Data Processing Addendum

This Data Processing Addendum explains how Zym Labs, LLC handles the personal data our customers load into the Service. It is part of our Terms of Service and applies automatically to every customer. In plain terms:

• You are the controller and we are the processor. We process Customer Personal Data only on your instructions and only to provide the Service.
• We use a short list of subprocessors, published at https://zymlabs.com/legal/subprocessors, and we give 14 days' notice before adding one.
• We tell you about a personal data breach without undue delay, and within any time frame Data Protection Law requires.
• We host in the United States today. Transfers from the EEA, the UK, and Switzerland are covered by the Standard Contractual Clauses, which this DPA incorporates.
• You can verify our compliance by requesting our security documentation and completing a security questionnaire with us, as Section 12 describes.

If your procurement process needs a signed copy, email [email protected] and we will countersign a copy of this DPA. Signing does not change any of our practices. Every customer gets the same protections.

1.1 Parties and incorporation. This Data Processing Addendum (the "DPA") is between Zym Labs, LLC ("Zym Labs," "we," "us," or "our") and the customer that has accepted our Terms of Service at https://zymlabs.com/legal/terms or signed a Master Services Agreement with us (the "Agreement") ("Customer," "you," or "your"). This DPA is incorporated into and forms part of the Agreement. Capitalized terms not defined here have the meanings given in the Agreement.

1.2 When this DPA applies. This DPA applies to the extent we Process Customer Personal Data on your behalf in providing the Service. It does not apply to personal data we Process as a controller, such as information about your Account Users, billing contacts, and visitors to our websites. Our Privacy Policy at https://zymlabs.com/legal/privacy governs that data.

1.3 Precedence. If this DPA conflicts with the Agreement, this DPA controls for the subject matter of the conflict. If the Standard Contractual Clauses conflict with this DPA, the Standard Contractual Clauses control.

1.4 Prior DPAs. This DPA replaces any data processing agreement or addendum the parties previously entered into for the Service.

1.5 Term. This DPA takes effect when the Agreement takes effect and continues until we stop Processing Customer Personal Data, including the deletion period in Section 11.

"Customer Personal Data" means Personal Data contained in Customer Data that we Process on your behalf in providing the Service.

"Data Protection Law" means all laws that apply to the Processing of Customer Personal Data under this DPA, including European Data Protection Law and US Data Protection Law.

"Data Subject" means an identified or identifiable natural person to whom Customer Personal Data relates.

"EEA" means the European Economic Area.

"European Data Protection Law" means (a) Regulation (EU) 2016/679 (the "GDPR"); (b) the GDPR as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018 (the "UK GDPR"); (c) the Swiss Federal Act on Data Protection (the "FADP"); (d) Directive 2002/58/EC and national laws implementing it; and (e) any law that replaces or supplements any of them.

"Personal Data" means any information relating to a Data Subject, and includes "personal information" and equivalent terms under Data Protection Law.

"Personal Data Breach" means a breach of our security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. It does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as unsuccessful login attempts, pings, port scans, or denial-of-service attacks on firewalls or network systems.

"Processing" means any operation performed on Personal Data, such as collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction. "Process" has a corresponding meaning.

"Restricted Transfer" means (a) where the GDPR applies, a transfer of Customer Personal Data from the EEA to a country that is not subject to an adequacy decision of the European Commission; (b) where the UK GDPR applies, a transfer from the United Kingdom to a country that is not subject to adequacy regulations under section 17A of the Data Protection Act 2018; and (c) where the FADP applies, a transfer from Switzerland to a country that the Swiss Federal Council has not recognized as providing adequate protection.

"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

"Subprocessor" means a third party we engage to Process Customer Personal Data on our behalf.

"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0, in force 21 March 2022.

"US Data Protection Law" means all US state laws that apply to the Processing of Customer Personal Data under this DPA, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (the "CCPA"), the Texas Data Privacy and Security Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and comparable comprehensive state privacy laws.

The terms "controller," "processor," "business," "service provider," "sell," and "share" have the meanings given in the applicable Data Protection Law. References to a controller include a business, and references to a processor include a service provider, where US Data Protection Law applies.

3.1 Customer as controller. Where you are a controller of Customer Personal Data, we are your processor.

3.2 Customer as processor. Where you Process Customer Personal Data as a processor on behalf of another controller, we are your subprocessor. You represent that your agreement with that controller permits you to engage us on the terms of this DPA, and you will comply with the subprocessor requirements of that agreement.

3.3 Details of Processing. Annex I describes the subject matter, duration, nature, and purpose of the Processing, the categories of Data Subjects, and the categories of Customer Personal Data.

4.1 Your instructions. We will Process Customer Personal Data only on your documented instructions, unless Data Protection Law requires otherwise. Your instructions are (a) to provide, maintain, secure, and support the Service; (b) as specified through your use of the Service, including its settings, integrations, and API; (c) as documented in the Agreement and this DPA; and (d) as otherwise agreed in writing between the parties.

4.2 Instructions that infringe law. We will inform you if, in our opinion, an instruction infringes Data Protection Law. We are not obliged to assess the law of every jurisdiction in which you operate, and you remain responsible for the lawfulness of your instructions.

4.3 Legally required Processing. If Data Protection Law requires us to Process Customer Personal Data other than on your instructions, we will inform you of that requirement before Processing unless the law prohibits us from doing so on important grounds of public interest.

4.4 Your obligations. You are responsible for (a) the accuracy, quality, and legality of Customer Personal Data and the means by which you acquired it; (b) providing all notices and obtaining all consents and authorizations that Data Protection Law requires for us to Process Customer Personal Data as described in this DPA; (c) ensuring that your instructions comply with Data Protection Law; and (d) complying with the restrictions on sensitive data in the Agreement. The Service is not designed for special categories of personal data under the GDPR or UK GDPR, and you must not submit them unless we have agreed otherwise in writing.

4.5 Aggregated and de-identified data. We may create aggregated or de-identified data from Customer Personal Data as described in the Agreement. We will not attempt to re-identify that data, will not disclose it in a form that identifies you or any Data Subject, and will contractually prohibit any recipient from attempting to re-identify it.

5.1 Service provider certifications. Where we act as a service provider or processor under US Data Protection Law, we certify that we understand and will comply with the following restrictions. We will not (a) sell or share Customer Personal Data; (b) retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement and this DPA, or as otherwise permitted by US Data Protection Law; (c) retain, use, or disclose Customer Personal Data outside the direct business relationship between you and us; or (d) combine Customer Personal Data with Personal Data we receive from other sources, except as permitted by US Data Protection Law.

5.2 Compliance and notice. We will comply with the obligations that US Data Protection Law places on a service provider or processor and will provide the same level of privacy protection that those laws require of you. We will notify you if we determine we can no longer meet those obligations. You may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

5.3 Consumer requests. We will assist you in responding to verifiable consumer requests as described in Section 7.

6.1 Personnel. We will ensure that each person we authorize to Process Customer Personal Data is bound by a duty of confidentiality, whether contractual or statutory, and receives appropriate training on data protection.

6.2 Security measures. We will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against Personal Data Breaches, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the Processing. Annex II describes our current measures. We may update them from time to time, provided the update does not materially reduce the overall security of the Service.

6.3 Your security responsibilities. You are responsible for the secure use of the Service on your side, including protecting account credentials and API keys, configuring access controls and integrations appropriately, and securing Customer Personal Data while it is in your systems or in transit to the Service.

7.1 Service tools. The Service provides features you can use to access, correct, export, and delete Customer Personal Data about a Data Subject. You will use those features to respond to Data Subject requests where you can.

7.2 Requests we receive. If a Data Subject contacts us directly about Customer Personal Data, we will not respond except to acknowledge the request and direct the Data Subject to you, and we will promptly notify you of the request unless the law prohibits us from doing so.

7.3 Assistance. Where you cannot fulfill a Data Subject request using the features of the Service, we will provide reasonable assistance on your written request, taking into account the nature of the Processing. We may charge a reasonable fee for assistance that goes beyond the features of the Service and is excessive or repetitive, such as manual exports, and we will tell you before incurring it.

8.1 Authorization. You give us general authorization to engage Subprocessors to Process Customer Personal Data. Our current Subprocessors, their locations, and their functions are listed at https://zymlabs.com/legal/subprocessors (the "Subprocessor List").

8.2 Changes. We will update the Subprocessor List and notify you at least 14 days before a new Subprocessor begins Processing Customer Personal Data. We will give notice by updating the Subprocessor List and sending an email to the email address associated with your account.

8.3 Objection. You may object to a new Subprocessor within the 14-day notice period by emailing [email protected] with reasonable grounds relating to data protection. If you object, we will work with you in good faith to resolve the concern, which may include offering a configuration of the Service that avoids the Subprocessor. If we cannot resolve the objection within 30 days of receiving it, either party may terminate the portion of the Service that cannot be provided without the Subprocessor, and we will refund any prepaid Fees for the terminated portion for the period after termination. If you do not object within the notice period, you are deemed to have accepted the Subprocessor.

8.4 Subprocessor agreements. We will have a written agreement with each Subprocessor that imposes data protection obligations no less protective of Customer Personal Data than those in this DPA, to the extent applicable to the services the Subprocessor provides. On your written request, we will provide a summary of the data protection terms of a Subprocessor agreement, redacted as necessary to protect confidential information.

8.5 Liability. We remain responsible for the performance of each Subprocessor's obligations and are liable for the acts and omissions of our Subprocessors to the same extent we would be liable if performing the services directly, subject to the limitations of liability in the Agreement.

9.1 Notice. We will notify you of a Personal Data Breach without undue delay after confirming it, and in any event within any time frame that Data Protection Law requires of us as your processor. Notice will be sent to the email address associated with your account and to any security contact you have designated in the Service.

9.2 Content. Our notice will describe, to the extent known at the time, the nature of the Personal Data Breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures we have taken or propose to take. Where we cannot provide all of this information at once, we will provide it in phases without undue further delay.

9.3 Cooperation. We will take reasonable steps to contain, investigate, and mitigate the Personal Data Breach and will provide the information you reasonably need to meet your own notification obligations. We may redact information that is confidential or competitively sensitive or that relates to other customers.

9.4 No admission. Our notice of or response to a Personal Data Breach is not an acknowledgment of fault or liability.

9.5 Public statements. You will not name us in any public statement or regulatory notification about a Personal Data Breach without first giving us a reasonable opportunity to review the statement, unless the law requires otherwise.

10.1 Impact assessments. Taking into account the nature of the Processing and the information available to us, we will provide reasonable assistance with data protection impact assessments, transfer impact assessments, and prior consultations with supervisory authorities that Data Protection Law requires of you in connection with the Service.

10.2 Government and third-party requests. If we receive a legally binding request from a government authority or other third party for Customer Personal Data, we will (a) attempt to redirect the requester to you, and in doing so may provide your basic contact information; (b) notify you before disclosing any Customer Personal Data unless the law prohibits us from doing so; (c) disclose only the minimum Customer Personal Data that we are legally compelled to disclose; and (d) challenge the request where we have reasonable grounds to believe it is unlawful. We will provide reasonable cooperation, at your expense, in any legal response you take to such a request.

10.3 Fees. Assistance under this Section 10 that goes beyond the features of the Service and requires material effort on our part may be subject to a reasonable fee, which we will tell you about before incurring it.

11.1 During the term. You may export and delete Customer Personal Data at any time using the features of the Service or the API. We will give effect to deletions as soon as reasonably practicable and in any event within 30 days, except where Data Protection Law requires further storage.

11.2 After termination. For 30 days after termination or expiration of the Agreement, we will make Customer Personal Data available for export on request, as described in the Agreement. After that period, we will delete Customer Personal Data from our active systems within 30 days.

11.3 Backups. Copies of Customer Personal Data in backups are deleted in the ordinary course of our backup rotation under our data retention policy. Until deleted, backup copies remain protected by this DPA, are not restored to active systems except as needed to recover from a disaster or system failure, and are not used for any other purpose.

11.4 Legal retention. We may retain Customer Personal Data to the extent Data Protection Law or other applicable law requires, and may retain records of consent, opt-out, and message delivery for messages sent through our infrastructure for up to four years after each message to respond to carrier and regulatory inquiries and to establish or defend legal claims, provided in each case that we isolate the retained data from further Processing and continue to protect it under this DPA. We may also retain security, access, and application logs that reference Customer Personal Data for up to 36 months after they are generated, for security investigation and to establish or defend legal claims, protected under this DPA. These logs record the identifiers needed to trace a request, not message content.

11.5 Certification. On your written request, we will confirm in writing that deletion under this Section 11 has been completed.

12.1 Reports and information. On your written request, no more than once in any 12-month period, we will make available on a confidential basis (a) a summary of our most recent independent audit report or certification, such as a SOC 2 report, when we hold one; (b) a summary of our most recent independent security test, when we hold one; and (c) written responses to a reasonable information security or data protection questionnaire. We will also provide any other information reasonably necessary to demonstrate our compliance with this DPA.

12.2 Scope of audit rights. You agree to exercise any audit or inspection right you have under this DPA or Data Protection Law, including under the Standard Contractual Clauses, by requesting the reports and information described in Section 12.1. We may restrict access to information where providing it would compromise the security or confidentiality of other customers, our intellectual property, or our obligations under applicable law.

12.3 Records. We will keep records of our compliance with this DPA for three years after it ends.

13.1 Hosting location. We host Customer Personal Data in the United States. If we offer hosting in another region and you select it, we will store Customer Personal Data at rest in that region, but we may access it from the United States and other locations where we or our Subprocessors operate to provide, support, and secure the Service. Our Subprocessor List states the location of each Subprocessor.

13.2 Authorization. You authorize us to transfer Customer Personal Data to, and Process it in, the United States and any other country where we or our Subprocessors operate, provided we comply with this Section 13 and Data Protection Law.

13.3 Transfers from the EEA. Where a transfer of Customer Personal Data from you to us is a Restricted Transfer governed by the GDPR, the parties are deemed to have entered into the Standard Contractual Clauses, which are incorporated into this DPA by reference and completed as follows:

• Module Two (controller to processor) applies where you are a controller. Module Three (processor to processor) applies where you are a processor.
• Clause 7 (the optional docking clause) does not apply.
• In Clause 9(a), Option 2 (general written authorization) applies, and the notice period is 14 days as set out in Section 8.
• In Clause 11(a), the optional language on independent dispute resolution does not apply.
• In Clause 13(a) and Annex I.C, the competent supervisory authority is the authority that has jurisdiction over you as data exporter.
• In Clause 17, Option 1 applies, and the SCCs are governed by the laws of Ireland.
• In Clause 18(b), disputes are resolved before the courts of Ireland.
• Annex I of the SCCs is completed by Annex I of this DPA, Annex II of the SCCs by Annex II of this DPA, and Annex III of the SCCs by the Subprocessor List.

13.4 Transfers from the United Kingdom. Where a transfer is a Restricted Transfer governed by the UK GDPR, the parties are deemed to have entered into the UK Addendum, which is incorporated by reference and completed as follows: Table 1 is completed with the parties' details in the Agreement; Table 2 selects the SCCs as completed in Section 13.3; Table 3 is completed by Annexes I and II of this DPA and the Subprocessor List; and in Table 4, neither party may end the UK Addendum under its Section 19. If the Information Commissioner issues a revised Addendum, the parties will work in good faith to update this DPA accordingly.

13.5 Transfers from Switzerland. Where a transfer is a Restricted Transfer governed by the FADP, the SCCs apply as completed in Section 13.3 with these changes: references to the GDPR are read as references to the FADP; references to the EU and member states are read as references to Switzerland; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; the governing law and forum under Clauses 17 and 18 are Swiss law and the courts of Switzerland for transfers governed exclusively by the FADP.

13.6 Alternative mechanisms. If a transfer mechanism in this Section 13 is invalidated or superseded, or if we become certified under a framework recognized as providing adequate protection, such as the EU-US Data Privacy Framework, the parties will cooperate in good faith to rely on a suitable alternative, and we may give notice that the alternative applies in place of or in addition to the SCCs.

13.7 Government access. We have not purposefully created back doors or similar programming that could be used to access the Service or Customer Personal Data, and we have not intentionally weakened the encryption we use. To the extent permitted by law, we will notify you of any legally binding request for access to Customer Personal Data by a public authority, as described in Section 10.2.

14.1 Cap. Each party's total liability arising out of or related to this DPA, whether in contract, tort, or otherwise, is subject to the exclusions and limitations of liability in the Agreement, and any liability under this DPA counts toward and does not increase the cap in the Agreement.

14.2 Exceptions. Section 14.1 does not limit either party's liability to a Data Subject for that Data Subject's rights under Data Protection Law, or either party's liability under the Standard Contractual Clauses or UK Addendum to the extent those instruments do not permit limitation.

14.3 Claims by affiliates. Any claim against us arising out of this DPA may be brought only by the Customer entity that is party to the Agreement, including on behalf of its affiliates.

15.1 Changes. We may update this DPA to reflect changes in Data Protection Law, in the Service, or in our Subprocessors. We will notify you of material changes as described in the Agreement. Changes that reduce our obligations materially will not take effect for your current Subscription Term without your agreement.

15.2 Severability. If any part of this DPA is held unenforceable, the rest remains in effect, and the parties will replace the unenforceable part with a valid one that achieves the same aim as closely as possible.

15.3 Governing law. This DPA is governed by the law that governs the Agreement, except where the Standard Contractual Clauses or Data Protection Law require otherwise.

15.4 Contact. Questions about this DPA and data protection requests should be sent to [email protected]. Security reports should be sent to [email protected].

A. List of parties

Data exporter: The Customer identified in the Agreement, acting as controller (Module Two) or processor (Module Three). Contact details are those in the Customer's account.

Data importer: Zym Labs, LLC, at the address set out in the Agreement, acting as processor. Contact: [email protected].

B. Description of the transfer

Categories of Data Subjects: The Customer's end users, customers, prospects, subscribers, and other individuals whose Personal Data the Customer submits to the Service or the Service collects on the Customer's behalf, including individuals whose data is synchronized from or to the Customer's own systems. The Customer's Account Users to the extent their activity within the Service forms part of Customer Data.

Categories of Personal Data: Identifiers and contact details (such as name, email address, phone number, user ID, device identifiers); profile attributes the Customer chooses to store; behavioral and event data (such as page views, app events, purchases, and message engagement); message content and metadata; technical data (such as IP address, browser and device information, and approximate location derived from IP address); and any other Personal Data the Customer submits to the Service.

Special categories of data: None. The Agreement prohibits the Customer from submitting special categories of personal data, and the Customer is responsible for enforcing that restriction.

Frequency of the transfer: Continuous, for the duration of the Agreement.

Nature of the Processing: Hosting, storage, collection, organization, analysis, segmentation, transmission (including delivery of messages through the channels the Customer configures), synchronization with the Customer's connected systems, display to the Customer's Account Users, deletion, and related operations necessary to provide the Service.

Purpose of the Processing: To provide the Service to the Customer under the Agreement, including sending messages the Customer configures, analyzing engagement and behavior on the Customer's behalf, synchronizing data between the Service and the Customer's systems, and providing support, security, and maintenance.

Duration of the Processing: The term of the Agreement plus the export and deletion periods in Section 11.

Transfers to Subprocessors: As described in the Subprocessor List, for the duration of the Agreement, for the purpose of providing the infrastructure and services listed there.

C. Competent supervisory authority

The supervisory authority with jurisdiction over the data exporter, determined in accordance with Clause 13 of the SCCs.

We maintain the following measures to protect Customer Personal Data. We update them as technology and risk evolve.

Encryption and pseudonymization. Customer Personal Data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 or equivalent. Encryption keys are managed by our cloud provider's key management service with access restricted to authorized systems.

Confidentiality, integrity, availability, and resilience. Production systems run on infrastructure provided by our hosting Subprocessor in redundant availability zones. We take daily backups, which allow restoration of Customer Personal Data to a recent point in time, and periodically test restoration.

Testing and evaluation. We perform vulnerability scanning on production systems and dependencies, engage periodic independent security testing, and track remediation to closure.

User identification and authorization. Access to production systems requires unique accounts, multi-factor authentication, and role-based permissions granted on the principle of least privilege. Access is reviewed periodically and revoked promptly when no longer needed.

Protection during transmission and storage. Customer Personal Data is logically segregated from other customers' data within multi-tenant systems. Production environments are separated from development and testing, and Customer Personal Data is not copied to non-production environments except where needed to investigate a specific issue, under the same access controls as production, and is deleted when the investigation ends.

Physical security. Our hosting Subprocessor is responsible for physical security of data centers and maintains independent certifications, including SOC 2 and ISO 27001.

Event logging. Access to production systems and administrative actions are logged. Logs are protected from tampering, and retained for security investigation.

System configuration. Changes to production infrastructure and code are reviewed before deployment.

Internal governance. We maintain written security policies, including incident response and data retention policies, approved by management and reviewed periodically. Personnel complete security and privacy training at onboarding and periodically thereafter.

Data minimization and quality. The Service lets the Customer configure which data it collects and stores, and provides tools to correct and delete Customer Personal Data.

Retention and deletion. Customer Personal Data is retained for the duration of the Agreement and deleted in accordance with Section 11 of this DPA. Media is sanitized or destroyed in accordance with our hosting Subprocessor's procedures.

Accountability. We maintain records of Processing activities and this DPA for the period in Section 12.3, and designate a privacy contact at [email protected].

Incident response. We maintain an incident response plan with defined roles, severity levels, and notification steps, including the customer notification commitment in Section 9. The plan is reviewed periodically.

Subprocessor measures. We assess each Subprocessor's security practices before engagement and periodically thereafter, and require contractual commitments as described in Section 8.4.

The current list of Subprocessors, with the location and function of each, is maintained at https://zymlabs.com/legal/subprocessors. That list is incorporated into this DPA and constitutes Annex III of the Standard Contractual Clauses. Changes to the list are governed by Section 8.