Data Processing Addendum

3.1 Role of the Parties

The Parties acknowledge and agree that with respect to the processing of Customer Personal Data, Customer is the Controller (or Business), Civic IQ is the Processor (or Service Provider/Contractor, as applicable), and Civic IQ engages Sub-processors as described in Annex B.

3.2 Customer Instructions

Civic IQ shall process Customer Personal Data only for the purposes described in the Agreement and this DPA, and only in accordance with Customer’s documented instructions. The Agreement (including this DPA), together with Customer’s use of and configuration of the Services, constitute Customer’s complete and final instructions to Civic IQ. Additional instructions outside the scope of the Agreement require prior written agreement between the Parties, including agreement on any additional fees.

Civic IQ shall inform Customer if, in its opinion, an instruction infringes Data Protection Laws. Civic IQ is not obligated to follow instructions that it reasonably believes violate Data Protection Laws.

3.3 Permitted Purposes

Civic IQ shall process Customer Personal Data solely for the following purposes:

• providing, operating, maintaining, securing, and improving the Services in accordance with the Agreement;
• responding to Customer support requests and providing professional services;
• complying with applicable law, regulation, legal process, or enforceable governmental request; and
• as otherwise authorized by Customer in writing.

3.4 Restrictions on Civic IQ

Civic IQ shall not:

• sell or share Customer Personal Data (as “sell” and “share” are defined under the CCPA);
• retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in this DPA and the Agreement, including for any commercial purpose other than providing the Services, except as otherwise permitted by Data Protection Laws;
• retain, use, or disclose Customer Personal Data outside the direct business relationship between Civic IQ and Customer; or
• combine Customer Personal Data with Personal Data obtained from, or on behalf of, any other source, except as permitted by applicable Data Protection Laws, including to provide the Services Customer uses (for example, enriching Customer’s imported or CRM contacts, or matching them against Civic IQ Data, at Customer’s direction).

Civic IQ shall notify Customer promptly if it determines it can no longer meet its obligations under Data Protection Laws.

For clarity, nothing in this DPA restricts Civic IQ’s collection, generation, use, or retention of aggregated, anonymized, or de-identified information derived from Customer Personal Data, provided that such information does not identify Customer, any Data Subject, or any other individual and no longer constitutes Personal Data under applicable Data Protection Laws.

3.5 Confidentiality

Civic IQ shall ensure that personnel authorized to process Customer Personal Data are subject to binding written confidentiality obligations and have received appropriate training on the protection of Personal Data.

3.6 Use of Customer Data for AI/ML Model Training

Civic IQ shall not use Customer Personal Data to develop, improve, or train artificial intelligence or machine learning models, except: (a) to personalize the Services for Customer, where the resulting model, settings, or outputs are used only for Customer; or (b) where Customer or its Authorized Users opt in to a specific feature that uses Customer Personal Data for that purpose (for example, call transcription or phone dialer features), as described at the time of opt-in. Customer may withdraw an opt-in at any time, after which Civic IQ will not use newly collected Customer Personal Data for that purpose. Customer Personal Data may otherwise be processed by AI/ML features solely to provide the functionality of the Services to Customer, and any such processing shall not result in the retention of Customer Personal Data by any third-party AI/ML provider for training or other secondary purposes.

4.1 Technical and Organizational Measures

Civic IQ shall implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against Security Incidents, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of Data Subjects. A description of these measures is set forth in Annex C and is further evidenced by Civic IQ’s SOC 2 Type I report as of October 27, 2025 (and any successor reports).

4.2 SOC 2 Report

Civic IQ maintains a SOC 2 Type I report (and intends to maintain a SOC 2 Type II report on a recurring basis) covering the Security Trust Services Criteria. Civic IQ shall make its most recent SOC 2 report available to Customer under non-disclosure obligations upon reasonable request.

4.3 Encryption

Customer Personal Data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 (or equivalent) encryption, including via Google Cloud KMS for production data stores.

4.4 Access Controls

Civic IQ enforces role-based access controls, the principle of least privilege, multi-factor authentication for access to production systems, and quarterly user access reviews. Privileged access is restricted to authorized personnel with a documented business need.

5.1 General Authorization

Customer provides Civic IQ with a general authorization to engage Sub-processors to process Customer Personal Data, subject to the requirements of this Section 5. A list of Civic IQ’s current Sub-processors is set forth in Annex B and is also available upon request.

5.2 Sub-processor Obligations

Civic IQ shall:

• conduct appropriate due diligence on each Sub-processor prior to engagement to evaluate its ability to comply with this DPA;
• enter into a written agreement with each Sub-processor that imposes data protection obligations substantially the same as, and no less protective than, those in this DPA; and
• remain liable to Customer for the acts and omissions of its Sub-processors with respect to Customer Personal Data to the same extent as if Civic IQ performed such acts or omissions itself.

5.3 Notice of Changes and Objection Right

Civic IQ shall notify Customer at least thirty (30) days in advance of any intended addition or replacement of a Sub-processor that processes Customer Personal Data (the “Notice Period”). Notice may be provided by email to Customer’s designated contact or by posting to the Civic IQ website or customer portal.

Customer may object in writing to a new Sub-processor on reasonable data protection grounds within the Notice Period. If Customer objects, the Parties shall work together in good faith to resolve the objection. If the Parties cannot resolve the objection within a reasonable period, Customer’s sole and exclusive remedy shall be to terminate the portion of the Services that cannot be provided without use of the objected-to Sub-processor, upon written notice to Civic IQ, and to receive a pro-rata refund of any prepaid fees for the terminated portion of the Services covering the period after termination.

6.1 Assistance with Data Subject Requests

Taking into account the nature of the processing, Civic IQ shall provide Customer with reasonable assistance, by appropriate technical and organizational measures, to enable Customer to respond to requests from Data Subjects (or Consumers, as applicable) to exercise their rights under Data Protection Laws, including rights of access, rectification, deletion, restriction of processing, data portability, objection to processing, opt-out of sale or share, and rights relating to automated decision-making.

6.2 Direct Requests to Civic IQ

If Civic IQ receives a Data Subject request directly relating to Customer Personal Data, Civic IQ shall, without undue delay, forward the request to Customer and not respond to the request itself except at Customer’s documented instruction or as required by applicable law.

6.3 Cost

Civic IQ’s reasonable assistance with Data Subject requests shall be provided at no additional charge, except to the extent the volume or nature of requests materially exceeds what would be expected in the ordinary course, in which case the Parties shall agree on reasonable fees.

7.1 Notification

Civic IQ shall notify Customer without undue delay, and in any event no later than seventy-two (72) hours, after becoming aware of a confirmed Security Incident affecting Customer Personal Data.

7.2 Content of Notification

To the extent known at the time of notification (and supplemented thereafter as additional information becomes available), Civic IQ shall provide:

• a description of the nature of the Security Incident, including, where possible, the categories and approximate number of Data Subjects and records concerned;
• the name and contact details of the Civic IQ point of contact from whom more information can be obtained;
• a description of the likely consequences of the Security Incident; and
• a description of the measures taken or proposed to address the Security Incident, including measures to mitigate its possible adverse effects.

7.3 Cooperation

Civic IQ shall reasonably cooperate with Customer’s handling of the Security Incident, including assisting with any investigation, notification to Data Subjects or regulators, and remediation. Civic IQ’s notification of, or response to, a Security Incident shall not be construed as an acknowledgment by Civic IQ of any fault or liability.

9.1 Primary Hosting Location

Civic IQ hosts and processes Customer Personal Data primarily in data center regions located in the United States (Google Cloud Platform regions us-central1 and us-east1).

9.2 EU/UK/Swiss Transfers

To the extent Civic IQ processes Personal Data that is subject to the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection in a jurisdiction that has not received an adequacy decision from the relevant authority, the Parties agree that:

• the EU Standard Contractual Clauses (Module Two: Controller to Processor, or Module Three: Processor to Processor, as applicable), approved by the European Commission in Implementing Decision (EU) 2021/914, are hereby incorporated by reference and shall apply to such transfers, with the completions set out in Annex D;
• for transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner’s Office shall apply, with the completions set out in Annex D; and
• for transfers subject to the Swiss FADP, the SCCs shall apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner (including replacing references to the GDPR with references to the FADP, as applicable).

9.3 Supplementary Measures

Civic IQ shall implement appropriate supplementary technical, organizational, and contractual measures to protect transferred Personal Data, including encryption in transit and at rest, access controls, and the vendor and security commitments described in this DPA.

10.1 Audit Reports

Civic IQ demonstrates compliance with its obligations under this DPA through the provision of its then-current SOC 2 report and, upon reasonable request and subject to confidentiality obligations, other relevant certifications, audit summaries, or security documentation.

10.2 Customer Audit Rights

To the extent the SOC 2 report and other information made available by Civic IQ are not sufficient to demonstrate compliance with Data Protection Laws, Customer may, upon at least thirty (30) days’ prior written notice and no more than once per twelve (12) month period (unless required by a supervisory authority or following a material Security Incident), request additional information reasonably necessary to verify Civic IQ’s compliance with this DPA.

10.3 Conduct of Audits

Any such audit or inspection shall: (i) be conducted during normal business hours; (ii) follow Civic IQ’s reasonable security and confidentiality requirements; (iii) not unreasonably interfere with Civic IQ’s business; (iv) be subject to the confidentiality provisions of the Agreement; and (v) be at Customer’s sole cost and expense (except where Civic IQ is in material breach of this DPA, in which case Civic IQ shall bear reasonable costs).

11.1 On Termination

Upon termination or expiration of the Agreement, Civic IQ shall, at Customer’s written election, return to Customer or delete all Customer Personal Data in Civic IQ’s possession or control within thirty (30) days, except to the extent Civic IQ is required by applicable law to retain some or all of the Customer Personal Data, or where Customer Personal Data is archived on back-up systems, in which case Civic IQ shall securely isolate and protect such Personal Data from further processing and delete it in accordance with its normal back-up deletion schedule.

11.2 During the Term

Customer may request the deletion of specific Customer Personal Data at any time during the Term by contacting [email protected], and Civic IQ shall delete such Personal Data within thirty (30) days of the request, except as otherwise required by applicable law.

11.3 Certification

Upon Customer’s reasonable request, Civic IQ shall certify in writing that it has complied with its deletion obligations under this Section 11.

14.1 Order of Precedence

In the event of any conflict or inconsistency among the following documents, the order of precedence is: (1) any applicable SCCs or regulator-required clauses; (2) this DPA; (3) the Agreement; and (4) any other related document.

14.2 Amendments

Civic IQ may update this DPA from time to time to reflect changes in Data Protection Laws or Civic IQ’s processing activities, provided that such updates do not materially reduce the overall level of protection afforded to Customer Personal Data. Material updates will be communicated to Customer at least thirty (30) days in advance.

14.3 Governing Law and Venue

This DPA shall be governed by the governing law and venue provisions of the Agreement, except to the extent Data Protection Laws or the SCCs require otherwise.

14.4 Severability

If any provision of this DPA is held to be invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect.

14.5 Entire Agreement

This DPA, together with the Agreement and any incorporated SCCs, constitutes the entire agreement between the Parties with respect to the processing of Customer Personal Data and supersedes any prior or contemporaneous agreements, representations, or understandings on that subject matter.

C.1 Information Security Governance

• Written information security policies reviewed at least annually and approved by executive management.
• Assigned ownership of information security responsibilities at the executive level.
• Annual formal risk assessment covering security, fraud, legal, regulatory, vendor, and technology risks, with documented risk register and treatment plans.
• Board of Directors oversight of the information security program on at least an annual basis.

C.2 Access Controls

• Unique user IDs and role-based access control (RBAC) to production systems.
• Principle of least privilege applied to all access grants.
• Multi-factor authentication (MFA) required for administrative access to production environments and source code repositories.
• Quarterly user access reviews; access revoked within one (1) business day of termination.
• Privileged access restricted to authorized personnel based on documented business need.

C.3 Encryption

• Data in transit encrypted using TLS 1.2 or higher with certificates from an established third-party certificate authority.
• Data at rest encrypted using AES-256 (or equivalent) via Google Cloud KMS.
• API keys, database credentials, and service account keys stored in Google Secret Manager.

C.4 Network Security

• Production systems hosted in a Google Cloud Platform Virtual Private Cloud (VPC) with segmented networks and access control lists.
• Databases and processing jobs (Cloud SQL, BigQuery, Cloud Run Jobs, Sync Jobs) isolated from public internet access within the VPC.
• Intrusion detection and prevention via GCP-native capabilities; firewall rules reviewed at least annually.
• Remote administrative access via bastion host and VPN.

C.5 Application and Development Security

• Formal change management process requiring authorization, testing in non-production environments, peer review, and approval prior to production deployment.
• Source code version-controlled with author attribution and timestamps; merge approval required.
• Automated monthly vulnerability scans; critical and high vulnerabilities remediated on an expedited basis.
• Annual third-party penetration testing; findings tracked to resolution via the incident management process.
• Hardened baseline configurations managed via infrastructure-as-code.

C.6 Logging and Monitoring

• Comprehensive audit logging of administrative activities, authentication events, data access, and configuration changes via Cloud Monitoring and Cloud Logging.
• Automated alerting on high/critical events routed through the incident management process.
• Log integrity protected through restricted access to log configuration.

C.7 Endpoint and Malware Protection

• Anti-virus and anti-malware software installed on all workstations and production servers.
• Automatic patching for workstations; daily patch compliance scanning.
• Endpoint encryption on company-issued laptops.

C.8 Personnel Security

• Background and reference checks for new employees prior to joining, to the extent permitted by law.
• Signed confidentiality agreements, code of business conduct, and information security policy acknowledgement at hire and annually thereafter.
• Information security awareness training at hire and at least annually.
• Documented hiring and termination checklists; access revoked within one (1) business day of termination.

C.9 Incident Response

• Formal incident response process covering identification, containment, eradication, recovery, and lessons learned.
• Security Incidents logged in a ticketing system, communicated to affected parties, and reviewed by senior management.
• Customer notification of confirmed Security Incidents without undue delay and no later than 72 hours after becoming aware (see Section 7).

C.10 Business Continuity and Backup

• Business Continuity and Disaster Recovery (BCDR) plan reviewed and tested at least annually across multiple loss scenarios.
• Production environment deployed across multiple GCP availability zones (us-central1, us-east1) with failover capabilities.
• Automated backups with defined retention periods; backup and restoration logs maintained.

C.11 Vendor Management

• Written vendor management policy with vendor inventory and baseline security requirements.
• Annual review of Sub-processor SOC reports; quarterly risk assessments for critical vendors without SOC reports.
• Contractual flow-down of data protection and confidentiality obligations.

C.12 Physical Security

• Physical security of production infrastructure is the responsibility of GCP (see GCP’s SOC 2 report). Civic IQ does not operate its own physical data centers and does not process Customer Personal Data on-premises.

C.13 Certifications

• SOC 2 Type I (Security) as of October 27, 2025. Civic IQ intends to maintain recurring SOC 2 Type II reporting.

D.1 EU SCCs (Commission Implementing Decision (EU) 2021/914)

• Module: Module Two (Controller to Processor) applies where Customer is a Controller; Module Three (Processor to Processor) applies where Customer acts as a Processor on behalf of its own controller.
• Clause 7 (Docking clause): Applies.
• Clause 9 (Use of sub-processors): Option 2 (general written authorization) applies. Notice Period: thirty (30) days.
• Clause 11 (Redress): The optional independent dispute resolution language does not apply.
• Clause 17 (Governing law): Irish law.
• Clause 18 (Forum and jurisdiction): The courts of Ireland.
• Annex I.A (Parties): Data exporter — Customer; data importer — Civic IQ, Inc. Contact information as set out in the executed DPA and Annex A.
• Annex I.B (Description of transfer): As set out in Annex A of this DPA.
• Annex I.C (Competent supervisory authority): The supervisory authority of the Member State in which the data exporter is established, or where no such authority applies, the Irish Data Protection Commission.
• Annex II (Technical and organizational measures): As set out in Annex C of this DPA.
• Annex III (List of sub-processors): As set out in Annex B of this DPA.

D.2 UK International Data Transfer Addendum

For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the EU SCCs (version B1.0) applies. Tables 1–4 shall be completed as follows:

• Table 1 (Parties): As set out in the executed DPA and Annex A.
• Table 2 (Selected SCCs, Modules, and Selected Clauses): EU SCCs as incorporated under Section D.1 above.
• Table 3 (Appendix Information): Annexes I–III as set out in Annexes A, B, and C of this DPA.
• Table 4 (Ending this Addendum when the Approved Addendum Changes): Neither Party may end this Addendum.

D.3 Swiss Transfers

Where Personal Data is subject to the Swiss FADP, the EU SCCs apply with the following adaptations:

• references to the GDPR shall be interpreted as references to the Swiss FADP, as applicable;
• the competent supervisory authority shall be the Swiss Federal Data Protection and Information Commissioner; and
• references to “Member State” shall not be interpreted to exclude Data Subjects in Switzerland from exercising their rights.