Data Processing Addendum

This Data Processing Addendum (“Addendum”) applies pursuant to, and supplements, the Order Form (“Agreement”) entered into between the customer named on the Order Form (“Controller”) and Supertools, Inc. d/b/a Timeless (“Processor”).

Select Definitions

The following terms, when capitalized and used in this Addendum (unless otherwise indicated), shall have the meaning set forth below. Any capitalized terms not defined in this Addendum shall have the meanings given to them in the Agreement.

Anonymous Information — Information which does not relate to an identified or identifiable natural person or to Personal Data rendered anonymous in such a manner that the data subject is not or no longer identifiable.

Applicable Law — Any law, regulation, ordinance, rule, or order of any governmental or judicial body which applies to the Processing of the Personal Data.

Consent — Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Data Protection Laws — All laws and regulations, ordinances, rules, or orders of any governmental or judicial body, which applies to the Processing of Personal Data, such as GDPR, the CCPA and the Israeli Protection of Privacy Law, 1981.

Controller Personal Data — Any Personal Data which is supplied or made available by Controller or on its behalf and Processed by Processor, or on its behalf, on behalf of the Controller in connection with the Services (defined below).

EU Data Protection Laws — The GDPR and any law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding instrument which implements the GDPR, the e-Privacy Directive 2002/58/EC, or any decision, directive or regulation of the EU Parliament, EU Commissions, EU Court of Justice or other body, as any of the above may amended, replaced or superseded from time to time.

GDPR — Regulation (EU) 2016/679 (General Data Protection Regulation).

CCPA — The California Consumer Privacy Act of 2018 and the regulations issued thereunder.

Personal Data — Any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personal Data Breach — A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.

Processing — Any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, destruction and any automated mean necessary for the improvement of the Services, including without limitation, AI learning and testing, machine learning models and any other automated model required for the Services.

Services — The products, services and other activities to be supplied or carried out by or on behalf of the Processor or its affiliates pursuant to the Agreement.

Subprocessor — Any third party appointed by or on behalf of Processor to Process Controller Personal Data in connection with the Services or this Addendum.

Processing Personal Data by Processor

Processor shall only Process Controller Personal Data:

1. Pursuant to the Controller’s reasonable and necessary documented instructions;
2. As necessary to perform the Services;
3. To share Controller Personal Data with, or receive Controller Personal Data from, third parties in accordance with Customer’s instructions and/or pursuant to Customer’s use of the Services (e.g. integrations between Processor’s Services and any services provided by third parties as configured by or on behalf of Customer);
4. To render Customer Personal Data anonymous, thus excluding it from the definition of Personal Data;
5. As required by Union or Member State law or any other applicable law to which Processor and its affiliates are subject, in which case, Processor shall, to the extent possible, inform the Customer of the legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

Controller hereby instructs Processor, along with companies within its corporate group, to Process Controller Personal Data as needed in order to perform the Services or to comply with the Agreement or Applicable Law.

To the extent that Processor or its affiliates cannot comply with a request (including, without limitation, any instruction, direction, code of conduct, certification, or change of any kind) from Customer relating to the Processing of Controller Personal Data or where Processor considers such a request to be unlawful, Processor:

1. Shall inform Customer, providing relevant details of the problem;
2. May, without any kind of liability towards Customer, temporarily cease all Processing of the affected Customer Personal Data (other than securely storing the data); and
3. If the Parties do not agree on a resolution to the issue in question and the costs thereof, Processor may, as its sole remedy, terminate the Agreement and this Addendum with respect to the affected Processing, and Customer shall pay to Processor all the amounts owed to Processor or due before the date of termination.

Customer will have no further claims against Processor (including, without limitation, requesting refunds for Services) due to the termination of the Agreement and/or the Addendum in the circumstances described above.

Processor will not be liable in the event of any claim brought by a third party, including, without limitation, a Data Subject, arising from any act or omission of Processor, to the extent that such is a result of Customer’s instructions.

Description of Processing

The subject-matter and duration of the Processing to be performed, the nature and purpose of such Processing, the type of Personal Data and categories of data subjects and the obligations and rights of the Controller in respect of such Processing, is set forth in Annex 1 (Description of Processing), attached hereto.

Confidentiality

Processor shall only authorize persons to participate in the Processing of the Controller Personal Data who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Data Subject Rights

Taking into account the nature of the processing, Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible and at the Controller’s expense, for the fulfilment of the Controller’s obligations as a data controller under Applicable Law to respond to requests for exercising of data subject’s rights pursuant to EU Data Protection Applicable Law.

Assistance

Processor shall assist Controller, at Controller’s expense, in complying with its obligations pursuant to Articles 32 to 36 of the GDPR as may be relevant to Processing of Controller Personal Data performed by Processor and taking into account the nature of processing and the information available to Processor.

Notifications of Data Breach

Processor shall notify Controller without undue delay after becoming aware of a Personal Data Breach. Such notice shall:

1. Describe the nature of the personal data breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
2. Communicate the name and contact details of the data protection officer or other contact point of Processor where more information, if available, can be obtained;
3. Describe the likely consequences of the Personal Data Breach; and
4. Describe the measures taken or proposed to be taken by Processor to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

Where, and in so far as, it is not possible for Processor to provide such information at the same time, the information may be provided in phases without undue further delay.

Demonstrating Compliance; Audits

Each Party shall, following the other Party’s written request and at such requesting Party’s expense, make available to the other reasonable information necessary for the requesting Party to demonstrate compliance with the obligations applicable to it pursuant to Applicable Law and to allow for and contribute to audits, including inspections, conducted by such Party or its designated auditor (subject to an undertaking of confidentiality).

All audits of another Party shall be performed at a time and manner determined jointly by the Parties, and in any case in a manner which does not interfere with the operations of the audited Party, and not more than a reasonable number of times in any given period. The auditing Party shall be responsible for all costs and expenses incurred by the audited Party as a result of the audit.

All information learned or obtained during such audits shall be deemed Confidential Information of the audited Party and any third-party person or entity participating or performing the audit shall execute a non-disclosure agreement with the audited Party at least as protective of such Confidential Information as the relevant provisions of the Agreement.

Deletion or Return of Data

Processor shall delete all Controller Personal Data to the Controller following termination of the provision of Services, except regularly scheduled backups which shall be retained for a reasonable period and then deleted. Notwithstanding the above, Processor may retain Controller Personal Data to the extent EU Data Protection Laws or the laws of any European Union member state require storage of such Personal Data.

Security

Processor and Controller shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Such measures may include, inter alia, as appropriate:

1. The pseudonymisation and encryption of personal data;
2. The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
3. The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and
4. A process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.

In assessing the appropriate level of security, Controller and Processor shall take account in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored or otherwise Processed.

Subprocessors

Controller agrees that Processor may engage Subprocessors to carry out Processing activities as part of the provision of the Services. The list of approved Subprocessors is detailed in Annex 1.

Processor shall notify Controller of the appointment of new Sub-processors. Customer may reasonably object to Processor’s use of a Sub-processor for reasons related to data privacy/security by notifying Processor promptly in writing within three (3) business days after receipt of Processor’s notice and such written objection shall include the reasons related to data privacy/security for objecting to Processor’s use of such Sub-processor.

Failure to object to such Sub-processor in writing within three (3) business days following Processor’s notice shall be deemed as acceptance of the Sub-Processor.

In the event Controller reasonably objects to a Sub-processor, as permitted in the preceding sentences, Processor will use reasonable efforts to make available to Controller a change in the Services or recommend a commercially reasonable change to Controller’s use of the Services to avoid Processing of Controller Personal Data by the objected-to Sub-processor without unreasonably burdening the Controller. If Processor is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Controller may, as a sole remedy, terminate the Agreement and this Addendum with respect only to those Services which cannot be provided by Processor without the use of the objected-to Sub-processor by providing written notice to Processor.

Until a decision is made regarding the Sub-processor, Processor may temporarily suspend the Processing of the affected Personal Data. Customer will have no further claims against Processor due to the termination (including, without limitation, requesting refunds) in the situation described in this paragraph.

Processor shall only engage Subprocessors pursuant to an agreement containing similar data protection obligations on the Subprocessor which apply to Processor in this Addendum. Engagement of a Subprocessor by Processor shall not derogate from Processor’s obligations to Controller under this Agreement.

International Transfers

Transfers to countries that offer adequate level of data protection

Customer Personal Data may be transferred from the EU Member States, the three EEA member countries (Norway, Liechtenstein and Iceland) and the United Kingdom (collectively, “EEA”) to countries that offer adequate level of data protection under or pursuant to the adequacy decisions published by the relevant data protection authorities of the EEA, the Union, the Member States, the European Commission, or the UK secretary of state (“Adequacy Decisions”), without any further safeguard being necessary.

Transfers to other countries

If the Processing of Personal Data includes transfers from the EEA or the UK to countries which do not offer adequate level of data protection or which have not been subject to an Adequacy Decision (“Other Countries”), the following terms shall apply:

1. With respect to the EU transfers of Customer Personal Data, Customer as a Data Exporter and Processor as a Data Importer hereby enter into the Standard Contractual Clauses set out in Annex 2. If any conflict arises between this Addendum and the SCCs, the SCCs shall take precedence.
2. With respect to the UK transfers of Customer Personal Data, the parties enter into the UK Standard Contractual Clauses set out in Annex 2. If any conflict arises between this Addendum and the UK SCCs, the UK SCCs shall take precedence.

The “Additional Safeguards” in Annex 2 shall apply to any transfer of Personal Data to Other Countries.

Anonymous Information

The obligations of Controller hereunder do not concern the Processing of Anonymous Information, including, without limitation, Anonymous Information derived or rendered from Controller Personal Data, which Processor and its affiliates may use without restriction.

Controller’s Responsibility

Controller represents, warrants, and undertakes that all Controller Personal Data is and shall be collected, obtained and provided or made available to Processor in accordance with all Applicable Laws, including EU Data Protection Laws. Controller agrees that it is solely liable for the legality of the Processing of the Controller Personal Data by Processor (or its Subprocessors) which is done in accordance with the Agreement and this Addendum.

Without limitation of the foregoing, Controller will indemnify, keep indemnified and hold harmless Processor, its subcontractors and affiliates from and against all third party loss, harm, cost (including reasonable legal fees and expenses), expense and liability that an Indemnified Party may suffer or incur as a result of Controller's non-compliance with this Addendum.

Controller represents, warrants, and undertakes that it shall:

• Post a privacy policy describing its collection and Processing of Controller Personal Data which complies with all Data Protection Laws;
• Provide all required notices and obtain all required consents; and
• Comply with its Privacy Policy and any other statements, promises or warranties it has made regarding Personal Data.

Controller represents, warrants, and undertakes that except as expressly set forth in Annex 1, the Controller Personal Data shall not include:

• Sensitive or special categories of data, including genetic, biometric, or health data;
• Personal Health Information as defined under applicable law; or
• Personal data of children under the age of 18.

Changes in Law

In the event that Processor determines that the use of the Services or Processing of the Controller Personal Data, or any change in Applicable Law, requires additional agreements or documentation, Controller shall promptly execute such agreements or documents as reasonably required.

Applicable Law

Notwithstanding anything to the contrary, Processor will comply with Applicable Law and may refuse to comply with any instruction or request to the extent Processor reasonably believes that such instruction or request violates Applicable Law. Processor shall notify Controller of such refusal and the relevant Applicable Law, to the extent permitted.

Governing Law; Jurisdiction

This Addendum and any disputes relating to it shall be governed by the laws of the jurisdiction set forth in the Agreement, and adjudicated exclusively by the competent courts set forth therein.

Incorporation to Agreement

This Addendum is incorporated into and made part of the Agreement. In the event of a contradiction, the provisions of this Addendum shall prevail to the extent necessary to resolve such contradiction.

Annex 1 - Description of Processing

Subject Matter

Processor will Process Controller Personal Data as necessary to perform the Services pursuant to the Agreement, as further instructed by Controller in its use of the Services.

Nature and Purpose of Processing

1. Performing the Agreement, including providing the Services and technical maintenance;
2. Complying with documented reasonable instructions provided by Controller;
3. Resolving disputes and enforcing rights;
4. Managing the Agreement, including fees, administration, accounting, and taxes; and
5. Complying with applicable laws and regulations.

Duration of Processing

Processor will Process Controller Personal Data for the duration of the Agreement unless otherwise agreed in writing.

Type of Personal Data

• Contact and registration data (e.g., name, email)
• Calendar data (meeting details)
• Meeting content (recordings, transcripts, summaries, action items, follow-ups)
• AI data (inputs, queries, correspondence with AI models)
• Social media data (if connected)
• Documents, reports, photos, and any attachments uploaded to the Services
• Any interactions with other users of the Services

Categories of Data Subjects

• Controller’s employees, agents, advisors, and freelancers
• Controller’s customers and/or prospective customers
• Any other individual with whom Controller or its representatives interact

Frequency and Retention

Processing occurs on a continuous basis. Personal Data is retained for as long as the Addendum is in effect, and thereafter as determined by the Controller and described in the Agreement.

Authorized Subprocessors

Annex 2 - Standard Contractual Clauses

The Standard Contractual Clauses (“EU SCCs”) set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021 shall be deemed incorporated into this DPA as applicable. Modules Two and Three apply as relevant. The SCCs are governed by the laws of Ireland, and disputes shall be heard by the courts of Ireland.

For UK transfers, the International Data Transfer Addendum to the EU SCCs (“UK Addendum”) issued by the ICO applies. It is governed by the laws of England and Wales, and disputes shall be resolved in the courts of England and Wales unless otherwise agreed.

Additional Safeguards are detailed below:

1. The data importer shall maintain encryption and network protection to prevent interception or unauthorized access.
2. The data importer shall use commercially reasonable efforts to resist requests for bulk surveillance or unlawful access.
3. Where government access is legally compelled, the data importer shall, if possible, notify the data exporter and provide relevant details.
4. Once every 12 months, the data importer shall provide a summary of government access requests received, to the extent permitted by law.

Annex 3 - Israeli Addendum

This Annex applies if the Processing of Controller Personal Data includes data subject to Israel’s Privacy Protection Law, 1981.

Data Protection Laws

Shall include, in addition to those defined in the Addendum, the Israeli Privacy Protection Law, 1981 and the regulations thereunder.

Data Transfers

If Controller Personal Data is transferred to a subprocessor outside Israel, such transfer shall comply with the Israeli Privacy Protection Regulations (Transfer of Information to Databases Outside the State), 2001.

Technical and Organizational Measures

Processor shall maintain sufficient and appropriate environmental, physical, and logical security measures to prevent unauthorized access, including:

• Maintaining secure infrastructure and regularly updated systems;
• Separating database systems from general systems where feasible;
• Listing and monitoring all hardware and software used for processing;
• Restricting and logging employee access to Personal Data and facilities;
• Implementing automated access control verification with periodic review;
• Maintaining access control logs for at least 24 months; and
• Holding a valid SOC 2 certification throughout the Agreement term.

Processor shall not transfer Customer Personal Data through public networks without using industry-standard encryption methods.