Data Processing Agreement

Controller to Processor Terms

1. DEFINITIONS

Capitalized terms not defined herein have the meanings given in the Principal Agreement. For purposes of this DPA:

"Applicable Data Protection Laws" means all laws and regulations applicable to the Processing of Personal Data, including: (a) the General Data Protection Regulation (EU) 2016/679 ("GDPR"); (b) the UK General Data Protection Regulation and Data Protection Act 2018 ("UK GDPR"); (c) the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"); (d) the Colorado Privacy Act; (e) the Virginia Consumer Data Protection Act; and (f) other applicable privacy laws.

"Controller" means the entity that determines the purposes and means of Processing Personal Data.

"Data Subject" means an identified or identifiable natural person whose Personal Data is Processed.

"Derived Learnings" means generalized, de-identified knowledge, techniques, patterns, and operational insights extracted from advisory engagements that do not identify Controller or reveal Controller's specific proprietary business information.

"Personal Data" means any information relating to an identified or identifiable natural person that Controller provides to Processor or that Processor Processes on Controller's behalf in connection with the Services.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.

"Processing" means any operation performed on Personal Data, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.

"Processor" means an entity that Processes Personal Data on behalf of a Controller.

"Services" means the services provided by Processor to Controller under the Principal Agreement, including the CAIO Bridge platform, advisory services, and related tools.

"Session Recording Data" means audio, video, and transcript recordings of advisory sessions, consulting calls, and onboarding meetings between Processor personnel and Controller or Controller's authorized users.

"Standard Contractual Clauses" or "SCCs" means the contractual clauses adopted by the European Commission for international data transfers.

"Sub-processor" means any third party engaged by Processor to Process Personal Data on behalf of Controller.

2. SCOPE AND ROLES

2.1 Roles of the Parties

(a) Platform Services: Where Controller uses the CAIO Bridge platform to process Personal Data of Controller's contacts, prospects, and customers, Controller is the Controller and Processor acts as the Processor.

(b) Advisory Services: Where Processor records advisory sessions involving Controller's personnel, Processor acts as Controller for the Session Recording Data (as Processor determines the purposes and means of recording), and as joint Controller with Controller for any Personal Data of Controller's personnel or business contacts discussed during sessions.

(c) Each Party shall comply with its obligations under Applicable Data Protection Laws in accordance with its role.

2.2 Scope of Processing

Processor shall Process Personal Data only as necessary to provide the Services and in accordance with Controller's documented instructions, except where Processor acts as Controller for Session Recording Data as described in Section 2.1(b). The details of Processing are set forth in Annex 1.

2.3 Controller's Responsibilities

Controller represents and warrants that:

• It has the legal authority to provide Personal Data to Processor
• Personal Data has been collected in compliance with Applicable Data Protection Laws
• It has provided any required notices and obtained any required consents from Data Subjects, including consent for session recording where Controller's personnel participate in advisory sessions
• Its instructions to Processor comply with Applicable Data Protection Laws
• It has appropriate legal basis for any outreach, enrichment, or automated processing conducted through the Platform on Controller's behalf

3. PROCESSOR OBLIGATIONS

3.1 Processing Instructions

Processor shall:

• Process Personal Data only on documented instructions from Controller, including regarding transfers to third countries, unless required by applicable law
• Immediately inform Controller if, in Processor's opinion, an instruction infringes Applicable Data Protection Laws
• Not Process Personal Data for any purpose other than as necessary to provide the Services, except for (i) Derived Learnings as permitted under the Principal Agreement, and (ii) aggregated, anonymized data as described in Section 3.10

3.2 Confidentiality

Processor shall ensure that persons authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.3 Security Measures

Taking into account the state of the art, costs of implementation, nature, scope, context, and purposes of Processing, and the risks to Data Subjects, Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of Personal Data in transit and at rest
• AES-256 encryption for third-party credentials and sensitive configuration data
• Measures to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems
• Ability to restore availability and access to Personal Data in a timely manner following an incident
• Regular testing and evaluation of security measures

Specific security measures are described in Annex 2.

3.4 Sub-processors

(a) Controller provides general authorization for Processor to engage Sub-processors to Process Personal Data, subject to the requirements of this Section.

(b) Processor shall maintain a list of current Sub-processors, available at getcaio.com/legal/subprocessors or upon request.

(c) Processor shall notify Controller at least fourteen (14) days before engaging a new Sub-processor or replacing an existing Sub-processor. If Controller objects to a new Sub-processor on reasonable grounds related to data protection, the Parties shall discuss the objection in good faith. If no resolution is reached, Controller may terminate the affected Services without penalty.

(d) Processor shall enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those in this DPA.

(e) Processor remains fully liable to Controller for the performance of Sub-processors' obligations.

3.5 Data Subject Rights

Processor shall, taking into account the nature of the Processing, assist Controller by appropriate technical and organizational measures in responding to requests from Data Subjects exercising their rights under Applicable Data Protection Laws, including rights of access, rectification, erasure, restriction, portability, and objection.

3.6 Data Protection Impact Assessments

Upon Controller's request, Processor shall provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, to the extent required by Applicable Data Protection Laws and to the extent Controller does not otherwise have access to the relevant information. This includes assessments related to AI-powered processing features and automated decision-making capabilities of the Platform.

3.7 Personal Data Breach

(a) Processor shall notify Controller without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting Controller's Personal Data.

(b) The notification shall include, to the extent known: (i) a description of the nature of the breach; (ii) categories and approximate number of Data Subjects affected; (iii) categories and approximate number of Personal Data records affected; (iv) likely consequences of the breach; and (v) measures taken or proposed to address the breach.

(c) Processor shall cooperate with Controller's investigation of and response to the breach and shall not inform any third party of the breach without Controller's prior consent, except as required by law.

3.8 Deletion and Return

(a) Upon termination or expiration of the Principal Agreement, or upon Controller's request, Processor shall, at Controller's choice, delete or return all Personal Data to Controller and delete existing copies, within thirty (30) days of the request.

(b) Processor may retain Personal Data to the extent required by law, provided that Processor maintains confidentiality and does not Process the data except as required by law.

(c) Derived Learnings that have been extracted and de-identified prior to termination are not subject to deletion or return obligations, as they do not constitute Personal Data.

(d) Third-party credentials (BYO) will be disconnected and deleted within five (5) business days of termination.

3.9 Audit Rights

(a) Processor shall make available to Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits conducted by Controller or Controller's auditor.

(b) Controller may conduct audits upon reasonable notice (at least thirty (30) days), during normal business hours, and no more than once per year (unless required by a supervisory authority or following a Personal Data Breach).

(c) Controller shall bear its own audit costs. If an audit reveals material non-compliance, Processor shall bear the cost of the audit and any remediation.

(d) Processor may satisfy audit requests by providing: (i) third-party audit reports (e.g., SOC 2); (ii) completed security questionnaires; or (iii) other documentation demonstrating compliance.

3.10 Aggregated and Anonymized Data

Processor may create aggregated, anonymized datasets from Personal Data processed under this DPA, provided that such datasets: (a) cannot reasonably be used to identify any Data Subject, Controller, or Controller's customers; (b) are used solely for product improvement, benchmarking, and platform development; and (c) are not shared in a form that could identify Controller. This processing constitutes a legitimate interest of Processor and does not require additional Controller instructions.

4. AI AND AUTOMATED PROCESSING

4.1 AI Processing

The Services include AI-powered features that Process Personal Data to generate content, analysis, research, and automated actions. Controller acknowledges that:

• Personal Data may be transmitted to AI Sub-processors (currently Anthropic) for processing
• AI Sub-processors process data only as needed to generate the requested output and do not use API inputs for model training
• AI outputs may be inaccurate and Controller is responsible for reviewing outputs before use

4.2 Automated Decision-Making

The Platform provides automated scoring, prioritization, and recommendation features (such as prospect scoring, engagement scoring, and ICP matching). These features assist Controller's decision-making but do not make binding decisions about individuals without Controller-configured human review. Controller is responsible for configuring appropriate human oversight for automated processing features.

4.3 Voice Data Processing

Where Controller enables voice features, audio data is processed by voice infrastructure Sub-processors (currently ElevenLabs for synthesis and OpenAI Whisper for transcription). Audio data is processed in real-time and is not retained by voice Sub-processors beyond the processing session, except as required for service delivery.

4.4 Session Recording Processing

Where advisory sessions are recorded:

• Recordings are processed by meeting intelligence Sub-processors (currently Granola) for transcription, summarization, and note generation
• Session Recording Data is retained according to the retention schedule in Annex 1
• Controller may request deletion of specific recordings at any time
• Derived Learnings may be extracted from session content as described in the Principal Agreement

5. INTERNATIONAL DATA TRANSFERS

5.1 Transfer Mechanisms

To the extent Processor transfers Personal Data from the European Economic Area, United Kingdom, or Switzerland to a country not recognized as providing adequate data protection:

• The Standard Contractual Clauses (Module 2: Controller to Processor) shall apply and are incorporated by reference into this DPA
• For transfers from the UK, the UK Addendum to the SCCs shall apply
• For transfers from Switzerland, the SCCs shall apply with necessary modifications

5.2 SCC Specifications

For purposes of the SCCs:

• Controller is the "data exporter" and Processor is the "data importer"
• The optional docking clause in Clause 7 applies
• Option 2 in Clause 9(a) applies; Sub-processor changes shall be notified as provided in Section 3.4
• The optional language in Clause 11(a) does not apply
• Option 1 in Clause 17 applies; governing law is Ireland
• Disputes under Clause 18 shall be resolved by the courts of Ireland

5.3 Additional Safeguards

Processor shall implement supplementary measures as necessary to ensure that Personal Data transferred internationally receives protection essentially equivalent to that guaranteed within the EEA, including encryption and access controls.

6. CALIFORNIA-SPECIFIC PROVISIONS

To the extent the CCPA/CPRA applies to Processing:

• Processor is a "Service Provider" as defined in the CCPA
• Processor shall not sell or share Personal Data
• Processor shall not retain, use, or disclose Personal Data for any purpose other than performing the Services or as permitted by the CCPA
• Processor shall not combine Personal Data with data from other sources except as permitted by the CCPA
• Processor certifies that it understands these restrictions and will comply with them
• Processor shall assist Controller in responding to consumer rights requests within the timeframes required by the CCPA/CPRA

7. GENERAL PROVISIONS

7.1 Order of Precedence

In the event of a conflict between this DPA and the Principal Agreement regarding Personal Data Processing, this DPA shall prevail. In the event of a conflict between this DPA and the SCCs, the SCCs shall prevail.

7.2 Liability

Each Party's liability under this DPA is subject to the limitations of liability in the Principal Agreement, except that such limitations shall not apply to the extent prohibited by Applicable Data Protection Laws.

7.3 Term

This DPA shall remain in effect for the duration of the Principal Agreement and thereafter until all Personal Data has been deleted or returned in accordance with Section 3.8.

7.4 Amendments

Processor may update this DPA to reflect changes in Applicable Data Protection Laws or Processing activities, with reasonable notice to Controller. Material changes that adversely affect Controller's rights require Controller's consent.

7.5 Entire Agreement

This DPA, including its Annexes, constitutes the entire agreement between the Parties regarding the subject matter hereof and supersedes all prior discussions and agreements.