Data Processing Addendum

Capitalized terms not defined in this DPA have the meanings given in the Agreement.

• "Data Protection Laws" means all applicable laws and regulations relating to the processing of Personal Data, including (a) the General Data Protection Regulation (EU) 2016/679 ("GDPR"), (b) the UK General Data Protection Regulation and Data Protection Act 2018 ("UK GDPR"), (c) the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), (d) the Swiss Federal Act on Data Protection ("FADP"), and (e) any other applicable data protection or privacy law.
• "Personal Data" means any information relating to an identified or identifiable natural person that is processed by iNeedTrust on behalf of the Customer in connection with the platform services, as further described in Schedule A.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, combination, restriction, erasure, or destruction.
• "Sub-processor" means any third party engaged by iNeedTrust to process Personal Data on behalf of the Customer.
• "Data Subject" means an identified or identifiable natural person whose Personal Data is processed.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored, or otherwise processed by iNeedTrust.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by the European Commission for the transfer of Personal Data to third countries, as set out in Commission Implementing Decision (EU) 2021/914.

Roles. For the purposes of this DPA and applicable Data Protection Laws:

• The Customer is the Controller of Personal Data. The Customer determines the purposes and means of processing Personal Data through its use and configuration of the iNeedTrust platform.
• iNeedTrust is the Processor of Personal Data. iNeedTrust processes Personal Data solely on behalf of and in accordance with the Customer's documented instructions.

Scope. This DPA applies to all Personal Data processed by iNeedTrust in connection with providing the platform services, including:

• Trust center visitor data (email addresses, names, company affiliations, IP addresses)
• Dataroom access records (visitor identity, access timestamps, document interaction logs)
• NDA signing records (signatory identity, acceptance timestamps, agreement versions)
• Alert subscription data (email addresses, notification preferences)
• Document request submissions (requestor identity, request content)

Customer Responsibilities. The Customer shall:

• Ensure it has a lawful basis for the processing of Personal Data and has provided all required notices and obtained all necessary consents
• Ensure its instructions to iNeedTrust comply with applicable Data Protection Laws
• Be responsible for the accuracy, quality, and legality of the Personal Data provided to iNeedTrust
• Inform iNeedTrust without undue delay if it becomes aware of any circumstances that may affect iNeedTrust's ability to comply with this DPA

Documented Instructions. iNeedTrust shall process Personal Data only on the documented instructions of the Customer, unless required to do so by applicable law. The Customer's instructions are documented in this DPA, the Agreement, and through the Customer's use and configuration of the platform (including dataroom settings, visitor access policies, NDA requirements, and notification configurations).

Additional Instructions. If the Customer provides processing instructions that, in iNeedTrust's reasonable opinion, violate applicable Data Protection Laws, iNeedTrust shall promptly inform the Customer. iNeedTrust shall not be required to assess whether the Customer's instructions comply with applicable law, but shall notify the Customer if it becomes aware of a potential violation.

Processing Limitation. iNeedTrust shall not:

• Process Personal Data for any purpose other than providing the platform services as described in the Agreement and this DPA
• Sell, rent, or otherwise make available Personal Data to third parties for their own commercial purposes
• Combine Personal Data received from the Customer with Personal Data received from other customers or collected from iNeedTrust's own interactions with Data Subjects, except as necessary to provide the platform services
• Retain Personal Data longer than necessary to fulfill the purposes of processing, unless required by applicable law

iNeedTrust shall implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures shall be appropriate to the risk and shall include, at a minimum, the measures described in Schedule C.

iNeedTrust shall:

• Ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality
• Take all measures required pursuant to Article 32 of the GDPR, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing
• Regularly test, assess, and evaluate the effectiveness of technical and organizational measures for ensuring the security of processing
• Notify the Customer promptly if, in iNeedTrust's opinion, an instruction from the Customer infringes applicable Data Protection Laws regarding security requirements

General Authorization. The Customer provides a general written authorization for iNeedTrust to engage Sub-processors to process Personal Data on behalf of the Customer. iNeedTrust maintains a current list of Sub-processors at ineedtrust.com/legal/sub-processors.

Obligations. When engaging a Sub-processor, iNeedTrust shall:

• Enter into a written agreement with the Sub-processor that imposes data protection obligations no less protective than those set out in this DPA
• Remain fully liable to the Customer for the performance of the Sub-processor's obligations
• Conduct appropriate due diligence to ensure the Sub-processor is capable of providing the level of protection required by this DPA and applicable Data Protection Laws

Notification of Changes. iNeedTrust shall notify the Customer at least thirty (30) days in advance of any intended addition or replacement of a Sub-processor by updating the Sub-processor list and sending an email notification to the Customer's designated contact address.

Objection Right. If the Customer has a reasonable, documented objection to a new Sub-processor based on data protection grounds, the Customer shall notify iNeedTrust in writing within fifteen (15) days of receiving the notification. The Parties shall negotiate in good faith to resolve the objection. If the Parties cannot resolve the objection within thirty (30) days, the Customer may terminate the affected services without penalty by providing written notice to iNeedTrust.

Current Sub-processors. As of the effective date, iNeedTrust uses the following categories of Sub-processors:

• Infrastructure: Cloudflare, Inc. (hosting, CDN, edge compute) - United States
• Database: Neon, Inc. (PostgreSQL database hosting) - United States
• E-Signature: DocuSeal (NDA e-signature processing) - as configured by the Customer
• Email: As configured in the platform for transactional notifications

Assistance. Taking into account the nature of the processing, iNeedTrust shall assist the Customer by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Customer's obligation to respond to requests from Data Subjects exercising their rights under applicable Data Protection Laws, including the right to access, rectification, erasure, restriction of processing, data portability, and objection.

Notification. If iNeedTrust receives a request directly from a Data Subject regarding the Customer's Personal Data, iNeedTrust shall promptly redirect the Data Subject to the Customer and notify the Customer of the request, unless prohibited by law. iNeedTrust shall not respond to such requests directly unless authorized by the Customer or required by applicable law.

Platform Tools. iNeedTrust provides the following self-service tools to assist with Data Subject requests:

• Visitor Management: Customer administrators can view, export, and delete visitor records through the platform dashboard
• Access Revocation: Customer administrators can revoke dataroom access for individual visitors at any time
• Data Export: Customer administrators can export visitor data in machine-readable format
• Subscription Management: Trust center visitors can manage their own alert subscriptions directly

Notification. iNeedTrust shall notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident affecting the Customer's Personal Data.

Content. The notification shall include, to the extent reasonably available:

1. A description of the nature of the Security Incident, including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned
2. The name and contact details of iNeedTrust's point of contact for further information
3. A description of the likely consequences of the Security Incident
4. A description of the measures taken or proposed to address the Security Incident, including measures to mitigate its possible adverse effects

Cooperation. iNeedTrust shall cooperate with the Customer and take reasonable commercial steps to assist in the investigation, mitigation, and remediation of the Security Incident. iNeedTrust shall provide updated information as it becomes available.

Limitations. iNeedTrust's obligation to report or respond to a Security Incident under this section is not and shall not be construed as an acknowledgment of any fault or liability by iNeedTrust.

Audit Information. iNeedTrust shall make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA and applicable Data Protection Laws, and shall allow for and contribute to audits, including inspections, conducted by the Customer or a qualified third-party auditor mandated by the Customer.

Audit Process. Audits shall be subject to the following conditions:

• The Customer shall provide at least thirty (30) days' prior written notice of any audit request
• Audits shall be conducted during normal business hours, no more than once per twelve (12) month period (unless required by a supervisory authority or following a Security Incident)
• The Customer or its auditor shall execute a confidentiality agreement reasonably acceptable to iNeedTrust before any audit
• The Customer shall bear its own costs in conducting any audit
• Audits shall be conducted in a manner that minimizes disruption to iNeedTrust's operations

Compliance Reports. To the extent iNeedTrust obtains third-party certifications or audit reports (such as SOC 2 Type II), iNeedTrust shall make summaries or copies available to the Customer upon request. Such reports may satisfy the Customer's audit rights under this section, provided they adequately cover the scope of the Customer's concerns.

Term. This DPA shall remain in effect for the duration of the Agreement. The obligations of this DPA with respect to the processing of Personal Data shall survive any termination or expiration of the Agreement until iNeedTrust ceases all processing of Personal Data on behalf of the Customer.

Deletion or Return. Upon termination or expiration of the Agreement, or upon the Customer's written request, iNeedTrust shall, at the Customer's election:

• Delete all Personal Data processed on behalf of the Customer, including all copies, backups, and replicas, within thirty (30) days; or
• Return all Personal Data to the Customer in a commonly used, machine-readable format within thirty (30) days

If the Customer does not provide instructions within thirty (30) days of termination, iNeedTrust shall delete all Personal Data.

Certification. Upon request, iNeedTrust shall provide the Customer with written certification that it has complied with its obligations under this section.

Retention Exception. iNeedTrust may retain Personal Data to the extent required by applicable law, provided that iNeedTrust shall (a) process such retained data solely for the purpose and duration required by applicable law, (b) maintain the confidentiality protections of this DPA, and (c) delete the data promptly once the legal retention requirement expires.

CCPA/CPRA Service Provider Designation. To the extent iNeedTrust processes Personal Data that is subject to the CCPA/CPRA, iNeedTrust is a "Service Provider" as defined in Cal. Civ. Code § 1798.140(ag). iNeedTrust shall:

• Not sell or share (as those terms are defined under the CCPA/CPRA) any Personal Data received from the Customer
• Not retain, use, or disclose Personal Data for any purpose other than the business purposes specified in the Agreement and this DPA, or as otherwise permitted by the CCPA/CPRA
• Not retain, use, or disclose Personal Data outside of the direct business relationship between iNeedTrust and the Customer
• Not combine Personal Data received from the Customer with Personal Data received from other sources or collected from iNeedTrust's own interactions with consumers, except as permitted by the CCPA/CPRA
• Comply with applicable obligations under the CCPA/CPRA and grant the Customer the right to take reasonable and appropriate steps to help ensure that iNeedTrust uses Personal Data in a manner consistent with the Customer's obligations under the CCPA/CPRA

Certification. iNeedTrust certifies that it understands the restrictions in this section and will comply with them.

Multi-State Compliance. To the extent that Personal Data is subject to other U.S. state privacy laws (including the Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, and similar laws), iNeedTrust shall process such data in accordance with the applicable requirements, which are substantially consistent with the obligations set forth in this DPA.

Transfer Mechanisms. To the extent that the processing of Personal Data involves a transfer of Personal Data from the European Economic Area ("EEA"), the United Kingdom, or Switzerland to a country that has not been recognized as providing an adequate level of data protection, the Parties agree that the following transfer mechanisms shall apply:

• Standard Contractual Clauses (Module 2 - Controller to Processor): The Parties agree that the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference into this DPA. For transfers from the EEA, the SCCs apply as approved by the European Commission. For transfers from the UK, the International Data Transfer Addendum to the EU SCCs (as issued by the UK Information Commissioner's Office) shall apply. For transfers from Switzerland, the SCCs apply with the modifications required by the Swiss FADP.

SCC Details. For the purposes of the SCCs:

• The Customer is the "data exporter" and iNeedTrust is the "data importer"
• The details of the processing activities are as described in Schedule A
• The technical and organizational measures are as described in Schedule C
• The competent supervisory authority shall be determined in accordance with Clause 13 of the SCCs

Alternative Transfer Mechanisms. If an alternative transfer mechanism becomes available under applicable Data Protection Laws that would be valid for the transfer of Personal Data (such as a new adequacy decision or certification framework), the Parties may agree to rely on such mechanism in lieu of or in addition to the SCCs.

Supplementary Measures. iNeedTrust shall implement appropriate supplementary measures as necessary to ensure that the level of protection of Personal Data is not undermined by the transfer, taking into account the laws and practices of the destination country.

Governing Law. This DPA shall be governed by the laws that govern the Agreement, except that the SCCs shall be governed as specified therein.

Liability. Each Party's liability under this DPA shall be subject to the limitations of liability set out in the Agreement, except that no limitation shall apply to the extent prohibited by applicable Data Protection Laws.

Severability. If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

Precedence. In the event of any conflict between this DPA and the Agreement with respect to the processing of Personal Data, this DPA shall prevail. In the event of any conflict between this DPA and the SCCs, the SCCs shall prevail.

Amendments. iNeedTrust may update this DPA from time to time to reflect changes in applicable Data Protection Laws or processing practices. Material changes will be notified to the Customer at least thirty (30) days in advance. Continued use of the platform after the effective date of changes constitutes acceptance of the updated DPA.

Entire DPA. This DPA, including its Schedules, constitutes the complete agreement between the Parties regarding the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals, or representations, written or oral, concerning data processing.

Applicable SCCs Module: Module 2 (Controller to Processor)

Data Exporter:

• Name: The Customer (as identified in the Agreement)
• Role: Controller
• Activities: Operating a trust center on the iNeedTrust platform; configuring visitor access, dataroom settings, NDA requirements, and notification preferences
• Contact: As specified in the Customer's account settings

Data Importer:

• Name: iNeedTrust
• Role: Processor
• Activities: Providing the iNeedTrust trust center platform, including hosting, data processing, visitor management, and notification delivery
• Contact: [email protected]

Clause 7 (Optional Docking Clause): Included - third parties may accede to the SCCs as a data exporter or data importer with the agreement of all existing parties.

Clause 9(a) (Sub-processor Authorization): Option 2 - General written authorization. The Processor shall inform the Controller of any intended changes to Sub-processors, giving the Controller the opportunity to object as described in Section 5 of this DPA.

Clause 13 (Competent Supervisory Authority): The supervisory authority of the EU Member State in which the data exporter is established. Where the data exporter is not established in the EU, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) shall be the competent supervisory authority.

Clause 17 (Governing Law): The laws of the Netherlands.

Clause 18 (Choice of Forum): The courts of the Netherlands.

iNeedTrust implements and maintains the following technical and organizational security measures:

Access Control

• Role-based access control (RBAC) with principle of least privilege for all platform operations
• Multi-factor authentication available for Customer administrator accounts
• Unique user credentials - no shared accounts for platform administration
• Automatic session expiration and re-authentication requirements
• Visitor access controlled through configurable authentication (email verification, NDA gating, access groups)

Encryption

• All data in transit encrypted via TLS 1.2 or higher
• All data at rest encrypted using AES-256 or equivalent industry-standard encryption
• Database connections encrypted with SSL/TLS
• Dataroom document storage encrypted at rest

Infrastructure Security

• Platform hosted on Cloudflare Workers (edge compute) with global DDoS protection
• Database hosted on Neon (managed PostgreSQL) with automated backups and point-in-time recovery
• Network-level isolation between tenant environments
• Regular security patches and updates applied to all infrastructure components

Data Isolation

• Strict tenant isolation at the application and database layer - each Customer's data is logically separated
• All database queries scoped to tenant identifiers with enforced tenant guards
• Cross-tenant data access is architecturally prevented through application-level controls

Monitoring and Logging

• Comprehensive audit logging for administrative actions and data access events
• Real-time error monitoring and alerting via Sentry
• Dataroom access audit trail with visitor identity, timestamps, and document interaction records

Incident Response

• Documented incident response procedures with defined roles and escalation paths
• Security incident notification process as described in Section 7 of this DPA

Personnel

• Confidentiality agreements for all personnel with access to Personal Data
• Security awareness and data protection training

Business Continuity

• Automated database backups with point-in-time recovery capability
• Edge-distributed architecture providing high availability across multiple regions
• Disaster recovery procedures tested periodically