Data Processing Addendum

This DPA applies when Pixelbase Inc (“Pixelbase”) processes Customer Personal Data on behalf of the Customer in providing the Services. Capitalized terms not defined here have the meanings given in the MSA.

• “Customer Personal Data” means personal data within Customer Data.
• “Data Protection Laws” means the laws that apply to the processing of Customer Personal Data under the MSA, including the California Consumer Privacy Act as amended (“CCPA”) and other U.S. state privacy laws, and, where they apply, the EU General Data Protection Regulation (“GDPR”) and the UK GDPR.
• “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by Pixelbase.

Customer is the controller (or a processor acting for its own customer), and Pixelbase is its processor (or subprocessor) and, under the CCPA, its service provider. Schedule 1 describes the processing. Pixelbase is an independent controller only of the personal data it processes to run its own business — account administration, billing, security and the Service Data described in the MSA — as the Privacy Policy describes.

Pixelbase will process Customer Personal Data only on Customer's documented instructions, which are the MSA, this DPA, and Customer's use and configuration of the Services, unless the law requires otherwise (in which case Pixelbase will tell Customer first, unless the law forbids it). Pixelbase will tell Customer if it believes an instruction infringes Data Protection Laws.

Customer is responsible for the lawfulness of its instructions and for having the notices, consents and lawful bases needed for Pixelbase to process Customer Personal Data under this DPA.

As to Customer Personal Data, Pixelbase will not:

• sell or share it, as those terms are defined in the CCPA;
• retain, use or disclose it for any purpose other than providing the Services under the MSA, or outside the direct business relationship between Pixelbase and Customer;
• combine it with personal data it receives from or on behalf of anyone else, except as the CCPA permits a service provider to; or
• use it to train artificial intelligence models.

Pixelbase will comply with the obligations the CCPA places on service providers, will tell Customer if it can no longer meet them, and allows Customer to take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

Pixelbase restricts access to Customer Personal Data to personnel who need it to provide, secure or support the Services, and ensures they are bound by obligations of confidentiality.

Pixelbase implements and maintains the technical and organizational measures in Schedule 2, which are designed to protect Customer Personal Data against Security Incidents. It may update those measures over time, but will not materially reduce the overall level of protection they provide.

Customer gives Pixelbase general authorization to engage subprocessors. The current list is published on our Subprocessors page.

• Pixelbase imposes data protection obligations on each subprocessor that are at least as protective as this DPA, and remains responsible for its subprocessors' performance.
• Before a new subprocessor begins processing Customer Personal Data, Pixelbase will update the Subprocessors page and notify Customer's owner by email at least 30 days in advance, except in an emergency affecting the security or availability of the Services, in which case it will notify as soon as it can.
• Customer may object to a new subprocessor on reasonable data protection grounds within that period. The parties will discuss the objection in good faith; if they cannot resolve it, Customer may terminate the affected Services and receive a refund of fees prepaid for the period after termination.

The Services let Customer access, correct, export and delete Customer Personal Data. Where Customer cannot do so itself, Pixelbase will provide reasonable assistance in responding to requests from individuals exercising their rights under Data Protection Laws. If Pixelbase receives such a request directly, it will refer the individual to Customer and will not respond itself except to do so, unless the law requires it.

Pixelbase will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident. The notice will describe, as far as then known, the nature of the incident, the categories and approximate volume of data affected, its likely consequences, and the measures taken or proposed to address it, and will be supplemented as more becomes known. Pixelbase will take reasonable steps to contain and remediate the incident.

Notifying Customer of a Security Incident is not an acknowledgement of fault or liability. Unsuccessful attempts that do not compromise the security of Customer Personal Data — pings, port scans, failed sign-ins — are not Security Incidents.

Taking into account the nature of the processing and the information available to it, Pixelbase will provide reasonable assistance with data protection impact assessments and prior consultations with regulators that Data Protection Laws require of Customer in connection with the Services.

Pixelbase will make available the information reasonably necessary to demonstrate its compliance with this DPA. That includes responding, once a year, to a reasonable written security questionnaire from Customer. Where Data Protection Laws or a regulator require an audit that the information provided does not satisfy, Customer may conduct one at its own expense, on at least 30 days' notice, during business hours, no more than once a year, by an auditor bound by confidentiality, in a way that does not disrupt the Services or expose other customers' data.

When the MSA ends, Customer may export Customer Personal Data as the MSA describes. Pixelbase will then delete it as the Data Retention Policy describes, except where the law requires it to keep it. Copies in backups are deleted as the backups expire in their normal cycle and remain protected by this DPA until then.

Pixelbase stores and processes Customer Personal Data in the United States. Where the GDPR or the UK GDPR applies to a transfer of Customer Personal Data to Pixelbase, the parties agree to the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 (Module Two where Customer is a controller, Module Three where it is a processor), with the UK International Data Transfer Addendum for transfers from the UK. They are incorporated into this DPA by reference, with Schedule 1 supplying their Annex I, Schedule 2 their Annex II, and the Subprocessors page their Annex III. For the clauses, the optional docking clause applies, Option 2 of Clause 9 applies with the notice period in Section 6, the optional language of Clause 11 does not, and Clauses 17 and 18 are governed by and resolved in Ireland.

This DPA takes effect when the MSA does and lasts as long as Pixelbase processes Customer Personal Data. Each party's liability under this DPA is subject to the limitations in the MSA. As to the processing of personal data, this DPA prevails over the rest of the MSA, and the Standard Contractual Clauses, where they apply, prevail over this DPA.

• Encryption. TLS for data in transit; encryption at rest for the database, file storage and backups. Credentials, tokens and other secrets are additionally encrypted at the field level with keys that can be rotated.
• Access control. Phone-verified sign-in, optional account PIN lock, single sign-on and SCIM deprovisioning for companies that use them, IP allowlists, and role-based scopes within each company. The application connects to the database as a least-privilege role, and administrative access to production is limited to the personnel who need it.
• Isolation. Every request is authorized against the company it concerns; companies cannot read each other's data.
• Resilience. Point-in-time recovery for the database and daily encrypted off-site backups held in a separate cloud account, with restores tested.
• Monitoring and abuse prevention. Rate limiting, request and connection audit logs, and error and health monitoring.
• Secure development. Code review, automated tests, static analysis and dependency vulnerability scanning on every change; production deploys only from signed commits.
• Vendors. Subprocessors are assessed for their security practices and bound by written data protection terms.
• Incident response. A documented process for investigating, containing and notifying Security Incidents under Section 8.