US Data Processing Agreement

1. Scope and Incorporation

1.1 This Data Processing Addendum (“DPA”), including all Schedules attached hereto, is an addendum to the agreement between the customer ("Controller") and quantilope Inc. ("Processor") governing Controller's use of Processor's services, whether established through (a) the quantilope Inc. Master Service Terms and Conditions (available at https://www.quantilope.com/us-msa) and any associated Order Form, or (b) a separately negotiated and signed master service agreement and any associated Order Form (in each case, the "Agreement"). This DPA is incorporated into and forms part of the Agreement by reference. No additional signatures are required for this DPA to take effect. This DPA shall be effective as of the effective date of the master service agreement governing the relationship, or, where no standalone master service agreement exists, as of the effective date of the first Order Form between the parties. This DPA applies automatically to any Processing of Personal Data under the Agreement, regardless of whether the parties have separately acknowledged or confirmed such Processing.

1.2 This DPA applies to the Processing of Personal Data by Processor on behalf of Controller in connection with the services provided under the Agreement.

1.3 In the event of any conflict between this DPA and the Agreement, this DPA shall prevail with respect to the Processing of Personal Data.

1.4 In the event of any conflict between this DPA and any Schedule hereto, the provision that provides the greater protection for Personal Data shall prevail.

2. Definitions

2.1 Capitalized terms not defined herein shall have the meanings set forth in the Agreement or Applicable Data Protection Laws.

2.2 “Applicable Data Protection Laws” means all applicable federal, state, and international laws, regulations, and guidance relating to data protection, privacy, and the Processing of Personal Data, including without limitation the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection (FADP), the California Consumer Privacy Act as amended by the CPRA (CCPA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Texas Data Privacy and Security Act (TDPSA), the Oregon Consumer Privacy Act (OCPA), and the Montana Consumer Data Privacy Act (MCDPA), in each case as amended from time to time.

2.3 “Personal Data,” “Processing,” “Data Subject,” “Controller,” “Processor,” “Subprocessor” shall have the meanings ascribed to them (or their equivalents) under Applicable Data Protection Laws.

3. Details of Processing

3.1 Purpose. Processor shall Process Personal Data solely to provide its Platform and related services to Controller as described in the Agreement (including, but not limited to, storing Personal Data on the Processor's Platforms and conducting online surveys).

3.2 Data Subjects. Data Subjects are survey participants, including panelists, customers, and any other individuals whose Personal Data is Processed by or on behalf of Controller.

3.3 Categories of Personal Data. The categories of Personal Data Processed are determined by the nature and scope of the services used by the Controller and may include, but are not limited to: names, addresses, email addresses, phone numbers, and other contact data; survey responses; demographic data; visual and audio material (e.g., video recordings, images, voice recordings); and any other data submitted by or on behalf of Controller.

3.4 Duration. Processing shall continue for the duration of the Agreement plus the period required for Processor to delete all Personal Data as set forth herein.

3.5 De-identified, Anonymized, or Aggregated Data. Either party may de-identify, anonymize, or aggregate Personal Data and thereafter use such De-identified Data for any purpose without restriction. "De-identified Data" means data from which all personal identifiers have been removed such that it cannot reasonably be linked to any individual. Each party shall implement reasonable measures to prevent re-identification and shall not attempt to re-identify De-identified Data to any Data Subject.

4. Obligations of the Processor

4.1 Processor shall Process Personal Data only on documented instructions from Controller, unless required by applicable law, in which case Processor shall inform Controller of such legal requirement before Processing (unless prohibited by law). Processor shall inform Controller without undue delay if, in Processor's opinion, an instruction infringes Applicable Data Protection Laws. Processor may suspend the execution of such instruction until Controller confirms or amends it.

4.2 Processor shall Process Personal Data only on documented instructions from Controller, unless required by applicable law, in which case Processor shall inform Controller of such legal requirement before Processing (unless prohibited by law).

4.3 Processor shall ensure that persons authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.4 Processor shall implement and maintain appropriate technical and organizational security measures to protect Personal Data against unauthorized or unlawful Processing, accidental loss, destruction, or damage, taking into account the state of the art, costs of implementation, and the nature, scope, context, and purposes of Processing.

4.5 Processor shall provide reasonable assistance to Controller, at no additional cost, in responding to Data Subject requests to exercise their rights under Applicable Data Protection Laws. Where such requests are manifestly unfounded, excessive, repetitive, or require disproportionate effort beyond the scope of Processor's standard operations, Processor may charge Controller reasonable fees reflecting the administrative costs of compliance, provided Processor notifies Controller of such fees in advance.

4.6 Processor shall assist Controller in ensuring compliance with its obligations regarding security of Processing, data breach notification, data protection impact assessments, and prior consultations with supervisory authorities, to the extent commercially reasonable, and taking into account the nature of Processing and the information available to Processor.

4.7 Controller acknowledges that it may export its Personal Data from the Platform at any time during the term of the Agreement. Upon termination of the Agreement, Processor shall delete all Personal Data in accordance with Processor's standard deletion procedures, unless applicable law requires continued storage. Personal Data residing in temporary backups or disaster recovery systems shall be deleted in the ordinary course of Processor's backup rotation cycle. Processor shall certify deletion upon Controller's written request.

4.8 Processor shall make available to Controller all information reasonably necessary to demonstrate compliance with this DPA. Processor may satisfy this obligation by providing a current ISO 27001 certificate or equivalent certification and, upon request, a summary of its most recent audit findings. Where Controller reasonably determines that such documentation is insufficient, Controller may conduct or commission an audit by a qualified third-party auditor, at Controller's expense, upon reasonable notice and no more than once per calendar year (unless required by a supervisory authority or following a Personal Data Breach). Any such audit must not unreasonably interfere with Processor’s business activities and must be reasonable in time and scope.

5. Personal Data Breach

5.1 Processor shall notify Controller without undue delay after becoming aware of a Personal Data Breach affecting Controller's Personal Data.

5.2 Upon Controller's request, Processor will, to the extent reasonably available, provide information on the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed to mitigate its effects.

6. Subprocessors

6.1 Controller hereby provides general written authorization for Processor to engage Subprocessors to Process Personal Data on Controller's behalf. The current list of Subprocessors is available at https://www.quantilope.com/quantilope-inc.-subprocessors

6.2 Processor shall notify Controller of any intended changes to the list of Subprocessors (additions or replacements) prior to the engagement of any new Subprocessor.

6.3 Controller may object to any new Subprocessor by notifying Processor within thirty (30) days of receipt of such notice. If Controller objects on reasonable data protection grounds, the parties shall enter into good faith negotiations to resolve the objection. If no resolution is reached within thirty (30) days of Controller's objection, Controller may terminate the affected services without penalty.

6.4 Processor shall impose on each Subprocessor, by written agreement, data protection obligations no less protective than those set out in this DPA. Processor shall remain liable for the acts and omissions of its Subprocessors.

6.5 For the purposes of this Section 6, Subprocessors are third parties that directly participate in the provision of the services under the MSA. Ancillary services that the Processor uses for its general business operations — such as telecommunications, postal or transport services, maintenance and user support, or the disposal of data carriers and other measures to ensure the confidentiality, availability, integrity, and resilience of hardware and software — do not constitute subprocessing within the meaning of this DPA. Processor shall nonetheless ensure appropriate contractual and organizational safeguards for such ancillary services.

7. International Data Transfers

7.1 To the extent that Controller's use of the services involves the transfer of Personal Data from the European Economic Area (EEA), the United Kingdom (UK), or Switzerland to the United States or any other country not deemed adequate by the relevant authority, the parties agree that such transfers shall be governed by the Standard Contractual Clauses (SCCs) as set forth in Schedule 1.

7.2 Processor and Controller shall comply with any additional requirements under Applicable Data Protection Laws necessary to ensure that international transfers of Personal Data are lawful.

8. Obligations of the Controller

8.1 Controller represents and warrants that it has all necessary rights, consents, and legal bases to provide Personal Data to Processor for Processing under this DPA and the Agreement, including the data collection through the Platform. Controller shall not submit special categories of data (as defined under Applicable Data Protection Laws, including but not limited to data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, or data concerning sex life or sexual orientation) to the Platform unless the parties have agreed in writing to appropriate additional safeguards.

8.2 Controller shall be responsible for providing all required notices and obtaining all required consents or authorizations from Data Subjects as necessary under Applicable Data Protection Laws.

8.3 Controller shall ensure that its instructions to Processor comply with Applicable Data Protection Laws.

8.4 Processor may notify Controller of any Personal Data submitted in violation of this Section 8 and request removal within five (5) business days. If Controller fails to remove such Personal Data, Processor may delete such Personal Data without further notice. Processor may delete Personal Data immediately without notice where continued storage would expose Processor to legal liability or regulatory risk.

9. General Provisions

9.1 Governing Law. This DPA shall be governed by the laws governing the Agreement, unless Applicable Data Protection Laws require otherwise.

9.2 Term. This DPA shall remain in effect for the duration of the Agreement and until all Personal Data has been deleted in accordance with this DPA.

9.3 Amendments. Processor may update this DPA from time to time to reflect changes required by Applicable Data Protection Laws or regulatory guidance. Processor shall notify Controller of any material changes at least thirty (30) days prior to such changes taking effect. If Controller objects to a material change, the parties shall negotiate in good faith to resolve the objection. Continued use of the services after the effective date of the change shall be deemed acceptance. All other amendments require the written agreement of both parties.

9.4 Notices. All notifications from Processor to Controller under this DPA (including but not limited to Personal Data Breach notifications, Subprocessor changes, and amendments) shall be delivered by email to the address Controller provided to Processor via the Platform. Controller is responsible for maintaining current and monitored account information at all times. All notifications from Controller to Processor under this DPA (including but not limited to Subprocessor objections and audit requests) shall be directed to [email protected]. Email notification constitutes sufficient notice for all purposes under this DPA.

9.5 Severability. If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.

9.6 Entire Agreement. Together with the Agreement, this DPA (including all Schedules) constitutes the entire agreement between the parties with respect to the Processing of Personal Data.

Schedule 1 — International Data Transfer Mechanisms

Part A — EU Standard Contractual Clauses

1. For transfers of Personal Data from the EEA to countries not deemed adequate by the European Commission, the parties agree to enter into the EU Standard Contractual Clauses adopted pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (“EU SCCs”), which are hereby incorporated by reference.

2. Module Two (Controller to Processor) shall apply.

3. The following elections are made under the EU SCCs:

(a) Clause 7 (Docking Clause): Not included.

(b) Clause 9(a) (Subprocessor Authorization): Option 2 (General written authorization) shall apply, with the notice period set at thirty (30) days.

(d) Clause 17 (Governing Law): The laws of the EU Member State in which the data exporter is established shall apply. Where the data exporter is not established in an EU Member State, the laws of Germany shall apply.

(e) Clause 18(b) (Forum): The courts of the jurisdiction identified under Clause 17 above shall have jurisdiction.

4. Annex I, II, and III of the EU SCCs shall be completed as follows:

(a) Annex I (List of Parties):

Data Exporter: Controller (as identified in the Agreement).

Data Importer: quantilope Inc., 25 Broadway, 10th Floor, New York, NY 10004-1082.

Contact details as specified in this DPA.

(b) Annex I (Transfer Details): As described in Section 3 of this DPA (categories of Data Subjects, Personal Data, frequency, nature and purpose of Processing, and retention period).

(c) Annex I (Competent Supervisory Authority): The supervisory authority of the EU Member State in which the Data Exporter is established, or, where the Data Exporter is not established in an EU Member State, the supervisory authority of the EU Member State in which the Data Exporter's EU representative is established. Where the Data Exporter is not established in an EU Member State and has not designated an EU representative, the supervisory authority of the EU Member State in which the Data Subjects are predominantly located shall be competent.

(d) Annex II (Technical and Organizational Measures): As described in Processor's security documentation made available to Controller upon request.

(e) Annex III (Subprocessors): As set forth in the Subprocessor list maintained by Processor at https://www.quantilope.com/quantilope-inc.-subprocessors

Part B — UK International Data Transfer Addendum

1. For transfers of Personal Data from the United Kingdom, the UK International Data Transfer Addendum to the EU SCCs (“UK Addendum”), issued by the UK Information Commissioner under Section 119A of the Data Protection Act 2018, is hereby incorporated by reference.

2. Tables 1 through 4 of the UK Addendum shall be completed using the information set forth in Part A above and the Subprocessor list.

Part C — Swiss Data Transfers

1. For transfers of Personal Data from Switzerland, the EU SCCs as described in Part A shall apply, with the following modifications:

(a) References to the GDPR shall be understood as references to the Swiss Federal Act on Data Protection (FADP).

(b) The competent supervisory authority shall be the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Schedule 2 — California Consumer Privacy Act (CCPA) Addendum

This Schedule applies to the extent that Processor Processes Personal Information (as defined under the CCPA) of California residents on behalf of Controller.

1. Definitions. "Business," "Service Provider," "Consumer," "Personal Information," "Sell," "Share," and "Business Purpose" shall have the meanings given in the CCPA (Cal. Civ. Code §§ 1798.100 et seq., as amended by the CPRA).

2. Processor as Service Provider. For purposes of the CCPA, Processor is a Service Provider. Processor shall not Sell or Share Personal Information received from Controller.

3. Use Restrictions. Processor shall not retain, use, or disclose Personal Information (a) for any purpose other than the Business Purposes specified in the Agreement and this DPA, including any commercial purpose other than providing the services; (b) outside the direct business relationship between the parties; or (c) to combine Personal Information received from Controller with Personal Information collected from other sources, except as expressly permitted by the CCPA.

4. Compliance Certification. Processor certifies that it understands the restrictions in this Schedule and will comply with them.

5. Cooperation. Processor shall assist Controller in responding to Consumer requests to exercise their rights under the CCPA (including requests to know, delete, correct, and opt-out) within the timeframes required by law.

6. Right to Monitor. Controller shall have the right to take reasonable and appropriate steps to ensure Processor uses Personal Information in a manner consistent with Controller's obligations under the CCPA, including ongoing manual reviews and automated scans, and regular assessments.

7. De-identified Data. For purposes of the CCPA, De-identified Data as defined in this DPA shall be treated as "deidentified" information under Cal. Civ. Code § 1798.140(m), and the obligations set forth in this DPA with respect to De-identified Data shall satisfy Processor's obligations regarding deidentified information under the CCPA, including the requirements to implement technical safeguards, business processes to prevent re-identification, and mechanisms to prevent inadvertent release of deidentified information. The use restrictions in this Schedule do not apply to De-identified Data.

Schedule 3 — US State Privacy Laws Addendum

This Schedule applies to the extent that Processor Processes Personal Data on behalf of Controller that is subject to any US state privacy law other than the CCPA (which is addressed in Schedule 2), including without limitation the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Texas Data Privacy and Security Act (TDPSA), the Oregon Consumer Privacy Act (OCPA), the Montana Consumer Data Privacy Act (MCDPA), and any other comprehensive US state privacy law that becomes effective during the term of the Agreement (collectively, "State Privacy Laws").

1. The obligations set forth in the main body of this DPA (including without limitation Sections 4, 5, and 6) shall apply to all Processing governed by State Privacy Laws. This Schedule supplements but does not limit those obligations.

2. Processor shall assist Controller in responding to consumer rights requests as required under the applicable State Privacy Laws, including but not limited to rights of access, correction, deletion, data portability, and opt-out of targeted advertising, sale, and profiling.

3. Processor shall provide Controller with information reasonably necessary to enable Controller to conduct and document any data protection assessments required under the applicable State Privacy Laws.

4. As additional comprehensive US state privacy laws become effective, this Schedule shall automatically extend to Processing governed by such laws. The parties shall cooperate in good faith to execute any additional amendments necessary to comply with new legislative requirements.

Data Processing Addendum