Data Processing Agreement

1. Scope and roles

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Closad LLC ("Closad") and the customer that accepts them ("Customer"). It applies when Closad processes Customer Personal Data on Customer's behalf and Data Protection Laws apply to that processing. It takes effect automatically when Customer accepts the Terms. A countersigned copy is available on request at legal@closad.com.

Definitions.

• "Data Protection Laws" means all privacy and data protection laws that apply to the processing, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act ("CCPA").
• "Customer Personal Data" means personal data in Customer Data (as defined in the Terms) that Closad processes on Customer's behalf to provide the Service.
• "Sub-processor" means a third party Closad engages to process Customer Personal Data.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• "Controller," "processor," "data subject," "personal data" and "processing" have the meanings given in the GDPR.

Roles. Customer is the controller and Closad is the processor of Customer Personal Data. Closad is a separate controller of personal data it uses to run its own business, such as account administration, billing, security and product analytics, as described in its Privacy Policy. This DPA does not apply to that data.

Customer responsibilities. Customer is responsible for having a lawful basis to provide Customer Personal Data to Closad and for giving any notices and obtaining any consents required by Data Protection Laws. Customer will not add special categories of personal data, health information regulated under HIPAA, biometric data, government identification numbers or payment card data to the Service. Closad is not a HIPAA business associate. Customer will defend, indemnify and hold harmless Closad against third-party claims arising from personal data Customer adds to the Service in breach of this paragraph or of Data Protection Laws.

2. Closad's obligations

Instructions. Closad will process Customer Personal Data only on Customer's documented instructions, which are the Terms, this DPA and Customer's use and configuration of the Service, unless required otherwise by law. If required by law to process it otherwise, Closad will tell Customer first unless the law prohibits it. Closad will tell Customer if it believes an instruction violates Data Protection Laws.

Confidentiality. Closad will ensure that anyone it authorizes to process Customer Personal Data is bound by an obligation of confidentiality.

Security. Closad will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, including those in Annex 2. Closad may update these measures as long as the overall level of protection is not reduced.

Data subject requests. If Closad receives a request from a data subject about Customer Personal Data, it will forward the request to Customer and will not respond directly except to confirm the request was forwarded. Taking into account the nature of the processing, Closad will assist Customer, through the Service's features or otherwise, in responding to such requests.

Other assistance. Closad will provide reasonable assistance to Customer with data protection impact assessments and consultations with supervisory authorities, to the extent required by Data Protection Laws and relating to Closad's processing.

3. Sub-processors

Authorization. Customer gives Closad general authorization to engage Sub-processors. The current Sub-processors are listed in Annex 3.

Sub-processor terms. Closad will have a written agreement with each Sub-processor that imposes data protection obligations no less protective than this DPA, and remains responsible for each Sub-processor's performance of those obligations.

Changes. Closad will notify Customer by email or in the Service at least 30 days before engaging a new Sub-processor. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected part of the Service and receive a pro-rated refund of prepaid fees for the remaining term, as its sole remedy.

4. Security incidents

Closad will notify Customer without undue delay, and where feasible within 72 hours, after confirming a Security Incident. The notice will describe, as far as then known, the nature of the incident, the categories and approximate number of data subjects and records affected, the likely consequences and the measures taken or proposed. Closad will take reasonable steps to contain and investigate the incident and to reduce its effects. A notice is not an admission of fault or liability.

5. International transfers

Customer Personal Data is processed in the United States. Where Customer Personal Data subject to the GDPR is transferred to Closad in a country without an adequacy decision, the parties agree to the Standard Contractual Clauses approved by European Commission Decision 2021/914, Module Two (controller to processor) ("SCCs"), which are incorporated by reference, with Customer as data exporter and Closad as data importer. For the SCCs: the optional docking clause in Clause 7 does not apply; Clause 9 option 2 (general authorization) applies with the notice period in Section 3; the optional language in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Ireland; and Annexes I and II are completed by Annexes 1 and 2 of this DPA.

For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the SCCs applies. For transfers subject to Swiss law, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent authority.

6. Audits

On written request, and no more than once a year, Closad will provide information reasonably needed to show its compliance with this DPA, such as answers to a reasonable security questionnaire and its Sub-processors' available third-party certifications or audit reports (for example, SOC 2 reports). Customer will rely on this information first. Only if it is not enough to meet Customer's obligations under Data Protection Laws, or a supervisory authority requires it, may Customer conduct an audit, with at least 30 days' notice, during business hours, remotely where possible, under a confidentiality agreement and at Customer's own cost. Audits will not include penetration testing, or access to Sub-processors' systems or other customers' data.

7. Deletion and return

When Customer's subscription ends, Customer may export its data through the Service until the end of its access period. Closad will delete Customer Personal Data within 30 days after the plan ends, unless the law requires Closad to keep it. Deleted data may remain in encrypted backups for up to 7 days until they are overwritten, and is not restored except to recover from a system failure.

8. US state privacy laws

Where the CCPA or a similar US state law applies, Closad acts as Customer's "service provider" or "processor" and will not:

1. Sell or share Customer Personal Data, as those terms are defined in those laws.
2. Retain, use or disclose Customer Personal Data for any purpose other than providing the Service and the other business purposes allowed by those laws.
3. Retain, use or disclose Customer Personal Data outside its direct business relationship with Customer.
4. Combine Customer Personal Data with personal data it receives from other sources, except as those laws allow.

Closad will comply with the obligations those laws place on service providers, will notify Customer if it can no longer meet them, and permits Customer to take reasonable steps to stop and remediate any unauthorized use. Closad certifies that it understands and will comply with these restrictions.

9. Liability and precedence

Each party's liability arising from this DPA, including the SCCs as between the parties, is subject to the limitations and exclusions of liability in the Terms, including the aggregate liability cap, and counts toward that cap, to the extent permitted by Data Protection Laws. Nothing in this DPA limits a data subject's rights under the SCCs. If there is a conflict, the SCCs take precedence over this DPA, and this DPA takes precedence over the Terms, except for the limitations of liability, which continue to apply. This DPA ends automatically when Closad no longer processes Customer Personal Data.

Annex 1: Details of processing

Annex 2: Security measures

• Encryption: data is encrypted in transit with TLS and encrypted at rest by our database and hosting providers.
• Access control: customer data is separated by account and workspace using database row-level security. Server-side permission checks enforce admin, editor and viewer roles.
• Administrative access: access to production systems is limited to authorized personnel, protected by multi-factor authentication, and credentials and API keys are stored as protected environment variables, not in code.
• Payments: card details are handled by Stripe, a PCI DSS certified provider. Closad does not store full card numbers.
• Backups and availability: daily database backups kept for 7 days, and uptime monitoring with alerts.
• Monitoring: error monitoring and logging to detect and investigate problems.
• Abuse protection: bot and spam protection on public forms, and server-side checks on account and billing actions.
• Vendor management: sub-processors are reviewed before use and bound by written data protection terms.
• Incident response: a defined process to contain, investigate and notify affected customers of Security Incidents.
• Deletion: Customer Personal Data is deleted within 30 days after a plan ends, as described in Section 7.

Annex 3: Sub-processors

Closad also uses third-party providers to collect public advertising data. They do not receive or process Customer Personal Data, so they are not Sub-processors under this DPA. They are listed in Closad's Privacy Policy.