assessment Outcome: Taking into account the information and obligations set forth in the Addendum and, as may be the case for a party, such party's independent research, to the parties' knowledge, the Customer Personal Data originating in the European Economic Area, Switzerland, and/or the United Kingdom that is transferred pursuant to the Standard Contractual Clauses to a country that has not been found to provide an adequate level of protection under applicable data protection laws is afforded a level of protection that is essentially equivalent to that guaranteed by applicable data protection laws and no supplemental or additional measures are required.

F. Clarifying Terms: The parties agree that:

G. Requests for disclosure of Customer Personal Data

Convex shall notify Customer where it receives a request or demand from a governmental agency or judicial authority to disclose Customer Personal Daya, unless legally prohibited from doing so. In such case, Convex shall use reasonably commercial measures to direct the government agency or judicial authority to request or demand Customer Personal Data directly from the Customer.

H. For transfers of Customer Personal Data subject to the FADP:

The parties agree that where Customer Personal Data is subject to the FADP, the Standard Contractual Clauses also apply mutatis mutandis to the Parties' processing of such Customer Personal Data with the following modifications:

(i) any references to the GDPR shall refer to the FADP;

(ii) the term Member State must not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their habitual place of residence in accordance with Clause 18(c) of the Standard Contractual Clauses.

I. For transfer of Customer Personal Data subject to the UK GDPR and the Data Protection Act 2018

In respect of Customer Personal Data subject to the UK GDPR and the Data Protection Act 2018, the ("UK Addendum") is incorporated herein by reference.

Table 1: The start date in Table 1 is the effective date of this Addendum. All other information required by Table 1 is set forth in Annex I, Section A of the Standard Contractual Clauses.

Table 2: The UK Addendum forms part of the version of the Approved EU SCCs which this UK Addendum is appended to including the Appendix Information, effective as of the effective date of the Addendum.

Table 3: The information required by Table 3 is set forth in Annex I and II to the Standard Contractual Clauses.

Table 4: The parties agree that Importer may end the UK Addendum as set out in Section 19.