Data Processing Agreement

DATA PROCESSING AGREEMENT

This Data Processing Agreement (the “DPA”) is entered into by and between Customer and Anysource, Inc. dba Runlayer and forms part of the Master Services Agreement or other written agreement between the parties governing Customer’s use of the Services (the “Agreement”). This DPA applies solely to the Processing of Personal Data by Runlayer on behalf of Customer and is effective as of the Effective Date of the Agreement.

1) DEFINITIONS

Incorporation of Agreement Definitions. Capitalized terms used but not defined in this DPA have the meanings assigned to them in the Agreement, including, but not limited to, Customer Data, Personal Data, Customer Results, Services Telemetry, and Services, which apply to this DPA without modification.

a) “Applicable Data Protection Laws” means all applicable laws relating to privacy, data protection, data security, and the Processing of Personal Data under this Agreement, including the GDPR, the UK GDPR, the CCPA, PIPEDA, and other applicable Canadian federal and provincial privacy laws, as well as applicable United States state privacy laws.

b) “Controller”, “Processor”, “Data Subject”, “Personal Data Breach”, “Processing”, “Supervisory Authority”. These terms have the meaning assigned under Applicable Data Protection Laws.

c) Security Incident” means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Information Processed by Runlayer on behalf of Customer.

d) “Subprocessor” means any third party engaged by Runlayer to Process Personal Data on behalf of Customer.

e) “Standard Contractual Clauses” or “SCCs” means one or both of the following, as the context requires:

i) the “2021 SCCs,” defined as the clauses issued pursuant to the EU Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, available at https://eur-lex.europa.eu/eli/dec_impl/2021/914 and completed as described in the “International Transfers” section below.

ii) the “UK Addendum,” defined as the United Kingdom Information Commissioner’s International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0 of which is available at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf), and completed as described in the “International Transfers” section below.

iii) the “Swiss Addendum,” defined as the 2021 SCCs as modified to apply to transfers of personal data from Switzerland, completed as described in the “International Transfers” section below and incorporating the modifications required under the Swiss Federal Act on Data Protection.

2) SCOPE AND ROLES

a) Controller and Processor. Customer is the Controller and Runlayer is the Processor of Personal Data.

b) Scope of Processing. This DPA governs the Processing of Personal Data in connection with the Services.

c) Customer Instructions. Runlayer will Process Personal Data on only documented instructions from Customer or as required by Applicable Data Protection Laws. Customer warrants that it has a valid legal basis for Processing Personal Data and for providing it to Runlayer, and that its instructions comply with Applicable Data Protection Laws.

d) No Determination of Purpose: Runlayer does not determine the purposes or means of Processing Personal Data.

3) PROCESSING OF PERSONAL DATA

a) Purpose. Runlayer will Process Personal Data solely to:

i) provide, maintain, secure, and support the Services in accordance with the Agreement;

ii) perform troubleshooting, diagnostics, and security functions;

iii) follow Customer’s documented instructions; and

iv) comply with Applicable Data Protection Laws.

b) No Secondary Use of PI. Runlayer will not use Personal Data to train Runlayer’s models, to develop or improve products or services beyond performing the Services for Customer, for cross-customer purposes, or for any other secondary purpose.

c) Authorized Personnel. Only personnel with a strict need-to-know may Process Personal Data and must be bound by confidentiality obligations.

4) SECURITY

a) Security Measures. Runlayer will implement and maintain the technical and organizational measures described in Annex II, consistent with Article 32 GDPR and equivalent requirements.

b) Customer Responsibilities. Customer is responsible for secure configuration and use of the Services and ensuring that Personal Data is provided to Runlayer only as permitted under the Agreement and this DPA.

5) SUBPROCESSORS

a) General Authorization. Customer grants Runlayer a general authorization to engage subprocessors for Processing Personal Data.

b) Subprocessor Contracts. Runlayer will impose data-protection obligations on all subprocessors that are no less protective than those in this DPA. For clarity, this Section 5(b) does not apply to hyperscale infrastructure providers identified in Section 5(e), whose standardized, non-negotiable terms Runlayer cannot modify; however, Runlayer will ensure that such providers offer data-protection commitments consistent with Applicable Data Protection Laws.

c) Notice of New Subprocessors. Runlayer’s current list of subprocessors is available at: https://runlayer.com/legal/subprocessors. Runlayer will update this list at least thirty (30) days before authorizing any new Subprocessor that will Process Personal Data, unless prohibited by Applicable Data Protection Laws or by the non-negotiable terms of a hyperscale infrastructure provider identified in Section 5(e). Runlayer will notify Customer of any such updates by email to Customer’s designated notice address, through the Services’ administrative console, or by any other direct written notice method reasonably designed to reach Customer.

d) Objection Right (GDPR). Customer may object to a new subprocessor based on reasonable data-protection grounds. If unresolved after 30 days, Customer may terminate only those Services requiring that subprocessor, without penalty. This right applies solely to Processing of Personal Data, not to processing governed exclusively by the MSA.

e) Hyperscalers. Notwithstanding Section 5(d) (Objection Right), Customer acknowledges that certain infrastructure or platform providers used by Runlayer—such as Amazon Web Services, Google Cloud Platform, Microsoft Azure, or materially similar large cloud providers—operate under standardized, non-negotiable terms and cannot be substituted or modified for individual customers. Customer may not object to Runlayer’s use of such hyperscale infrastructure providers, provided that Runlayer has entered into data-protection terms with such providers that comply with Applicable Data Protection Laws.

6) DATA SUBJECT REQUESTS

a) Runlayer will provide reasonable assistance for Customer to respond to Data Subject requests.

b) If Runlayer receives a request directly, unless prohibited by Applicable Laws, it will notify Customer and will not respond except on documented instructions.

7) SECURITY INCIDENTS

a) Notification. Runlayer will notify Customer without undue delay after a confirmed Security Incident affecting Personal Data Processed on behalf of Customer has occurred.

b) Content of Notification. Runlayer’s notification will include, to the extent reasonably known at the time:

i) a description of the nature of the Security Incident, including, where possible, the categories and approximate number of affected Data Subjects and Personal Data records;

ii) the likely consequences of the Security Incident;

iii) the measures taken or proposed to be taken by Runlayer to address the Security Incident, including measures to mitigate its possible adverse effects; and

iv) contact information for a point of contact who will coordinate breach-related communications.

Runlayer may provide information in phases as it becomes available.

c) Cooperation. Runlayer will reasonably cooperate with Customer, at Customer’s request, in Customer’s assessment of and response to the Security Incident, including providing information necessary for Customer to:

i) comply with its legal obligations (including notification obligations to regulators or affected individuals); and

ii) meet any legally required documentation or record-keeping obligations.

d) Limitations. Runlayer is not required to notify Customer of unsuccessful or immaterial security events, including routine scans, pings, failed login attempts, or similar events that do not compromise the confidentiality, integrity, or availability of Personal Data.

e) No Admission. Notification by Runlayer of a Security Incident shall not be construed as an admission of fault, liability, or wrongdoing.

8) AUDITS AND COMPLIANCE

a) Audits. Customer may conduct one audit in any twelve-month period solely to verify Runlayer’s compliance with this DPA, provided that Customer gives at least thirty (30) days’ prior written notice and submits a detailed audit plan describing the proposed scope, testing procedures, and duration. Runlayer may object to the audit plan if it would disrupt operations, compromise security, or exceed the scope permitted under this DPA, and Customer shall revise the plan accordingly. Runlayer may satisfy Customer’s audit request by providing its most recent SOC 2 Type II report, ISO/IEC 27001 certification, or other third-party audit or certification reports, together with written responses to reasonable security or privacy questionnaires. Customer shall accept these reports in lieu of conducting its own audit unless Applicable Data Protection Laws expressly require Customer to perform an audit that cannot be satisfied through such documentation. All audits are subject to Runlayer’s reasonable confidentiality, security, operational, technical, and facility access restrictions and must be conducted during normal business hours without interfering with Runlayer’s operations. Audits must be limited to systems, processes, and records relevant to the Processing of Personal Data for Customer. Remote audits shall be used unless an onsite audit is expressly required by Applicable Data Protection Laws and cannot be satisfied through remote measures or third-party reports. Any onsite audit shall be limited to one day unless otherwise agreed in writing.

b) Supervisory Authority Cooperation. Runlayer will cooperate with any lawful inquiry by a Supervisory Authority relating to Personal Data Processed on behalf of Customer.

9) INTERNATIONAL TRANSFERS

a) Permitted Transfers. Runlayer may transfer Personal Data internationally only in compliance with Applicable Data Protection Laws.

b) EU SCCs. The EU Standard Contractual Clauses apply to all transfers of Personal Data from the EEA to third countries lacking adequacy determinations.

c) UK Addendum. The ICO International Data Transfer Addendum to the EU Standard Contractual Clauses (“UK Addendum”) is incorporated by reference and applies to transfers of Personal Data subject to the UK GDPR. The completed version of the UK Addendum’s Tables (1–4) is set forth in Annex III, and the UK Addendum is deemed executed by the Parties and forms part of this DPA.

d) Swiss Addendum. The Swiss Addendum to the EU Standard Contractual Clauses, as required by the Swiss Federal Act on Data Protection, is incorporated into this DPA by reference and applies to transfers subject to the Swiss FADP. The applicable modifications to the SCCs are set forth in Annex III.

10) RETURN AND DELETION

a) Deletion or Return Upon Termination. Upon expiration or termination of the Agreement, Runlayer will, upon Customer’s written request:

i) return Personal Data to Customer; or

ii) delete Personal Data

in each case in accordance with Article 28 GDPR and in any case deletion shall occur no later than thirty (30) days from the time of expiration, termination or Customer’s written request.

b) Backup and Legal Retention. Runlayer may retain Personal Data:

i) in archival, backup, or disaster-recovery systems;

ii) as required by law; or as required for legal claims or defense,

provided such Personal Data is securely isolated and deleted in accordance with Runlayer’s retention schedule.

11) CCPA / CPRA TERMS. To the extent Runlayer Processes Personal Data subject to the CCPA/CPRA, Runlayer acts as Customer’s Service Provider. The Parties’ rights and obligations under the CCPA/CPRA, including all required Service Provider restrictions, are set forth exclusively in Annex IV (CCPA/CPRA Addendum), which is incorporated into this DPA and controls in the event of a conflict.

12) LIABILITY

a) MSA Governs. Except to the extent expressly prohibited by the SCCs, the limitations of liability set forth in the Agreement apply to this DPA and to all Processing of Personal Data under it.

b) SCC Carve-Out. To the extent the SCCs prohibit limitation of liability for the obligations imposed by the SCCs themselves, such liability shall not be limited; however, all other liability between the Parties remains subject to the limitations and exclusions in the Agreement.

13) PRECEDENCE. If there is a conflict between:

a) this DPA and the Agreement regarding Personal Data, this DPA controls;

b) this DPA and the SCCs, the SCCs control;

c) the SCCs and the UK or Swiss Addenda, the applicable Addendum controls.

ANNEX I

DETAILS OF PROCESSING

1. The Parties

1.1. Customer acts as Controller.

1.2. Runlayer acts as Processor.

2. Description of Processing

2.1. Subject matter: Processing Personal Data in connection with the Services.

2.2. Duration: The Subscription Term and any period thereafter during which Runlayer retains Personal Data per the Agreement.

2.3. Nature and purpose: Providing, maintaining, securing, supporting, and improving the Services as set forth in the Agreement.

2.4. Categories of Data Subjects: Customer’s employees, contractors, end users, and any other individuals whose data is submitted to the Services by Customer.

2.5. Categories of Personal Data: Identifiers, contact information, account data, and any Customer Data uploaded or transmitted to the Services.

2.6. Special categories: None, unless expressly agreed in writing.

ANNEX II

TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

Runlayer maintains a written information security program that includes administrative, technical, and physical safeguards appropriate to the nature of the Personal Data. These include, without limitation:

1. Access controls, including role-based access and multi-factor authentication.

2. Encryption of Personal Data in transit and at rest.

3. Network and system security, including monitoring, logging, and intrusion detection.

4. Vulnerability management and regular security testing.

5. Secure software development practices.

6. Incident response and breach notification procedures.

7. Business continuity and disaster recovery plans.

8. Sub-processor oversight and contractual security requirements.

Runlayer’s complete security measures are available at: https://runlayer.com/legal/security-addendum

ANNEX III

This Annex forms part of the DPA and supplements the EU Standard Contractual Clauses.

A. UK ADDENDUM

This section incorporates by reference the ICO International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (“UK Addendum”). The UK Addendum is deemed executed by both Parties, and its Tables 1–4 are completed as follows:

TABLE 1 — PARTIES

TABLE 2 — SELECTED SCCs

The “Approved EU Standard Contractual Clauses” are the EU Commission SCCs (Module 2 – Controller to Processor).

TABLE 3 — APPENDICES

TABLE 4 — MANDATORY CLAUSES

The Mandatory Clauses of the UK Addendum apply in full and are incorporated by reference without modification.

B. SWISS ADDENDUM

For transfers of Personal Data subject to the Swiss Federal Act on Data Protection (FADP), the SCCs apply with the following modifications:

These modifications are incorporated into this DPA and require no separate signature.

ANNEX IV

This Annex IV (“Addendum”) applies solely to the Processing of Personal Data subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”). This Addendum is incorporated into the DPA.

Terms not defined in this Addendum have the meanings given in the DPA or the Agreement.

1. Service Provider Status

Runlayer acts as Customer’s Service Provider under the CCPA/CPRA and shall Process Personal Data solely to perform the Services for Customer in accordance with the Agreement and the DPA.

2. CPRA Restrictions (Required Contract Terms)

Runlayer shall not:

a) Sell or Share Personal Data; b) retain, use, or disclose Personal Data for any purpose other than performing the Services or as otherwise permitted by the CCPA/CPRA; c) retain, use, or disclose Personal Data outside the direct business relationship with Customer; d) use Personal Data for cross-context behavioral advertising; ore) combine Personal Data received from Customer with Personal Data received from other sources, except as permitted under Cal. Civ. Code §1798.140(v).

Runlayer certifies that it understands and will comply with these restrictions.

3. Conflict

In the event of any conflict between this Addendum and the Agreement or the DPA, this Addendum controls solely with respect to Personal Data subject to the CCPA/CPRA.

STANDARD CONTRACTUAL CLAUSES (MODULE TWO: CONTROLLER TO PROCESSOR)

The EU Standard Contractual Clauses for the transfer of personal data to processors established in third countries (Module Two: Controller to Processor), as set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021, are incorporated into this DPA by reference and form part of this Agreement. The official text of the Standard Contractual Clauses is available at:

https://eur-lex.europa.eu/eli/dec_impl/2021/914

The Annexes to the Standard Contractual Clauses are completed as set out in Annex I, Annex II, and Annex III of this DPA. For the purposes of Clause 9 (Use of sub-processors), Option 2 (General Written Authorisation) applies, and the notice period is thirty (30) days. The governing law of the Standard Contractual Clauses is the law of Ireland, and disputes shall be resolved by the courts of Ireland.