CONVEX DATA PROCESSING ADDENDUM

Last Updated: March 2, 2022

This Data Processing Addendum (including its Exhibits) (“Addendum”) forms part of and supplements our Terms of Service and any and all agreements covering the Services (collectively, the “Agreement”) by and between you (“Customer”) and Convex Systems, Inc. (“Service Provider”).

1. Subject Matter and Duration.

a) Subject Matter. This Addendum reflects the parties’ commitment to abide by Data Protection Laws concerning the Processing of Customer Personal Data in connection with Service Provider’s execution of the Agreement. All capitalized terms that are not expressly defined in this Addendum will have the meanings given to them in the Agreement. If and to the extent language in this Addendum or any of its Exhibits conflicts with the Agreement, this Addendum shall control.

b) Duration and Survival. This Addendum will become legally binding upon the effective date of the Agreement or upon the date that the parties execute Addendum if it is completed after the effective date of the Agreement. Service Provider will Process Customer Personal Data until the relationship terminates as specified in the Agreement.

2. Definitions.

For the purposes of this Addendum, the following terms and those defined within the body of this Addendum apply.

a) “Customer Personal Data” means Personal Data Processed by Service Provider on behalf of Customer.

b) “Data Protection Laws” means the applicable data privacy, data protection, and cybersecurity laws, rules and regulations to which the Customer Personal Data are subject. “Data Protection Laws” may include, but are not limited to, the California Consumer Privacy Act of 2018 (“CCPA”); the EU General Data Protection Regulation 2016/679 (“GDPR”) and its respective national implementing legislations; the Swiss Federal Act on Data Protection; the United Kingdom General Data Protection Regulation; and the United Kingdom Data Protection Act 2018 (in each case, as amended, adopted, or superseded from time to time).

c) “Personal Data” has the meaning assigned to the term “personal data” or “personal information” under applicable Data Protection Laws.

d) “Process” or “Processing” means any operation or set of operations which is performed on Personal Data or sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.

e) “Security Incident(s)” means the breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data attributable to Service Provider.

f) “Services” means the services that Service Provider performs under the Agreement.

g) “Subprocessor(s)” means Service Provider’s authorized vendors and third party service providers that Process Customer Personal Data.

3. Processing Terms for Customer Personal Data.

a) Documented Instructions. Service Provider shall Process Customer Personal Data to provide the Services in accordance with the Agreement, this Addendum, any applicable Statement of Work, and any instructions agreed upon by the parties. Service Provider will, unless legally prohibited from doing so, inform Customer in writing if it reasonably believes that there is a conflict between Customer’s instructions and applicable law or otherwise seeks to Process Customer Personal Data in a manner that is inconsistent with Customer’s instructions.

b) Authorization to Use Subprocessors. To the extent necessary to fulfill Service Provider’s contractual obligations under the Agreement, Customer hereby authorizes Service Provider to engage Subprocessors. A current list of Service Provider’s Subprocessors can be found at: https://convex.dev/legal/subprocessors. Customer hereby acknowledges and agrees that Service Provider’s use of such Subprocessors satisfies the requirements of this Addendum.

c) Service Provider and Subprocessor Compliance. Service Provider shall (i) enter into a written agreement with Subprocessors regarding such Subprocessors’ Processing of Customer Personal Data that imposes on such Subprocessors data protection requirements for Customer Personal Data that are consistent with this Addendum; and (ii) remain responsible to Customer for Service Provider’s Subprocessors’ failure to perform their obligations with respect to the Processing of Customer Personal Data.

d) Right to Object to Subprocessors. Where required by Data Protection Laws, Service Provider will notify Customer by updating its website at: https://convex.dev/legal/subprocessors. If Customer raises a legitimate objection to the appointment of any new Subprocessor within ten (10) days of such notice being posted on Service Provider’s website, the parties will work together in good faith to resolve the grounds for the objection.

e) Confidentiality. Any person authorized to Process Customer Personal Data must contractually agree to maintain the confidentiality of such information or be under an appropriate statutory obligation of confidentiality.

f) Personal Data Inquiries and Requests. Where required by Data Protection Laws, Service Provider agrees to provide reasonable assistance and comply with reasonable instructions from Customer related to any requests from individuals exercising their rights in Customer Personal Data granted to them under Data Protection Laws.

g) Sale of Customer Personal Data Prohibited. Service Provider shall not sell Customer Personal Data as the term "sell" is defined by the CCPA.

h) Data Protection Impact Assessment and Prior Consultation. Where required by Data Protection Laws, Service Provider agrees to provide reasonable assistance at Customer’s expense to Customer where, in Customer’s judgement, the type of Processing performed by Service Provider requires a data protection impact assessment and/or prior consultation with the relevant data protection authorities.

i) Demonstrable Compliance. Service Provider agrees to provide information reasonably necessary to demonstrate compliance with this Addendum upon Customer’s reasonable request.

j) Service Optimization. Where permitted by Data Protection Laws, Service Provider may Process Customer Personal Data: (i) for its internal uses to build or improve the quality of its services; (ii) to detect Security Incidents; and (iii) to protect against fraudulent or illegal activity.

k) Aggregation and De-Identification. Service Provider may: (i) compile aggregated and/or de-identified information in connection with providing the Services provided that such information cannot reasonably be used to identify Customer or any data subject to whom Customer Personal Data relates (“Aggregated and/or De-Identified Data”); and (ii) use Aggregated and/or De-Identified Data for its lawful business purposes.

4. Information Security Program.

a) Security Measures. Service Provider shall use commercially reasonable efforts to implement and maintain reasonable administrative, technical, and physical safeguards designed to protect Customer Personal Data.

5. Security Incidents.

a) Notice. Upon becoming aware of a Security Incident, Service Provider agrees to provide written notice without undue delay and within the time frame required under Data Protection Laws to Customer’s Designated POC. Where possible, such notice will include all available details required under Data Protection Laws for Customer to comply with its own notification obligations to regulatory authorities or individuals affected by the Security Incident.

6. Cross-Border Transfers of Customer Personal Data.

a) Cross-Border Transfers of Customer Personal Data. Customer authorizes Service Provider and its Subprocessors to transfer Customer Personal Data across international borders, including from the European Economic Area, Switzerland, and/or the United Kingdom to the United States.

b) Data Transfer Impact Assessment Questionnaire. Service Provider agrees that it has provided true, complete, and accurate responses to the Data Transfer Impact Assessment Questionnaire attached hereto as Exhibit A.

c) EEA, Swiss, and UK Standard Contractual Clauses. If Customer Personal Data originating in the European Economic Area, Switzerland, and/or the United Kingdom is transferred by Customer to Service Provider in a country that has not been found to provide an adequate level of protection under applicable Data Protection Laws, the parties agree that the transfer shall be governed by the Controller to Processor Standard Contractual Clauses (Module Two) provided by the European Commission pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (“Controller to Processor Standard Contractual Clauses”), as supplemented by Exhibit B attached hereto, the terms of which are incorporated herein by reference. Each party’s execution of the Agreement shall be considered a signature to the Standard Contractual Clauses to the extent that the Standard Contractual Clauses apply hereunder.

d) Data Transfer Impact Assessment Outcome. Taking into account the information and obligations set forth in this Addendum and, as may be the case for a party, such party’s independent research, to the parties’ knowledge, the Customer Personal Data originating in the European Economic Area, Switzerland, and/or the United Kingdom that is transferred pursuant to the attached Standard Contractual Clauses to a country that has not been found to provide an adequate level of protection under applicable Data Protection Laws is afforded a level of protection that is essentially equivalent to that guaranteed by applicable Data Protection Laws.

7. Audits.

a) Customer Audit. Where Data Protection Laws afford Customer an audit right, Customer (or its appointed representative) may carry out an audit of Service Provider’s policies, procedures, and records relevant to the Processing of Customer Personal Data. Any audit must be: (i) conducted during Service Provider’s regular business hours; (ii) with reasonable advance notice to Service Provider; (iii) carried out in a manner that prevents unnecessary disruption to Service Provider’s operations; and (iv) subject to reasonable confidentiality procedures. In addition, any audit shall be limited to once per year, unless an audit is carried out at the direction of a government authority having proper jurisdiction.

8. Customer Personal Data Deletion.

a) Data Deletion. At the expiry or termination of the Agreement, Service Provider will delete all Customer Personal Data (excluding any back-up or archival copies which shall be deleted in accordance with Service Provider’s data retention schedule), except where Service Provider is required to retain copies under applicable laws, in which case Service Provider will isolate and protect that Customer Personal Data from any further Processing except to the extent required by applicable laws.

9. Customer’s Obligations. Customer represents and warrants that: (i) it has complied and will comply with Data Protection Laws; (ii) it has provided data subjects whose Customer Personal Data will be Processed in connection with the Agreement with a privacy notice or similar document that clearly and accurately describes Customer’s practices with respect to the Processing of Customer Personal Data; (iii) it has obtained and will obtain and continue to have, during the term, all necessary rights, lawful bases, authorizations, consents, and licenses for the Processing of Customer Personal Data as contemplated by the Agreement; and (iv) Service Provider’s Processing of Customer Personal Data in accordance with the Agreement will not violate Data Protection Laws or cause a breach of any agreement or obligations between Customer and any third party.

10. Processing Details.

a) Subject Matter. The subject matter of the Processing is the Services pursuant to the Agreement.

b) Duration. The Processing will continue until the expiration or termination of the Agreement.

c) Categories of Data Subjects. Data subjects whose Customer Personal Data will be Processed pursuant to the Agreement.

d) Nature and Purpose of the Processing. The purpose of the Processing of Customer Personal Data by Service Provider is the performance of the Services.

e) Types of Customer Personal Data. Customer Personal Data that is Processed pursuant to the Agreement.

11. Contact Information. Contact information for the Service Provider’s designated point of contact for urgent and security issues:

Convex Systems, Inc.

Jamie Turner

CEO

548 Market St

PMB 73135

San Francisco, California 94104-5401 US

privacy@convex.dev

EXHIBIT A TO THE DATA PROCESSING ADDENDUM

DATA TRANSFER IMPACT ASSESSMENT QUESTIONNAIRE

This Exhibit A forms part of the Addendum. Capitalized terms not defined in this Exhibit A have the meaning set forth in the Addendum.

1. What countries will Customer Personal Data that is transferred outside of the European Economic Area, Switzerland, and/or the United Kingdom be stored in or accessed from? If this varies by region, please specify each country for each region.

a. Answer: United States of America.

2. What are the categories of data subjects whose Customer Personal Data will be transferred outside of the European Economic Area, Switzerland, and/or the United Kingdom?

a. Answer: Data subjects shall include Customer’s employees, contractors, and end users who engage with Customer’s applications using Service Provider’s Services.

3. What are the categories of Customer Personal Data transferred outside of the European Economic Area, Switzerland, and/or the United Kingdom?

a. Answer: Varies based on the data collected by Customer and processed by Service Provider, but could potentially include personal data.

4. Will any Customer Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences be transferred outside of the European Economic Area, Switzerland, and/or the United Kingdom? If so, are there any restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures?

a. Answer: This data could be collected by Customers via their user-facing applications and transferred to Service Provider for processing. Such data would be governed by Customer’s privacy policies.

5. What business sector is Service Provider involved in?

a. Answer: Software application development.

6. Broadly speaking, what are the services to be provided and the corresponding purposes for which Customer Personal Data is transferred outside of the European Economic Area, Switzerland, and/or the United Kingdom?

a. Answer: Information is transferred to facilitate the provision of the platform and Services.

7. What is the frequency of the transfer of Customer Personal Data outside of outside of the European Economic Area, Switzerland, and/or the United Kingdom? E.g., is Customer Personal Data transferred on a one-off or continuous basis?

a. Answer: Continuous.

8. When Customer Personal Data is transferred outside of the European Economic Area, Switzerland, and/or the United Kingdom to Service Provider, how is it transmitted to Service Provider? Is the Customer Personal Data in plain text, pseudonymized, and/or encrypted?

a. Answer: Personal Data is transferred and made available to Data Controller directly through the Services, accessible only to Data Controller’s authorized users.

9. What is the period for which the Customer Personal Data will be retained, or, if that is not possible, the criteria used to determine that period?

a. Answer: Customer Personal Data will be retained in accordance with the Addendum.

10. Please list the Subprocessors that will have access to Customer Personal Data that is transferred outside of the European Economic Area, Switzerland, and/or the United Kingdom:

a. Answer: As described in https://convex.dev/legal/subprocessors.

11. Is Service Provider subject to any laws in a country outside of the European Economic Area, Switzerland, and/or the United Kingdom where Customer Personal Data is stored or accessed from that would interfere with Service Provider fulfilling its obligations under the attached Standard Contractual Clauses? For example, FISA Section 702. If yes, please list these laws.

a. Answer: As of the effective date of the Agreement, no court has found Data Controller to be eligible to receive process issued under the laws contemplated by Question 10, including FISA Section 702 and no such court action is pending.

12. Has Service Provider ever received a request from public authorities for information pursuant to the laws contemplated by Question 11 above (if any)? If yes, please explain.

a. Answer: No.

13. Has Service Provider ever received a request from public authorities for Personal Data of individuals located in European Economic Area, Switzerland, and/or the United Kingdom? If yes, please explain.

a. Answer: No.

14. What safeguards will Service Provider apply during transmission and to the processing of Customer Personal Data in countries outside of the European Economic Area, Switzerland, and/or the United Kingdom that have not been found to provide an adequate level of protection under applicable Data Protection Laws?

a. Answer: Those safeguards set forth in the Addendum.

EXHIBIT B TO THE DATA PROCESSING ADDENDUM

ADDITIONAL TERMS FOR THE CONTROLLER TO PROCESSOR
STANDARD CONTRACTUAL CLAUSES (MODULE TWO)

This Exhibit B forms part of the Data Processing Addendum. Capitalized terms not defined in this Exhibit B have the meaning set forth in the Data Processing Agreement.

The Parties agree that the following terms will supplement the Controller to Processor Standard Contractual Clauses (Module Two):

1. Swiss Transfers. The following text is added as a new Clause 1(e): To the extent applicable hereunder, these Clauses also apply mutatis mutandis to the Parties’ processing of personal data that is subject to the Swiss Federal Act on Data Protection. Where applicable, references to EU Member State law or EU supervisory authorities shall be modified to include the appropriate reference under Swiss law as it relates to transfers of personal data that are subject to the Swiss Federal Act on Data Protection.

2. UK Transfers. The following text is added as a new Clause 1(f): To the extent applicable hereunder, these Clauses, as supplemented by Annex III, also apply mutatis mutandis to the Parties’ processing of personal data that is subject to the UK Data Protection Laws (as defined in Annex III).

3. Docking Clause. The text of Clause 7 is deleted in its entirety and replaced with the following: Omitted.

4. Subprocessors. Clause 9(a) shall read as follows:

(a) The data importer has the data exporter’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least ten (10) days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object.

5. Supervision. Clause 13(a) shall read as follows:

(b) Where the data exporter is established in an EU Member State, the following section applies: The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.

Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679, the following section applies: The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.

Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679, the following section applies: The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.

6. Governing Law. Clause 17 shall read as follows: These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.

7. Choice of Forum and Jurisdiction Law. Clause 18(b) shall read as follows: (b) The Parties agree that those shall be the courts of Ireland.

8. Annex I. Annex I shall read as follows:

A. List of Parties

Data Exporter:

Name: As set forth under the applicable Customer’s account.

Address: As set forth under the applicable Customer’s account.

Contact person’s name, position, and contact details: As set forth under the applicable Customer’s account.

Activities relevant to the data transferred under these Clauses: As set forth in Exhibit A of the Addendum.

Role: Controller.

Data Importer:

Name: Service Provider.

Address: As set forth in the Addendum.

Contact person’s name, position, and contact details: As set forth in the Addendum.

Activities relevant to the data transferred under these Clauses: As set forth in Exhibit A of the Adendum.

Role: Processor.

B. Description of the Transfer

As set forth in Exhibit A of the Addendum. (For clarity, each response required in Annex I, Section B shall be populated with the foregoing.)

C. Competent Supervisory Authority

The supervisory authority mandated by Clause 13. If no supervisory authority is mandated by Clause 13, then the Irish Data Protection Commission (DPC), and if this is not possible, then as otherwise agreed by the parties consistent with the conditions set forth in Clause 13.

9. Annex II. Annex II shall read as follows: Data importer shall implement and maintain appropriate technical and organisational measures designed to protect personal data in accordance the Addendum. Pursuant to Clause 10(b), data importer will provide data exporter assistance with data subject requests in accordance with the Addendum.

10. Annex III. A new Annex III shall be inserted, which reads:

Standard Data Protection Clauses to be issued by the Commissioner under S119A(1) Data Protection Act 2018

UK Addendum to the EU Commission Standard Contractual Clauses

Date of this Addendum:

1. The Clauses are dated as of the same date as the Addendum.

Background:

2. The Information Commissioner considers this Addendum provides appropriate safeguards for the purposes of transfers of personal data to a third country or an international organisation in reliance on Articles 46 of the UK GDPR and, with respect to data transfers from controllers to processors and/or processors to processors. This Addendum forms part of and supplements the Clauses to which it is attached. If personal data originating in the United Kingdom is transferred by data exporter to data importer in a country that has not been found to provide an adequate level of protection under UK Data Protection Laws, the Parties agree that the transfer shall be governed by the Clauses as supplemented by this Addendum.

Interpretation of this Addendum

3. Where this Addendum uses terms that are defined in the Annex those terms shall have the same meaning as in the Annex. In addition, the following terms have the following meanings:

This Addendum	This UK Addendum to the EU Commission Standard Contractual Clauses.
The Annex	The Standard Contractual Clauses set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
UK Data Protection Laws	All laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018.
UK GDPR	The United Kingdom General Data Protection Regulation, as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.
UK	The United Kingdom of Great Britain and Northern Ireland.

4. This Addendum shall be read and interpreted in the light of the provisions of UK Data Protection Laws, and so that if fulfils the intention for it to provide the appropriate safeguards as required by Article 46 UK GDPR.

5. This Addendum shall not be interpreted in a way that conflicts with rights and obligations provided for in UK Data Protection Laws.

6. Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Addendum has been entered into.

Hierarchy

7. In the event of a conflict or inconsistency between this Addendum and the provisions of the Clauses or other related agreements between the Parties, existing at the time this Addendum is agreed or entered into thereafter, the provisions which provide the most protection to data subjects shall prevail.

Incorporation of the Clauses

8. This Addendum incorporates the Clauses which are deemed to be amended to the extent necessary so they operate:

a. for transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s processing when making that transfer; and

b. to provide appropriate safeguards for the transfers in accordance with Articles 46 of the UK GDPR Laws.

9. The amendments required by Section 8 above, include (without limitation):

c. References to the “Clauses” means this Addendum as it incorporates the Clauses.

d. Clause 6 Description of the transfer(s) is replaced with:

“The details of the transfers(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply to the data exporter’s processing when making that transfer.”

e. References to “Regulation (EU) 2016/679” or “that Regulation” are replaced by “UK Data Protection Laws” and references to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK Data Protection Laws.

f. References to Regulation (EU) 2018/1725 are removed.

g. References to the “Union”, “EU” and “EU Member State” are all replaced with “UK.”

h. Clause 13(a) and Part C of Annex II are not used; the “competent supervisory authority” is the Information Commissioner.

i. Clause 17 is replaced to state “These Clauses are governed by the laws of England and Wales.”

j. Clause 18 is replaced to state:

“Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”

10. Clarifying Terms. The Parties agree that: (i) the certification of deletion required by Clause 8.5 and Clause 16(d) of the Controller to Processor Standard Contractual Clauses will be provided upon Data Controller’s written request; (ii) the measures Data Processor is required to take under Clause 8.2(a) of the Controller to Processor Standard Contractual Clauses will only cover Data Processor’s impacted systems; (iii) the notice of new subprocessors required under Clause 9(a) shall be delivered in accordance with Section 3(d) of the Addendum; (iv) the termination right contemplated by Clause 14(f) and Clause 16(c) of the Controller to Processor Standard Contractual Clauses will be limited to the termination of the Controller to Processor Standard Contractual Clauses, in which case, the corresponding Processing of Personal Data affected by such termination shall be discontinued unless otherwise agreed by the parties; (v) unless otherwise stated by Data Processor, Data Controller will be responsible for communicating with data subjects pursuant to Clause 15.1(a) of the Controller to Processor Standard Contractual Clauses; (vi) the information required under Clause 15.1(c) will be provided upon Data Controller’s written request; (vii) the audit described in Clause 8.9 of the Controller to Processor Standard Contractual Clauses shall be carried out in accordance with Section 6 of the Data Processing Agreement; (viii) Data Processor may engage Sub-Processors using European Commission Decision C(2010)593 Standard Contractual Clauses for Controllers to Processors or any other adequacy mechanism, provided that such adequacy mechanism complies with applicable data protection laws and such use of Sub-Processors shall not be considered a breach of Clause 9 of the Controller to Processor Standard Contractual Clauses; and (ix) notwithstanding anything to the contrary, Data Controller will reimburse Data Processor for all costs and expenses incurred by Data Processor in connection with the performance of Data Processor’s obligations under Clause 15.1(b) and Clause 15.2 of the Controller to Processor Standard Contractual Clauses without regard for any limitation of liability set forth in the Agreement.