Data Processing Addendum

This Data Processing Addendum (this “DPA”) supplements and is incorporated into the Terms of Service, or the Master Services Agreement and applicable Order Form(s), between Path 6, LLC, a Texas limited liability company doing business as Pentaria (“Pentaria”), and the customer that has agreed to that agreement (“Customer”) (as applicable, the “Agreement”). This DPA applies to the extent Pentaria processes Personal Data on Customer’s behalf in the course of providing the Services under the Agreement. Capitalized terms not defined in this DPA have the meanings given in the Agreement.

For Customers operating under Pentaria’s Terms of Service, this DPA is incorporated by reference and takes effect automatically upon Customer’s acceptance of the Terms of Service, without a separate signature, to the extent Pentaria processes Personal Data on Customer’s behalf. For Customers operating under a Master Services Agreement, this DPA takes effect upon execution by both parties on the signature page below, or, if earlier, upon Pentaria’s processing of Customer Personal Data under the Agreement.

1. Definitions

1.1 “Applicable Data Protection Laws” means all data protection and privacy laws applicable to the processing of Customer Personal Data under this DPA, including, as applicable, the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”), the UK GDPR and the UK Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), and other applicable U.S. state privacy laws.

1.2 “Controller,” “Processor,” “Data Subject,” “Personal Data,” “Processing,” and “Personal Data Breach” have the meanings given in the GDPR; equivalent terms under other Applicable Data Protection Laws (including “Business,” “Service Provider,” “Consumer,” and “Personal Information” under the CCPA) are construed accordingly.

1.3 “Customer Personal Data” means Personal Data that Pentaria processes on Customer’s behalf in connection with the Services, as described in Annex 1.

1.4 “SCCs” means the Standard Contractual Clauses approved by the European Commission under Commission Implementing Decision (EU) 2021/914 (Module Two: Controller to Processor), as may be updated or replaced, and, for transfers subject to the UK GDPR, the UK Information Commissioner’s International Data Transfer Addendum to those clauses.

1.5 “Sub-processor” means any third party engaged by Pentaria to process Customer Personal Data.

1.6 “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data.

2. Roles of the parties

2.1 Customer is the Controller (or, where applicable, a Processor acting on behalf of a third-party Controller) of Customer Personal Data, and Pentaria is a Processor acting on Customer’s behalf, or Customer’s Sub-processor, as applicable, with respect to Customer Personal Data.

2.2 Customer will comply with its own obligations as a Controller (or Processor) under Applicable Data Protection Laws, including with respect to the instructions it gives Pentaria and the lawful basis for the processing.

3. Scope and instructions

3.1 Pentaria will process Customer Personal Data only: (a) to provide the Services in accordance with the Agreement; (b) in accordance with Customer’s documented instructions, which the parties agree include the Agreement and this DPA; and (c) as required by applicable law, in which case Pentaria will, where legally permitted, inform Customer of that legal requirement before processing.

3.2 The subject matter, duration, nature and purpose of processing, types of Customer Personal Data, and categories of Data Subjects are described in Annex 1.

3.3 Pentaria will promptly inform Customer if, in its reasonable opinion, an instruction from Customer violates Applicable Data Protection Laws.

4. Personnel

Pentaria will ensure that personnel authorized to process Customer Personal Data are subject to a binding written obligation of confidentiality.

5. Security

5.1 Pentaria will implement and maintain the technical and organizational security measures described in Annex 2, designed to protect Customer Personal Data against Security Incidents and to preserve its confidentiality, integrity, and availability, taking into account the state of the art, costs of implementation, and the nature, scope, context, and purposes of processing.

5.2 Customer is responsible for assessing whether Pentaria’s security measures are appropriate for Customer’s particular use case and regulatory obligations.

6. Sub-processors

6.1 Customer provides Pentaria general written authorization to engage Sub-processors to process Customer Personal Data, provided Pentaria: (a) maintains a current list of Sub-processors, available on request or as set out in Annex 3; (b) imposes data protection obligations on each Sub-processor materially no less protective than those in this DPA; and (c) remains liable to Customer for each Sub-processor’s performance of its obligations.

6.2 Pentaria will notify Customer (by email or in-product notice, or by updating its published Sub-processor list) at least 10 days before authorizing any new Sub-processor to process Customer Personal Data, except in urgent cases. Customer may object in writing within 10 days of that notice on reasonable data-protection grounds; if the parties cannot resolve the objection, Customer’s exclusive remedy is to terminate the affected Services in accordance with the Agreement.

7. Data subject requests

7.1 Taking into account the nature of the processing, Pentaria will provide reasonable assistance to Customer, by appropriate technical and organizational measures, to help Customer fulfill its obligation to respond to requests from Data Subjects to exercise their rights under Applicable Data Protection Laws.

7.2 If Pentaria receives a request directly from a Data Subject regarding Customer Personal Data, Pentaria will not respond to the request, other than to acknowledge receipt, except on Customer’s documented instructions or as required by law, and will promptly notify Customer of the request.

8. Personal data breach notification

8.1 Pentaria will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data.

8.2 Pentaria’s notification will include, to the extent then known, a description of the nature of the Security Incident, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Pentaria may provide this information in phases as it becomes available.

8.3 Pentaria will take reasonable steps to mitigate the effects of a Security Incident and to minimize any resulting damage.

9. Data protection impact assessments

Taking into account the nature of processing and the information available to Pentaria, Pentaria will provide reasonable assistance to Customer with data protection impact assessments, and with prior consultations with supervisory authorities, that Customer reasonably considers necessary under Applicable Data Protection Laws.

10. International data transfers

10.1 Pentaria may process Customer Personal Data in the United States and other countries where Pentaria or its Sub-processors operate.

10.2 To the extent the transfer of Customer Personal Data out of the European Economic Area, United Kingdom, or Switzerland to Pentaria (or a Sub-processor) requires a data transfer mechanism under Applicable Data Protection Laws, the SCCs are incorporated into this DPA by reference to govern that transfer, completed as follows: Customer is the data exporter and Pentaria is the data importer; Module Two (Controller to Processor) applies, or Module Three (Processor to Processor) applies where Customer is itself a Processor; the optional docking clause (Clause 7) is included; the general Sub-processor authorization and objection procedure in Section 6 of this DPA applies for purposes of Clause 9(a); the optional redress language in Clause 11(a) is not included; and the SCCs are governed by, and subject to the courts of, Ireland pursuant to Clauses 17 and 18(b). For transfers subject to the UK GDPR, the UK Information Commissioner’s International Data Transfer Addendum is incorporated by reference to apply the SCCs to those transfers.

10.3 Where a Sub-processor is certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), the parties may rely on that certification as an alternative transfer mechanism to the extent permitted by Applicable Data Protection Laws.

11. Audits

11.1 On Customer’s written request, no more than once per 12-month period (or more frequently if required following a Security Incident or by a supervisory authority), Pentaria will make available information reasonably necessary to demonstrate compliance with this DPA, which Pentaria may satisfy by providing a summary of its security practices, responses to a reasonable security questionnaire, or a relevant third-party audit or certification report then available, in lieu of an on-site audit.

11.2 If the information provided under Section 11.1 is insufficient, Customer may conduct an audit of Pentaria’s relevant policies and procedures, at Customer’s expense, on at least 30 days’ written notice, during business hours, subject to reasonable confidentiality protections and without unreasonably disrupting Pentaria’s business.

12. Deletion and return of Customer Personal Data

Upon expiration or termination of the Agreement, or upon Customer’s written request, Pentaria will, at Customer’s election, delete or return all Customer Personal Data in its possession or control, and will delete existing copies, except to the extent applicable law requires Pentaria to retain some or all of the Customer Personal Data, in which case Pentaria will isolate and protect that data from further processing except as required by that law.

13. CCPA and other U.S. state privacy laws

13.1 To the extent Pentaria processes Personal Information (as defined under the CCPA) on Customer’s behalf as a “Service Provider” (or equivalent role under other applicable U.S. state privacy laws), Pentaria certifies that it will not: (a) sell or share Personal Information; (b) retain, use, or disclose Personal Information for any purpose other than performing the Services specified in the Agreement, or as otherwise permitted by the CCPA; or (c) combine Personal Information received from or on behalf of Customer with Personal Information Pentaria receives from other sources, except as permitted by the CCPA.

13.2 Pentaria will provide reasonably requested assistance to Customer in responding to verifiable consumer requests under applicable U.S. state privacy laws, to the extent required of a Service Provider.

14. Liability

Each party’s liability arising out of or related to this DPA, whether in contract, tort, or otherwise, is subject to the limitations and exclusions of liability set out in the Agreement (including the applicable limitation-of-liability provisions of the Terms of Service or Master Services Agreement), which are incorporated into this DPA by reference.

15. Governing law; relationship to the Agreement

This DPA is governed by the same governing law and dispute resolution provisions as the Agreement it supplements, except that the SCCs (and any transfer governed by them) are governed by the law specified in Clause 17 of the SCCs, as completed in Section 10.2 above. This DPA supplements the Agreement; in the event of a conflict between this DPA and the Agreement regarding the processing of Personal Data, this DPA controls, and in all other respects, the Agreement controls.

16. Term

This DPA remains in effect for as long as Pentaria processes Customer Personal Data on Customer’s behalf under the Agreement.

17. Signatures

This signature page applies to Customers executing this DPA in connection with a Master Services Agreement. Customers operating solely under Pentaria’s Terms of Service are not required to countersign; this DPA is incorporated by reference as described above.

Annex 1 — Description of processing

Subject Matter: Pentaria’s provision of the Services (access to the Site and license to the Materials) under the Agreement.

Duration: For the term of the Agreement, plus any period during which Pentaria retains Customer Personal Data in accordance with Section 12 of this DPA.

Nature and Purpose: Account creation and administration; authentication and license/seat management; billing and payment processing; customer support; product delivery and updates; and, where applicable, delivery of custom development services under a SOW.

Categories of Data Subjects: Customer’s Authorized Users (employees and contractors); Customer’s billing and administrative contacts; and, where applicable, individuals whose data is included in content shared with Pentaria under a SOW.

Types of Customer Personal Data: Name, business email address, job title, and phone number; an optional profile photo or avatar; login and account credentials, including authentication data processed by Pentaria’s identity provider; billing and payment-related information (e.g., invoice and payment records, and, for payments made by wire or ACH, bank account and routing information; if credit card payment is offered in the future, payment card data will be processed by a third-party payment processor); Site usage and license/seat data, including product usage analytics; and, where applicable, any personal data included in content shared under a SOW, as described in that SOW.

Sensitive Data: The parties do not anticipate that special categories of Personal Data (as defined under Applicable Data Protection Laws) will be processed under the Agreement. If Customer intends to share such data, including under a SOW, Customer will notify Pentaria in advance and the parties will agree on appropriate additional safeguards.

Annex 2 — Technical and organizational security measures

Access Control: Role-based access controls, unique user credentials, multi-factor authentication for administrative access, and periodic access reviews.

Encryption: Encryption of Customer Personal Data in transit using TLS, and encryption at rest for stored account and billing data.

Confidentiality: Written confidentiality obligations for personnel with access to Customer Personal Data, and periodic security awareness training.

Incident Response: A documented security incident response process, including the notification procedures in Section 8 of this DPA.

Vendor Management: Due diligence and contractual data protection obligations for Sub-processors, as described in Section 6 of this DPA.

Business Continuity: Routine backups of account and billing data, and reasonable measures to restore availability of Customer Personal Data in a timely manner following a physical or technical incident.

Data Minimization: Pentaria collects and processes Customer Personal Data limited to what is necessary for the purposes described in Annex 1, and does not process any prompts, data, or outputs Customer submits to or receives from a Customer AI Platform.

Annex 3 — Sub-processors

Current as of the Effective Date of this DPA. An up-to-date list is available from Pentaria on request.