Data Processing Addendum

Section 01

Background and Parties

This Data Processing Addendum (“DPA”) forms part of the agreement between LaunchStruc LLC, 3324 Rue Royale St, Ste 792, St Charles, MO 63301, USA (“Processor”), and the customer that subscribes to StrucPact (“Controller”), whether through the Terms of Service or a signed order (the “Agreement”). It applies where Processor processes Personal Data on behalf of Controller in providing StrucPact. If this DPA conflicts with the Agreement on the processing of Personal Data, this DPA controls.

Section 02

Definitions

• Applicable Data Protection Law: all laws applicable to the processing, including Regulation (EU) 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss FADP, and US state privacy laws including the California Consumer Privacy Act as amended by the CPRA.
• Personal Data: any information relating to an identified or identifiable natural person that is contained in Customer Data and processed by Processor under the Agreement.
• Controller, Processor, Data Subject, Processing, Supervisory Authority: have the meanings in the GDPR; “Controller” includes “business” and “Processor” includes “service provider” under US state law.
• Security Incident: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.
• Sub-processor: a third party engaged by Processor to process Personal Data.
• SCCs: the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.

Section 03

Roles and Scope of Processing

Controller is the controller of Personal Data and Processor is its processor. Processor shall process Personal Data only on Controller's documented instructions, which are the Agreement, this DPA and Controller's configuration and use of StrucPact, and shall inform Controller if it believes an instruction infringes Applicable Data Protection Law.

Subject matter and duration: provision of StrucPact for the term of the Agreement. Nature and purpose: analysis of contracts and generation of proposed redlines. Data subjects: individuals named in contracts, such as signatories, notice contacts and vendor personnel, and Controller's users. Categories of data: names, business contact details, job titles and any other personal data appearing in uploaded contracts. Controller shall not submit special category data unless the contract requires it and Controller has a lawful basis.

Processor shall not sell or share Personal Data, retain, use or disclose it outside the direct business relationship or for any purpose other than those in the Agreement, or combine it with other data, and shall not use Personal Data to train, fine-tune or evaluate any machine learning model.

Section 04

Confidentiality

Processor shall ensure that persons authorized to process Personal Data are bound by written or statutory confidentiality obligations, receive appropriate data protection training, and access Personal Data only as needed to provide the service.

Section 05

Security Measures

Processor shall implement and maintain appropriate technical and organizational measures to protect Personal Data, including at minimum:

• encryption of Personal Data in transit using TLS 1.3 and at rest using AES-256;
• role-based access control with least-privilege and named-user access to production systems;
• append-only audit logging of access, exports and configuration changes;
• logical separation of each customer's workspace and playbook data;
• vulnerability management, secure development practices and prompt remediation of confirmed issues;
• incident response procedures and backup and recovery processes.

Processor may update these measures provided that the update does not materially reduce the overall level of protection. Processor shall notify Controller of a Security Incident without undue delay and in any event within 72 hours of becoming aware of it, with the information reasonably available to Processor to allow Controller to meet its own notification duties.

Section 06

Sub-processor Authorization

Controller gives general written authorization for Processor to engage the Sub-processors listed below. Processor shall bind each Sub-processor to data protection obligations no less protective than this DPA, including the prohibition on training models with Personal Data, and remains liable for their performance.

Processor shall give Controller at least 30 days' written notice of a new or replacement Sub-processor, by email to the account administrator. Controller may object on reasonable data protection grounds within that period. The parties shall work in good faith to resolve the objection; if they cannot, Controller may terminate the affected service and receive a pro-rata refund of prepaid fees.

Section 07

Data Subject Requests and Assistance

Taking into account the nature of the processing, Processor shall assist Controller by appropriate technical and organizational measures in responding to requests from Data Subjects to exercise their rights. If Processor receives such a request directly, it shall not respond except to redirect the Data Subject to Controller, and shall notify Controller promptly. Processor shall also provide reasonable assistance with data protection impact assessments, prior consultations with Supervisory Authorities, and security and breach notification duties, at Controller's expense where the assistance exceeds what is reasonably required for standard service.

Section 08

Audits and Records

Processor shall make available to Controller the information necessary to demonstrate compliance with this DPA, including a completed security questionnaire on request. Controller may, no more than once per year and on 30 days' written notice, audit Processor's compliance, or more often after a Security Incident or where required by a Supervisory Authority. Audits shall be conducted during business hours, shall not unreasonably disrupt operations, are subject to confidentiality, and shall not give access to data of other customers.

Section 09

Deletion and Return of Data

During the term Controller can delete or export Personal Data using StrucPact. Within 30 days after the end of the Agreement, Processor shall, at Controller's choice, return or delete all Personal Data, and shall delete remaining copies, including those held by Sub-processors, within a further 60 days, as backups are overwritten, unless retention is required by law. On request Processor shall certify deletion in writing.

Section 10

International Transfers and EU Standard Contractual Clauses

Processor is established in the United States. Where Personal Data subject to the GDPR is transferred to Processor in a country without an adequacy decision, the parties agree that the SCCs apply and are incorporated by reference as follows:

• Module Two (Controller to Processor) applies to transfers from Controller to Processor.
• Module Three (Processor to Processor) applies to onward transfers to Sub-processors.
• Clause 7 (docking clause) applies; Clause 9(a) Option 2 applies with a 30-day notice period.
• Clause 11(a) optional independent dispute resolution language does not apply.
• Clause 17: the laws of Ireland. Clause 18(b): the courts of Ireland.
• Annex I describes the parties, the processing and the competent Supervisory Authority as set out in this DPA and Controller's account records; Annex II is the security measures in Section 5; Annex III is the Sub-processor table in Section 6.

For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the SCCs is incorporated, with the tables completed by the information in this DPA. For transfers subject to the Swiss FADP, the SCCs apply with references to the GDPR read as references to the FADP and the Swiss Federal Data Protection and Information Commissioner as competent authority. If the SCCs conflict with this DPA, the SCCs prevail.

Section 11

US State Privacy Laws

Processor acts as a service provider and processor under US state privacy laws. Processor shall comply with applicable obligations, shall provide the same level of privacy protection as required of businesses, shall notify Controller if it can no longer meet its obligations, and grants Controller the right to take reasonable steps to stop and remediate unauthorized use of Personal Data.

Section 12

Liability and Governing Law

Each party's liability under this DPA is subject to the limitations in the Agreement, except where the SCCs or Applicable Data Protection Law provide otherwise. Subject to the SCCs, this DPA is governed by the laws of the State of Missouri, and the exclusive venue is as stated in the Terms of Service.

Section 13

Contact and Execution

This DPA is effective on acceptance of the Agreement and does not require separate signature. Customers that need a countersigned copy for their records may request one at [email protected]. Data protection inquiries may also be sent to LaunchStruc LLC, 3324 Rue Royale St, Ste 792, St Charles, MO 63301, USA, telephone +1 (573) 271-9007.