Data Processing Addendum

Effective November 15, 2026

This Data Processing Addendum ("DPA") forms part of the agreement between SuperTrace, Inc. ("Supertrace") and the Business Customer ("Customer") for the Services (the "Agreement"). It applies when Supertrace processes Customer Personal Data on Customer's behalf. If the DPA conflicts with the Agreement, the DPA controls for the processing of personal data.

1. Definitions

• "Customer Personal Data" means personal data in Customer Content that Supertrace processes on Customer's behalf.
• "Data Protection Laws" means all laws on personal data that apply to the processing, including:
  • the GDPR;
  • the UK GDPR and Data Protection Act 2018;
  • the Swiss FADP; and
  • U.S. state privacy laws such as the CCPA.
• "Controller", "processor", "data subject", "personal data breach" and "processing" have the meanings in the GDPR. "Controller" includes "business", and "processor" includes "service provider", under U.S. state law.

2. Roles and instructions

2.1 Roles. Customer is the controller, or a processor acting for its own controllers. Supertrace is a processor.

2.2 Instructions. Supertrace processes Customer Personal Data only on Customer's documented instructions. The Agreement, this DPA, and Customer's use and configuration of the Services make up those instructions. If Supertrace believes an instruction violates Data Protection Laws, it will tell Customer.

2.3 Customer's responsibilities. Customer is responsible for having a lawful basis and giving required notices for the personal data it brings into the Services. This includes personal data in device output, tickets and integration data.

3. Supertrace's obligations

3.1 Purpose limitation and no training. Supertrace will not:

• process Customer Personal Data for any purpose other than providing, supporting and improving the Services;
• use Customer Personal Data to train or fine-tune AI models; or
• sell or share Customer Personal Data, as those terms are defined in the CCPA.

Supertrace will not combine it with personal data from other sources, except as Data Protection Laws allow for service providers.

3.2 Confidentiality. Everyone Supertrace authorizes to process Customer Personal Data is bound by confidentiality obligations.

3.3 Security. Supertrace will maintain the measures in Annex II.

3.4 Assistance. Taking into account the nature of the processing, Supertrace will help Customer:

• respond to data subject requests;
• carry out data protection impact assessments; and
• consult with regulators.

If Supertrace receives a request directly from a data subject, it will forward the request to Customer and will not respond to it, except to redirect the data subject.

3.5 Compliance. Supertrace will comply with the CCPA's service-provider obligations and give the same level of protection the CCPA requires. Supertrace will notify Customer if it can no longer meet those obligations.

4. Subprocessors

4.1 General authorization. Customer authorizes Supertrace to use the subprocessors listed at supertrace.ai/legal/subprocessors. Supertrace will bind each subprocessor to data-protection terms at least as protective as this DPA and remains liable for its subprocessors.

4.2 Changes. Supertrace will give at least 30 days' notice before adding or replacing a subprocessor.

4.3 Objections. Customer may object on reasonable data-protection grounds within that 30-day period. If the parties cannot resolve the objection, Customer may terminate the affected Services and receive a refund of prepaid, unused fees for them.

5. Personal data breaches

5.1 Notice. Supertrace will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

5.2 Information. The notice will describe the breach, the data and data subjects likely affected, and the steps Supertrace is taking. Supertrace will give further information as it becomes available.

5.3 No admission. Notice is not an admission of fault.

6. Deletion and return

6.1 Export. Customer may export Customer Content during the Agreement and for 30 days after it ends.

6.2 Deletion. After that, Supertrace will delete Customer Personal Data within 30 days. On request, Supertrace will also delete an individual user's personal data within 30 days. The exceptions are copies in backups, which expire within 35 days; copies in Supertrace's internal workspace (listed on the Subprocessors page), which Supertrace deletes within 30 days of Customer's written request; and copies the law requires Supertrace to keep. All of these stay protected under this DPA.

7. Audits

7.1 Reports. Supertrace will make available its most recent SOC 2 Type II report, or an equivalent independent audit report, and will answer reasonable security questionnaires once a year.

7.2 On-site audits. If those do not reasonably show compliance, or a regulator requires it, Customer may audit Supertrace once a year. Customer must give 30 days' notice. The audit takes place during business hours, at Customer's cost, under confidentiality terms.

8. International transfers

8.1 Mechanism. Where Supertrace processes Customer Personal Data from the EEA, the UK or Switzerland in a country without an adequacy decision, the following are incorporated by reference:

• the Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor) or Module Three (processor to processor);
• the UK International Data Transfer Addendum; and
• for Switzerland, the same Clauses with the FADP adjustments.

8.2 Clause options.

• Clause 7 (docking) applies.
• Option 2 of Clause 9 (general authorization, 30 days' notice) applies.
• Clause 11's optional language does not apply.
• Clauses 17 and 18 select Irish law and the courts of Ireland.
• Annexes I and II of this DPA complete the appendix.

8.3 Data residency. Supertrace hosts Customer Personal Data in the United States (AWS us-east-1). AI model providers also process prompts in the United States.

9. Liability

Each party's liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses prohibit such limits.

Annex I: Description of processing

Annex II: Security measures

• Encryption: TLS for data in transit; encryption of most stored integration credentials; storage of SSH device keys in AWS Secrets Manager.
• Access control:
  • role-based access in the Services (superuser, org admin, member);
  • SSO with Okta, Google or Microsoft;
  • hashed API and access tokens;
  • least-privilege production access for staff.
• Isolation: Each customer's data is separated logically by organization; all hosting is in the United States.
• Monitoring: Error and infrastructure monitoring with personal-data scrubbing; audit logs of agent actions and approvals.
• Agent safeguards: Commands are classified, and write and destructive commands need human approval; per-user command allowlists.
• Resilience: Managed databases with backups; infrastructure as code; Kubernetes-based deployment.
• Assurance: SOC 2 Type II program; vendor security review of subprocessors; staff confidentiality agreements and security training.
• Incident response: A documented process with the customer notice in Section 5.