Data Processing Addendum

“Applicable Data Protection Law” means a law applicable to a party’s processing under the Agreement concerning privacy, data protection, or security. “Customer Personal Data” means personal information, personal data, or an equivalent protected category contained in Customer Content that Cartograph processes on Customer’s behalf. “Data Subject,” “Controller,” “Processor,” “Business,” “Service Provider,” and “Sell” have the meanings given by applicable law. “Security Incident” means unauthorized acquisition of or access to Customer Personal Data in Cartograph’s possession or control, excluding unsuccessful attempts that do not compromise its security.

The Agreement controls general commercial matters. This DPA controls conflicts about processing Customer Personal Data. The applicable Standard Contractual Clauses control conflicts concerning a restricted international transfer.

Customer is the Controller or Business and Cartograph is the Processor or Service Provider for Customer Personal Data. If Customer acts as a Processor for another Controller, Cartograph acts as Customer’s subprocessor.

Cartograph will process Customer Personal Data only on Customer’s documented instructions, including the Agreement, this DPA, Customer’s configurations, Authorized User activity, workflows, and written directions. Those instructions authorize Cartograph to provide, host, secure, support, test, evaluate, debug, maintain, and improve the Cartograph service Customer uses; prevent abuse; carry out customer-directed integrations and communications; and comply with law. Cartograph will notify Customer if it believes an instruction violates Applicable Data Protection Law, unless law prohibits notice.

Cartograph will not use identifiable Customer Personal Data to train a third-party or general-purpose foundation model. Information that has been lawfully anonymized or de-identified so that it identifies neither a person nor Customer as its source is no longer Customer Personal Data, provided Cartograph maintains required safeguards and does not re-identify it except to test safeguards where law permits.

Customer is responsible for the lawfulness of its instructions and Customer Personal Data, including notices, lawful bases, consents, accuracy, minimization, retention choices, and responses to Data Subjects. Customer will not instruct Cartograph to process information in violation of law.

Customer acknowledges that ordinary business communications, calls, documents, and records may incidentally contain sensitive or special-category information. Customer will not intentionally submit regulated health data, full payment-card data, government identifiers, children’s data, biometric templates, or large-scale special-category data unless Cartograph has agreed in writing and required safeguards are in place.

Cartograph will ensure that personnel authorized to process Customer Personal Data are subject to confidentiality obligations and receive access only as needed for their duties. Cartograph will maintain technical and organizational measures appropriate to the risk, taking into account the state of the art, implementation cost, and nature, scope, context, and purposes of processing.

The current measures are described in Schedule 2. Cartograph may update them to reflect technical and operational development, but will not materially reduce overall protection during a paid term. The measures describe current controls and do not represent that Cartograph holds SOC 2, ISO 27001, or another certification.

Customer generally authorizes Cartograph to use the subprocessors on the Subprocessor List. Cartograph will enter a written agreement requiring each subprocessor to protect Customer Personal Data to a standard appropriate to the processing and will remain responsible for the subprocessor’s performance to the extent required by law.

Cartograph will give at least 30 days’ notice before a new subprocessor begins materially different processing of Customer Personal Data. Customer may object during that period on reasonable data-protection grounds. The parties will work in good faith on a commercially reasonable solution. If none is available, Customer may stop using the affected feature or terminate it before the change without penalty; this is Customer’s exclusive remedy for the objection.

Taking into account the nature of processing and information available, Cartograph will reasonably assist Customer with Data Subject requests, security obligations, breach notifications, impact assessments, and regulator consultations required by Applicable Data Protection Law. If Cartograph receives a request concerning Customer Personal Data, it will direct the requester to Customer where feasible and will not respond substantively unless Customer instructs it or law requires.

Customer is responsible for using available product controls first. Assistance requiring material work beyond standard functionality may be charged at reasonable rates unless the need results from Cartograph’s breach.

Cartograph will notify Customer without undue delay after becoming aware of a confirmed Security Incident affecting Customer Personal Data. Notice will include information reasonably available about the nature of the incident, affected information and people, likely consequences, mitigation, and a contact for follow-up. Cartograph may provide information in phases and may withhold details where disclosure would create a security risk or violate law.

Cartograph will take reasonable steps to contain, investigate, and remediate a Security Incident. Notification is not an admission of fault or liability. Customer is responsible for notices to regulators, Data Subjects, and third parties unless law assigns that duty directly to Cartograph.

During the Service, Customer may access and export Customer Personal Data through available product features. After termination, and at Customer’s choice where Applicable Data Protection Law requires it, Cartograph will return or delete Customer Personal Data within the period stated in the Agreement or, if none, within 30 days after Customer’s timely written request.

Cartograph may retain information where law requires, in protected backups until ordinary overwrite, in security and legal evidence, or in a form that has been lawfully anonymized or de-identified. Retained personal data remains protected by this DPA and will not be processed for another purpose.

Cartograph will provide information reasonably necessary to demonstrate compliance, beginning with current security documentation, policies, architecture descriptions, subprocessor information, and available third-party assessments. Customer may request this information no more than once in any 12-month period unless a Security Incident, regulator, or credible evidence of material noncompliance reasonably requires more.

If documentation is insufficient, Customer may conduct a remote audit during normal business hours on reasonable notice, subject to confidentiality, security, and non-disruption requirements. On-site inspection is available only where legally required or reasonably necessary after a material incident and no less intrusive method is sufficient. Customer bears its audit costs unless the audit identifies Cartograph’s material breach.

Cartograph may process Customer Personal Data in the United States and countries where approved subprocessors operate. If Customer transfers personal data governed by the European Economic Area GDPR to Cartograph in a country without an adequacy decision, the 2021 European Commission Standard Contractual Clauses (“SCCs”) are incorporated as follows:

• Module 2 applies when Customer is a Controller and Cartograph is a Processor; Module 3 applies when Customer is a Processor and Cartograph is its subprocessor.
• Clause 7 docking applies; Clause 9 uses Option 2 with a 30-day notice period; the optional language in Clause 11 does not apply.
• For Clause 17, the SCCs are governed by Irish law. For Clause 18, the courts of Ireland have jurisdiction.
• Customer is data exporter and the Cartograph contracting party is data importer. Schedule 1 supplies Annex I, Schedule 2 supplies Annex II, and the Subprocessor List supplies the authorized subprocessor information.

The parties will complete an applicable UK International Data Transfer Addendum or Swiss modification on request where required. Each party will reasonably cooperate on a transfer impact assessment and supplementary measures. If a transfer mechanism becomes invalid, the parties will work in good faith to implement a lawful replacement.

A. United States

Where US state law applies, Cartograph acts as Customer’s Processor, Service Provider, or Contractor. Cartograph will not sell or share Customer Personal Data; retain, use, or disclose it outside the direct business relationship except as permitted by law; combine it with personal information received from another person except as permitted; or use it for targeted advertising. The Agreement specifies the limited and specific business purposes, and Customer may take reasonable steps to verify compliance, require remediation, and stop processing that violates law.

B. Canada outside Quebec

Cartograph will process personal information only for the purposes for which Customer transfers it, maintain safeguards appropriate to sensitivity, assist Customer with access and correction, notify Customer of material unauthorized access, and use contractual or other means to provide protection comparable to that required under applicable Canadian federal, Alberta, or British Columbia private-sector law. Customer remains accountable for the information and for notices concerning processing outside Canada.

C. Mexico

If Mexico becomes a Supported Region, Cartograph will act as encargado for Customer Personal Data, process only under Customer’s instructions and the Agreement, maintain confidentiality and security, delete or return data when instructed subject to law, and not transfer it except to authorized subprocessors or as Customer directs. Mexico is unavailable because Cartograph has not published the business domicile required for its Mexican privacy notice.

D. Honduras

Cartograph will process Customer Personal Data concerning people in Honduras only under Customer’s instructions and the Agreement, maintain confidentiality and the security measures in this DPA, assist Customer in responding to requests to access, correct, or delete personal information, including requests made through habeas data, notify Customer of material unauthorized access, and delete or return the data when instructed, subject to law. Customer remains responsible for the notices and consents its own data subjects require, including notice that Customer Personal Data is processed in the United States.

Parties. Data exporter is Customer at the account or Enterprise Agreement address. Data importer is Cartograph Technologies, Inc., Seattle, Washington, United States, at hello@cartograph.ai. The parties’ activities are described in the Agreement. Acceptance of the Agreement constitutes signature of the SCCs on the same date.

Data Subjects. Customer and Authorized User personnel; suppliers, customers, prospects, business partners, and their personnel; communication recipients; people identified in connected records; and other people whose information Customer submits or directs Cartograph to process.

Categories. Names, work contact information, identifiers, professional details, business records, purchase and accounting data, communications, email, messages, call audio and transcripts, files, documents, tasks, instructions, prompts, AI interactions, tool activity, workflow results, technical data, and any sensitive information incidentally included by Customer.

Processing. Collection, receipt, organization, storage, retrieval, consultation, analysis, inference, transformation, transmission, disclosure at Customer’s direction, restriction, export, deletion, and other operations necessary to provide and improve the Service under Customer’s instructions.

Purpose, frequency, and duration. Continuous or customer-initiated processing to provide the Service, carry out workflows and communications, secure and support the Service, and perform the Agreement, for the Service term plus the documented deletion and legal-retention period.

Competent authority. The supervisory authority determined under Clause 13 of the SCCs. Where no other authority is mandated, the Irish Data Protection Commission.

• Access and identity. Authenticated accounts, role-based workspace authorization, controlled administrative access, access review, and session protections.
• Tenant isolation. Workspace-scoped authorization and separate tenant database projects, with a shared control plane limited to routing, billing, security, and legal records.
• Encryption and secrets. TLS in transit; infrastructure encryption at rest; vault storage for integration secrets; application encryption for designated token caches; no plaintext secrets in ordinary logs.
• Data handling. Data classification, private attachment storage, workspace-scoped access, documented retention controls, subject-erasure workflows, and protected backups.
• Security operations. Audit logging for privileged actions, vulnerability management, change review, incident-response procedures, risk tracking, backup and recovery planning, and availability monitoring.
• Providers. Documented subprocessor inventory, contractual protection requirements, and review of providers receiving personal data.
• Personnel and continuity. Confidentiality duties, least-privilege access, onboarding and offboarding controls, and business-continuity procedures appropriate to a small service provider.

These measures are a factual description, not a certification or warranty of uninterrupted operation. Product-specific limits and deletion controls are described in the Service and security documentation.