Data Protection Addendum

1. Purpose

This Data Protection Addendum (“Addendum”) is entered into between Nunchux AI, Inc. (“Provider”) and the individual or organization agreeing to this Agreement (“Customer”) for use of the “Services” (each a “Party” and collectively, the “Parties”). This Addendum supplements and forms part of any existing, current, or future agreement between the Parties (any such agreement being individually or together referred to as the “Agreement”) and will terminate when the last Agreement in effect terminates unless extended by the Parties. This Addendum will be in effect as of the effective date of the Agreement (“Effective Date”); provided, however, the relevant obligations apply only to the extent that (i) Personal Data is subject to the Applicable Data Privacy Laws; and (ii) an Applicable Data Privacy Law has taken effect.

2. Relationship with the Agreement

In the event of a conflict between this Addendum and the Agreement, the Addendum will control to the extent necessary to resolve the conflict.

3. Definitions

Capitalized terms used but not defined have the meanings given in the Agreement.

• “Applicable Data Privacy Laws”: all U.S. data protection and privacy laws applicable to the Processing of Personal Data under the Agreement, including, but not limited to, the California Consumer Privacy Act (“CCPA”), as amended from time to time and including any regulations promulgated thereunder.
• “Consent”: a Data Subject’s freely given, specific, informed, and unambiguous indication of the Data Subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the Processing of Personal Data relating to him or her.
• “Controller”: the entity that determines the purposes and means of Processing Personal Data. “Controller” includes equivalent terms in other Applicable Data Privacy Laws, such as the CCPA-defined terms “Business” and “Third Party,” as context requires.
• “Data Breach”: “breach of the security of the system,” “security breach,” “breach of security,” “breach of system security,” and other analogous terms referenced in Applicable Data Privacy Laws.
• “Data Subject”: an identified or identifiable natural person. Data Subject includes a Consumer as that term is defined under Applicable Data Privacy Laws.
• “Personal Data”: information that is linked or linkable, directly or indirectly, to an identified or identifiable natural person. “Personal Data” includes equivalent terms in Applicable Data Protection Laws, such as the CCPA-defined term “Personal Information,” as context requires.
• “Processor”: an entity that Processes Personal Data on behalf of another entity. “Processor” includes equivalent terms in other Applicable Data Privacy Laws, such as the CCPA-defined term “Service Provider,” as context requires.
• “Sensitive Data”: the following types and categories of data: Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, a mental or physical health condition or diagnosis, sex life or sexual orientation, citizenship or immigration status; genetic data; biometric data; neural data; government identification numbers; payment card information; unencrypted identifier or username in combination with a password or other access code that would allow access to an account; precise geolocation information; and information from a known child.
• “Subprocessor”: a Processor engaged by a Party who is acting as a Processor.
• The following terms have the meanings assigned to them in Applicable Data Privacy Laws: “Business,” “Business Purpose,” “Process” (and its cognates), “Sale” (and its cognates), “Service Provider,” “Share” (and its cognates), and “Third Party.”

4. Status of the Parties

The parties intend for Customer to act as the Controller, and Provider to act as the Processor/Service Provider with respect to the Personal Data Processed under the Agreement and this Addendum.

5. Description of the Parties’ Personal Data Processing Activities

Schedule 1 describes the purposes of Parties’ Processing, the types or categories of Personal Data involved in the Processing, and the categories of Data Subjects affected by the Processing.

6. General Data Privacy Obligations

6.1 Compliance.

The Parties will comply with their respective obligations under Applicable Data Privacy Laws, including by providing the same level of privacy protection that is required of Businesses under the CCPA. Customer agrees to be responsible for providing notice to and obtaining consent from Data Subjects for the processing and sharing of Personal Data with Provider as may be required by Applicable Data Privacy Laws.

Upon request, Provider will provide reasonably relevant information to Customer to enable Customer to fulfill its obligations (if any) to conduct data protection assessments or prior consultations with data protection authorities, at Customer’s cost. Where any action under this Addendum is at Customer’s cost, Customer will pay Provider’s costs as determined by Provider within ten (10) days of written request by Customer. Provider may request Customer to pay an estimated amount of Provider’s costs in advance before Provider is obligated to take any action that is at Customer’s cost; Customer will also pay any amount of Provider’s actual costs that exceed the estimate.

6.2 Notification.

Provider will notify Customer if it determines that it can no longer meet its obligations under Applicable Data Privacy Laws or if it determines that Customer’s Processing instructions violate Applicable Data Privacy Laws.

7. Provider’s Obligations as a Processor, Subprocessor, or Service Provider

Provider will have the obligations set forth in this Section if it Processes the Personal Data of Data Subjects in its capacity as Customer’s Processor or Service Provider. The provisions of this Section 6 apply to the extent they are required by Applicable Data Privacy Laws.

7.1 Scope of Processing

• Provider will Process Personal Data solely for the Business Purposes specified in Schedule 1, to carry out its obligations under the Agreement, and to carry out Customer’s documented instructions.
• Processing any Personal Data outside the scope of the Agreement and this Addendum will require prior written agreement between Provider and Customer.
• Provider is prohibited from retaining, using, or disclosing the Personal Data (1) for any purpose other than the Business Purposes specified in Schedule 1, including retaining, using, or disclosing the Personal Data for a commercial purpose other than carrying out Customer’s instructions, (2) outside of the Parties’ direct business relationship, unless permitted by Applicable Data Privacy Laws, or (3) by combining Personal Data that Provider receives from, or on behalf of, Customer with Personal Data that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the Data Subject, provided that Provider may combine Personal Data to perform any Business Purposes permitted by Applicable Data Privacy Law. Provider will not Sell or Share the Personal Data that it collects or obtains pursuant to the Agreement.
• If permitted by Applicable Data Privacy Laws, Provider may aggregate, de-identify, or anonymize Personal Data in accordance with requirements under Applicable Data Privacy Laws to create data that no longer meets the definition of Personal Data, and may use such aggregate, de-identified, or anonymized data to operate, maintain, protect, and improve the Services, including without limitation capacity planning, abuse prevention, and billing.

7.2 Confidentiality.

Provider will ensure that each person who Processes Personal Data is subject to a duty of confidentiality with respect to such Personal Data.

7.3 Compliance.

• Provider will assist Customer, at Customer’s cost, in complying with Data Subjects’ requests to delete and correct Personal Data under Applicable Data Protection Law when Customer forwards such requests that it receives to Provider and will make available to Customer any Personal Data in its possession that Customer needs to respond to Data Subjects’ requests to access their Personal Data.
• Provider will make available to Customer, upon the Customer’s reasonable request and at Customer’s cost, all information in its possession reasonably necessary to demonstrate Provider’s compliance with its obligations under Applicable Data Privacy Laws.

7.4 Permitted Activities.

Notwithstanding the foregoing prohibitions, Parties agree that Provider may, and Customer instructs Provider to, Process Personal Data for the following activities when necessary to support the Business Purposes specified in Schedule 1: detect data security incidents; protect against fraudulent or illegal activity; effectuate repairs; and maintain and improve the quality of the Services specified in Schedule 1.

7.5 Subprocessors.

If Provider discloses Personal Data to a Subprocessor for a Business Purpose, Provider and Subprocessor will enter into a written contract that prohibits the Subprocessor from (i) Selling or Sharing Personal Data; or (ii) retaining, using, or disclosing Personal Data for any purpose other than for the specific Business Purpose for which the Personal Data was disclosed. Provider will require any Subprocessor to comply with applicable obligations under Applicable Data Privacy Laws, including to provide the same level of privacy protection required of Businesses by the CCPA. Provider will notify Customer before engaging a Subprocessor (which may be by means of updating an online list of Provider’s Subprocessors) and give Customer an opportunity to object to the engagement for reasonable cause, specified in writing. If Customer objects to a Subprocessor, and Provider is unable to find a reasonable alternative, Provider shall have the right to terminate this Addendum and the Agreement without penalty and without further obligation. Customer approves the Subprocessors listed in Schedule 2. Provider will require Subprocessors to use security measures that offer materially no less security than this Addendum requires Provider to use.

7.6 Duration of Processing, Deletion and Return of Personal Data.

Provider shall retain Personal Data for a period coterminous with the term of the Agreement. At the expiration or termination of the Agreement, Provider will upon written request by Customer: (1) return all Customer Personal Data to Customer; or (2) upon request by Customer, destroy all Personal Data, in each case unless applicable laws require otherwise, destruction is impractical (such as where the Personal Data is in a Provider backup system), Provider needs the Personal Data to protect Provider’s legal rights, or the Parties agree otherwise expressly in writing. For any Personal Data that Provider retains after expiration or termination of the Agreement, Provider will continue to comply with this Addendum.

7.7 Assessment and Remediation.

• Customer may take reasonable and appropriate steps, as provided in Applicable Data Privacy Laws, to ensure Provider Processes the Personal Data in a manner consistent with Customer’s obligations under Applicable Data Privacy Laws, including by conducting reasonable assessments or audits (no more than once every twelve (12) month period), at Customer’s cost and as provided by Applicable Data Privacy Laws. The Parties agree that this obligation is fulfilled by Provider making available, upon request, and subject to appropriate redactions and confidentiality obligations, a summary of Provider’s then-current independent third-party certifications or audit reports, answering reasonable questionnaires from Customer, and providing other relevant documentation necessary to demonstrate compliance. If, and solely to the extent the foregoing are insufficient to demonstrate Provider’s compliance with this Addendum, or where further reviews or audits are required by Applicable Data Privacy Laws, the Parties shall negotiate in good faith regarding the scope and nature of such reviews and audits, provided that any such reviews/audits: (i) shall be limited to the extent necessary for Provider to demonstrate compliance with this Addendum or comply with the requirements of Applicable Data Privacy Laws or request of the competent supervisory authority; (ii) may be limited, in Provider’s reasonable discretion, to the extent necessary to avoid disclosure of third party confidential information; (iii) shall be subject to any relevant requirements or limitations of Provider’s authorized Subprocessors; and (iv) shall be conducted on no less than 30-days prior notice, in good faith, with minimal disruption, at Customer’s sole expense, and during normal business hours.
• If Customer discovers material unauthorized use of Personal Data by Provider or Provider’s Subprocessors, Customer may, upon written notice to Provider, take reasonable and appropriate steps to remediate such unauthorized use.

8. International Data Transfer

Customer authorizes Provider’s Processing of Personal Data in the United States as required pursuant to the terms of the Agreement. Provider shall ensure that Personal Data remains adequately protected to the extent required under applicable Data Privacy Law. The parties shall negotiate in good faith any further agreements or supplemental measures which may be required under Applicable Data Privacy Laws in relation to the international transfer of Personal Data prior to any such transfer.

9. Security

• Provider will implement the technical and organizational measures described in Schedule 3, which are intended to protect Personal Data from a Data Breach and preserve the security and confidentiality of Personal Data. Provider shall obtain independent validation of its technical and organizational measures and comply with all measures set forth on Schedule 3.
• Upon becoming aware of a Data Breach, Provider will:
  • Notify Customer of the Data Breach promptly after confirming that a Data Breach has occurred that involves Customer Personal Data;
  • Promptly investigate or perform required assistance in the investigation of the Data Breach and provide Customer with detailed information about the Data Breach, including (after Customer confirmation) to the extent known by Provider, a description of the Data Breach, the approximate number of Data Subjects affected, the Data Breach’s impact, and the measures Provider is taking to address the Data Breach and mitigate its effects, excluding Provider’s privileged information; and
  • Promptly take all commercially reasonable steps to mitigate the effects of the Data Breach or assist Customer in doing so.

Provider must obtain Customer’s written approval before notifying any governmental entity, individual, the press, or other third party of a Data Breach that affected Personal Data that Provider obtained from, or Processed on behalf of, Customer. Notwithstanding anything to the contrary in this Addendum, Provider may notify any third party about a Data Breach affecting Personal Data if it is under a legal obligation to do so or as necessary to protect Provider’s rights or property. Provider will reasonably assist Customer in communicating a Data Breach to a supervisory authority where required by Applicable Data Privacy Law. Provider will take the actions in this Section 8 at Customer’s cost, unless the Data Breach was caused solely by Provider’s breach of this Addendum.

10. Representations and Warranties of Customer

Customer represents and warrants that it has and will maintain all necessary rights to the Personal Data, will make all necessary disclosures, and obtain necessary consents, for Provider to Process the Personal Data as required by and permitted by the Agreement and this Addendum. Customer will notify Provider as soon as possible in writing if it no longer has those rights, made those disclosures, or obtained those consents with as much specificity as is reasonably possible. This warranty will survive the termination of this Addendum.

11. Miscellaneous

11.1 Entire agreement.

This Addendum is the Parties’ entire agreement on this subject and merges and supersedes all related prior and contemporaneous oral understandings, representations, prior discussions, letters of intent, or preliminary agreements.

11.2 No further amendment.

Except as modified by this Addendum, the Agreement remains unmodified and in full force and effect.

12. Schedule 1: Description of the Processing

13. Schedule 2: Provider Subprocessors

Provider uses Subprocessors to support the provision of the Services. The Provider Subprocessor List identifies Subprocessors authorized to subprocess Customer Data on behalf of Provider to provide Services to our Customers. This list is applicable for all Services governed by the Addendum, and is available upon request at [email protected].

14. Schedule 3: Technical and Organizational Security Measures

In its capacity as a Processor, Provider has implemented an information security policy that addresses:

• Data minimization
• Purpose limitation
• User rights management
• Encryption in transit and at rest
• Multi-factor authentication for all access to Customer data
• Role-based access controls with least privilege
• Access logging retained for minimum 12 months
• Network segmentation and firewalls
• Intrusion detection/prevention systems
• Regular vulnerability scanning and penetration testing