Data Processing Addendum

This Data Processing Addendum ("DPA") is between ClearMark LLC ("ClearMark") and the customer entity ("Customer") that has entered into ClearMark's Terms of Use, an Order Form, or another written agreement for the Services (the"Agreement"). It applies to the extent ClearMark Processes Personal Data on Customer's behalf. If this DPA conflicts with the Agreement regarding Processing of Customer Personal Data, this DPA controls.

3.1 Safeguards. ClearMark will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data, taking into account the state of the art, implementation costs, the nature, scope, context, and purposes of Processing, and the risks to the rights and freedoms of individuals. Measures include, as appropriate, encryption in transit and at rest, least-privilege access controls, multi-factor authentication for administrative access, security logging and monitoring, controlled software changes and deployments, vulnerability management, backup and recovery measures, incident response, business continuity, and vendor risk management.

3.2 ISO/IEC 27001:2022 certification and security program. ClearMark maintains an information security management system (ISMS) certified to ISO/IEC 27001:2022 by an independent certification body. The certification applies to the scope identified in ClearMark's then-current ISO/IEC 27001:2022 certificate and Statement of Applicability, as applicable, and does not by itself constitute a certification of any Customer, Customer system, or Customer compliance with any law. ClearMark will maintain its ISMS and associated risk-management processes in accordance with the requirements applicable to its certification, subject to periodic surveillance and recertification activities. ClearMark also maintains controls designed with reference to the applicable AICPA Trust Services Criteria supporting its SOC 2 program. ClearMark may update its safeguards as technology, legal requirements, and risks evolve, provided it does not materially reduce the overall protection of Customer Personal Data during an active subscription term.

3.3 Certification status and notice. ClearMark will not knowingly represent that its ISO/IEC 27001:2022 certification extends beyond the scope or validity stated in the applicable certificate. If ClearMark becomes aware that its ISO/IEC 27001:2022 certification has expired, been suspended, or been withdrawn and the change materially affects the security commitments applicable to the Services, ClearMark will provide reasonable notice to affected Customers, subject to applicable legal and confidentiality restrictions.

4.1 Notification. ClearMark will notify Customer without undue delay and, where reasonably practicable, within twenty-four (24) hours after confirming a Personal Data Breach involving Customer Personal Data. An initial notice may be supplemented as additional information becomes available.

4.2 Cooperation. ClearMark will provide information and reasonable assistance necessary for Customer to investigate the incident and satisfy applicable notification obligations. ClearMark's notification of an incident is not an admission of fault or liability.

5.1 Authorization. Customer generally authorizes ClearMark to engage Subprocessors to provide the Services. ClearMark will maintain a current Subprocessor List and will enter into written agreements with Subprocessors that Process Customer Personal Data imposing data-protection obligations appropriate to the Processing and, where required by applicable law, obligations that provide at least the same level of protection for Customer Personal Data as those imposed on ClearMark under this DPA. ClearMark remains responsible for the performance of its Subprocessors to the extent required by applicable law and this DPA.

5.2 Changes and objections. ClearMark will provide reasonable advance notice of a new Subprocessor that will Process Customer Personal Data. Customer may object on reasonable data-protection grounds within fifteen (15) days of notice. The parties will work in good faith to resolve the objection; if they cannot, Customer may terminate the affected Service as its sole remedy for the objection, subject to payment of amounts accrued before termination.

6.1 Transfer mechanisms. Where Customer Personal Data subject to the GDPR, UK GDPR, or Swiss data-protection law is transferred to a country not recognized as providing adequate protection, the parties will rely on a valid transfer mechanism. The European Commission Standard Contractual Clauses ("SCCs") are incorporated by reference where required, using Module 2 (Controller-to-Processor) or Module 3 (Processor-to-Processor), as applicable. For UK transfers, the UK International Data Transfer Addendum applies; for Swiss transfers, the SCCs apply with legally required Swiss adaptations.

6.2 Transfer information. For purposes of the SCCs, Customer is the data exporter and ClearMark is the data importer. The parties, Processing details, categories of data, categories of data subjects, purposes of Processing, retention, Subprocessors, and security measures are described in this DPA, the Agreement, ClearMark's Privacy Policy, Security Statement, and current Subprocessor List. Those documents complete the corresponding SCC annexes to the extent permitted by law.

7.1 Assistive use. ClearMark may use machine-learning, statistical, and artificial-intelligence components within the Services to identify patterns, summarize information, prioritize opportunities, and produce insights. Such outputs are assistive and are not intended to replace professional judgment.

7.2 No third-party model training. ClearMark will not use Customer Personal Data to train, fine-tune, evaluate, or improve any third-party artificial-intelligence model, machine-learning model, large language model, foundation model, or generative-AI system operating outside the Services.

7.3 Third-party AI providers. If a third-party AI provider Processes Customer Personal Data to provide functionality within the Services, ClearMark will contractually require the provider not to use Customer Personal Data to train or improve its own or another party's models and not to retain Customer Personal Data beyond what is necessary to provide the relevant service, except as legally required.

7.4 De-identified data. ClearMark may use aggregated, anonymized, or de-identified data for analytics, benchmarking, product improvement, and improving ClearMark's own models operating within the Services, provided such data does not identify Customer or any individual and ClearMark does not attempt to re-identify it.

8.1 Assistance. ClearMark will provide reasonable assistance, taking into account the nature of the Processing and information available to ClearMark, to enable Customer to meet applicable obligations relating to data-subject rights, security of Processing, Personal Data Breach notifications, data-protection impact assessments, prior consultations with regulators, and other privacy compliance obligations relating to the Services.

8.2 Compliance evidence and certification. Upon reasonable request and subject to confidentiality, security, intellectual-property, and third-party restrictions, ClearMark will make available information reasonably necessary to demonstrate compliance with this DPA. ClearMark may satisfy routine security and audit requests through then-current independent audit reports, certifications, penetration-test summaries, security documentation, or equivalent evidence. ClearMark may make its then-current ISO/IEC 27001:2022 certificate or other appropriate evidence of certification available through its Trust Center or upon reasonable request. Any certification representation is limited to the scope and validity period stated in the applicable certificate.

8.3 Audits. If such evidence is insufficient to satisfy a legally required audit, Customer may conduct one reasonable audit in a twelve-month period with at least thirty (30) days' notice, during normal business hours and in a manner that minimizes disruption and protects other customers' information. Additional audits may be permitted following a confirmed Personal Data Breach materially affecting Customer Personal Data or when required by a competent regulator.

9.1 During the term. ClearMark will retain Customer Personal Data only for as long as reasonably necessary to provide the Services, follow Customer's documented instructions, or comply with law.

9.2 Termination. Following termination or expiration of the Agreement, ClearMark will, upon Customer's written request made within thirty (30) days, make Customer Data available for export in a commercially reasonable format as provided in the Agreement. After that period, ClearMark may delete Customer Personal Data from its systems, subject to routine backup retention schedules, applicable legal requirements, and legal holds.

9.3 Backups. Customer Personal Data may remain in routine backups until the applicable backup cycle expires. During that period, it will remain protected and will not be restored for ordinary business purposes except as necessary for disaster recovery, security, or legal compliance.

10.1 ServiceProvider/Contractor/Processor terms. Where the California Consumer Privacy Act ( CCPA), as amended by the California Privacy Rights Act (CPRA), or another applicable U.S. state privacy law applies, ClearMark will act as a Service Provider, Contractor, or Processor, as applicable. ClearMark will Process Customer Personal Data only for the specific business purposes described in the Agreement, this DPA, and Customer's documented instructions; will provide the same level of privacy protection required of such recipients by applicable law; and will not sell or share Customer Personal Data, retain, use, or disclose it outside the direct business relationship with Customer or for purposes other than those specified in the Agreement and this DPA, or combine it with Personal Data received from or on behalf of another person or collected from ClearMark's own interactions with an individual, except as expressly permitted by applicable law.

10.2 Compliance, oversight, and remediation. ClearMark will notify Customer if ClearMark determines it can no longer meet its applicable obligations under the CCPA/CPRA or other applicable U.S. state privacy law. Customer may take reasonable and appropriate steps permitted by applicable law to help ensure that ClearMark uses Customer Personal Data consistently with Customer's obligations, including through the compliance evidence and audit mechanisms in Section 8, and may require ClearMark to stop and remediate unauthorized Processing.

11.1 Liability. Except where applicable law or an incorporated transfer mechanism requires otherwise, the limitations of liability, exclusions of damages, indemnities, and other risk-allocation terms in the Agreement apply to this DPA.

11.2 Term. This DPA becomes effective when it is incorporated into or accepted under the Agreement and remains in effect for as long as ClearMark Processes Customer Personal Data on Customer's behalf. Obligations that by their nature should survive termination will survive for so long as ClearMark retains Customer Personal Data.

11.3 Updates. ClearMark may update this DPA to reflect changes in law, regulation, or the Services. ClearMark will provide reasonable notice of material changes and will not materially reduce Customer's data-protection rights during an active subscription term except where required by law or agreed in writing.

11.4 Contact.
‍Privacy questions and notices may be sent to privacy@clearmark.ai.
Security concerns may be sent to security@clearmark.ai.
Legal notices may be sent to legal@clearmark.ai.

Subject matter and duration. ClearMark Processes Customer Personal Data to provide, operate, support, secure, and improve the Services for the term of the Agreement and any limited post-termination retention period described above.

Data subjects and categories. Data subjects may include Customer personnel, authorized users, producers or agents, and individuals whose information is contained in Customer-provided or Customer-authorized data sources. Personal Data may include business contact and account information, employment or professional information, identifiers, system or device information, and other Personal Data contained in Customer Data as determined by Customer.

Nature and purpose. Processing may include collection, organization, storage, retrieval, analysis, use, transmission, restriction, deletion, and other operations necessary to provide the Services. Customer should not provide sensitive personal information unless expressly authorized in writing by ClearMark and supported by the applicable Agreement and safeguards.

Subprocessors. ClearMark's then-current Subprocessor List is available through the Trust Center or upon request.