SOFTLEDGER, INC.
Data Processing Addendum

1. Role and Scope of Processing
   1. The parties acknowledge that with regard to and to the extent of any processing of Customer Personal Data, Customer shall be the Controller and Softledger shall process Customer Personal Data as a Processor on behalf of Customer.
   2. Softledger will process Customer Personal Data only in accordance with Customer's documented instructions and will not process Customer Personal Data for its own purposes, except where required by applicable law(s). The Agreement, including this DPA, along with Customer’s configuration of any settings or options in the Services (as Customer may be able to modify from time to time), constitute Customer’s complete and final instructions to Softledger regarding the Processing of Customer Personal Data, including for purposes of the Standard Contractual Clauses.
   3. Each party shall comply with its obligations under Applicable Privacy Law(s) in respect of any Customer Personal Data it Processes under or in connection with the Services or this DPA. Without prejudice to the foregoing, Customer is responsible for determining whether the Services are appropriate for the storage and processing of Customer Personal Data under Applicable Privacy Law(s) and for the accuracy, quality and legality of the Customer Personal Data and the means by which it acquired Customer Personal Data. Customer further agrees that it has provided notice and obtained all consents, permissions and rights necessary for Softledger and its Subprocessors to lawfully process Customer Personal Data for the purposes contemplated by the Agreement (including this DPA).
   4. Softledger shall promptly notify Customer if it makes a determination that Customer's instructions infringe Applicable Privacy Law(s) (but without obligation to actively monitor Customer's compliance with Applicable Privacy Law(s)) and in such event, Softledger shall not be obligated to undertake such Processing until such time as the Customer has updated its processing instructions and Softledger has determined that the incidence of non-compliance has been resolved.
   5. Details of Data Processing:
      1. Subject matter: The subject matter of the data processing under this DPA is the Customer Personal Data.
      2. Duration: As between Customer and Softledger, the duration of the processing is the term of the Agreement plus any period after the termination or expiry of the Agreement during which Softledger will process Customer Personal Data in accordance with the Agreement.
      3. Purpose: Softledger will process Customer Personal Data as necessary to perform the Services pursuant to the Agreement, as further instructed by Customer in its use of the Services.
      4. Nature of the processing: The provision of the Services as described in the Agreement and initiated by the Customer from time to time.
      5. Types of Customer Personal Data. Customer Personal Data uploaded to the Services into Customer's Softledger account.
      6. Categories of data subjects: The data subjects could include Customer's employees, consultants, agents and third parties authorized to use the Services as "Users" under Customer's Softledger account and any other data subjects whose personal data is submitted to Softledger by Customer through the Services.
2. Subprocessing
   1. Customer grants Softledger a general authorization to subcontract the processing of Customer Personal Data to a Subprocessor on the list provided to Customer by Softledger from time to time ("Subprocessor List") and Softledger will:
      1. provide 10 days prior written notice to Customer in the event of the engagement of any new or replacement Subprocessor, including updating the Subprocessor List;
      2. impose substantially the same data protection terms on any Subprocessor it engages as contained in this DPA (including data transfer provisions, where applicable); and
      3. remain liable to Customer for any breach of this DPA caused by an act, error or omission of such Subprocessor.Customer grants Softledger a general authorization to subcontract the processing of Customer Personal Data to a Subprocessor on the list provided to Customer by Softledger from time to time ("Subprocessor List") and Softledger will:
   2. Customer may object to Softledger’s  appointment  of any new or replacement Subprocessor promptly in writing within thirty (30) days after receipt of notice in accordance with (3.1 (a)) and on reasonable grounds related to Subprocessor's ability to comply with Applicable Privacy Law(s). In such case, the parties shall discuss Customer´s concerns in good faith with a view to achieving a commercially reasonable resolution. If the parties cannot reach such resolution, Softeldger shall have the right, at its sole discretion, to either not appoint the disputed Subprocessor, or permit Customer to suspend or terminate the applicable Order and/or the Agreement. In the event, Customer exercises its right of termination under this Section 3.2,  Softledger will refund to Customer a pro rata share of any prepaid fees for the remaining and unexpired portion of the applicable Subscription Term from the date of termination. These procedures are Customer’s exclusive remedy and Softledger’s entire liability for resolving Customer’s objections to Softledger’s appointment of Subprocessor’s under this DPA.
3. Cooperation
   1. Softledger all reasonably cooperate with Customer to enable Customer to respond to any requests, complaints or other communications from data subjects and regulatory or judicial bodies relating to the processing of Customer Personal Data, including requests from data subjects seeking to exercise their rights under Applicable Privacy Law(s).  In the event that any such request, complaint or communication is made directly to Softledger, Softledger shall, once it has identified the request is from or related to a data subject for whom the Customer is responsible, pass this onto Customer and shall not respond to such communication without Customer's express authorization (unless required to do so in order to comply with applicable law(s)).
   2. To the extent Softledger is required under Applicable Privacy Law(s), Softledger will assist Customer to conduct a data protection impact assessment and, where legally required, consult with applicable data protection authorities in respect of any proposed processing activity that presents a high risk to data subjects.
   3. Taking into account the nature of the processing, Customer agrees that it is unlikely that Softledger would become aware that Customer Personal Data transferred under the Standard Contractual Clauses is inaccurate or outdated. Nonetheless, if Softledger becomes aware that Customer Personal Data transferred under the Standard Contractual Clauses is inaccurate or outdated, it will inform Customer without undue delay. Softledger will reasonably cooperate with Customer to erase or rectify inaccurate or outdated Customer Personal Data transferred under the Standard Contractual Clauses.
4. Data Access & Security Measures
   1. Softledger will ensure that any personnel tasked with the processing of Customer Personal Data are subject to an appropriate duty of confidentiality (whether a contractual or statutory duty) and that they process Customer Personal Data only for the purpose of delivering the Services.
   2. Softledger will implement and maintain reasonable and appropriate technical and organizational security measures with the aim of protecting Customer Personal Data from Security Incidents in accordance with the measures listed in Schedule 2 ("Security Measures"). Customer acknowledges that the Security Measures are subject to technical progress and development and that Softleger may update or modify the Security Measures from time to time, provided that such updates and modifications do not degrade or diminish overall security of the Services.
5. Security Incidents
   In the event of a Security Incident, Softledger shall inform Customer without undue delay and will provide written details of the Security Incident to Customer, including the type of data affected and the identity of affected person(s), once such information becomes known or available to Softledger.  Softledger shall, to the extent possible, provide timely information and cooperation to Customer to allow Customer to fulfil its data breach reporting obligations under Applicable Privacy Law(s) and shall take reasonable steps to remedy or mitigate the effects of the Security Incident. The obligations herein shall not apply to Security Incidents that are caused by the Customer or its users.
6. Security Reports & Inspections
   1. Upon request, Softledger shall provide copies of any certifications, audit report summaries and/or other relevant documentation it holds, where reasonably required by Customer to verify Softledger's compliance with this DPA.
   2. While it is the parties' intention ordinarily to rely on Softledger's obligations set forth in Section 7.1 to verify Softledger's compliance with this DPA, following a confirmed Security Incident or where a data protection authority requires it, Customer may provide Softledger with thirty (30) days’ prior written notice requesting that a third-party conduct an audit of Softledger's operations ("Audit"); provided that (i) any Audit shall be conducted at Customer’s expense; (ii) the parties shall mutually agree upon the scope, timing and duration of the Audit; (iii) the Audit shall not unreasonably impact Softledger's regular operations.
   3. Any written responses or Audit described in this Section 7 shall be subject to the confidentiality provisions of the Agreement.  The parties agree that the audits described in Clause 8.9 of EU SCCs shall be carried out in accordance with this Section 7 (Security Reports & Instructions).

7. Data Transfers

   1. Customer Personal Data that Softledger processes under the Agreement may be processed in any country in which Softledger, its Affiliates, and Sub-processors maintain facilities to perform the Services, as further detailed in the Subprocessor List. Softledger shall not process or transfer Customer Personal Data (nor permit such data to be processed or transferred) outside of EEA, Switzerland or UK, unless it first takes such measures as are necessary to ensure the transfer is in compliance with this EU/UK Data Protection Law.
   2. The parties agree that, when the transfer of Customer Personal Data from Customer to Softledger is a Restricted Transfer, it shall be governed by the EU SCCs, which the parties hereby enter into and incorporate into this DPA as Annex III. In the event that any provision of this DPA contradicts, directly or indirectly, the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.
   3. To extent that and for so long as the EU SCCs as implemented in accordance with Section 8.2 cannot be used to lawfully transfer Customer Personal Data in compliance with the UK GDPR, the UK SCCs shall be incorporated by reference and form an integral part of this DPA and shall apply to transfers of Personal Data governed by the UK GDPR. For the purposes of the UK SCCs, the relevant annexes, appendices or tables shall be deemed populated with the relevant information set out in this DPA.
   4. If Softledger adopts an alternative lawful data export mechanism for the transfer of personal data not described in this DPA ("Alternative Transfer Mechanism"), the Alternative Transfer Mechanism shall apply instead of any applicable transfer mechanism described in this DPA (but only to the extent such Alternative Transfer Mechanism complies with EU/UK Data Protection Law and extends to the territories to which the relevant Customer Personal Data is transferred).
8. Deletion & Return  
   1. Upon Customer's request, or upon termination or expiry of this DPA, Softledger shall destroy or return to Softledger all Customer Personal Data in its possession in accordance with Softledger’s then-current data deletion timelines and policies, which may be requested by Customer at any time.  This requirement shall not apply to the extent that Softledger is required by any applicable law to retain some or all of the Customer Personal Data, in which event Softledger shall isolate and protect such Customer Personal Data from any further processing except to the extent required by such law. The parties agree that the certification of deletion of Personal Data described in Clause 8.5 and 16.(d) of EU SCCs shall be provided by Softledger to Customer only upon Customer's written request.

9. California Consumer Privacy Act (CCPA)

   1. To the extent that Customer has users of the Services who are residents of the state of California in the United States and the CCPA applies, the terms set forth in this Section 10 shall apply to this DPA.
   2. The following amendments shall be made to the definitions set forth in Section 1 of this DPA:
      1. The following amendments shall be made to the definitions set forth in Section 1 of this DPA:
      2. “Business” has the meaning given to it in the CCPA.
      3. “Service Provider” has the meaning given to in the CCPA.
   3. For purposes of Customer Personal Data constituting “personal information” under the CCPA, Customer is a Business and Softledger is a Service Provider. Customer’s transfer of Customer Personal Data to Softledger is not a sale, and Softledger provides no monetary or other valuable consideration to Customer in exchange for Personal Data.
   4. Softledger agrees to comply with all applicable requirements of the CCPA, and if and to the extent agreed between Customer and Softledger in writing as set forth in this DPA.
   5. As applicable to the Services, Softledger shall reasonably assist Customer in responding (at Customer’s expense) to any request from a data subject (including “verifiable consumer requests”, as such term is defined in the CCPA), relating to the processing of Customer Personal Data under the Agreement.
10. General
    1. Except for the changes made by this DPA, the Agreement remains unchanged and in full force and effect.  If there is any conflict between any provision in this DPA and any provision in the Agreement, this DPA controls and takes precedence.  With effect from the effective date, this DPA is part of, and incorporated into the Agreement.
    2. In no event does this DPA restrict or limit the rights of any data subject or of any competent supervisory authority.
    3. Any claim or remedy Customer may have against Softledger, its employees, agents and Subprocessors, arising under or in connection with this DPA (including the Standard Contractual Clauses), whether in contract, tort (including negligence) or under any other theory of liability, shall to the maximum extent permitted by law be subject to the limitations and exclusions of liability in the Agreement. Accordingly, any reference in the Agreement to the liability of a party means the aggregate liability of that party under and in connection with the Agreement and this DPA together.
    4. This DPA may not be modified except by a subsequent written instrument signed by both parties.
    5. This DPA shall be governed by and construed in accordance with the governing law and jurisdiction provisions in the Agreement, unless required otherwise by Applicable Privacy Law(s) or the Standard Contractual Clauses.
    6. If any part of this DPA is held unenforceable, the validity of all remaining parts will not be affected.

ANNEX I

A. LIST OF PARTIES

MODULE TWO: Transfer controller to processor Data

exporter(s):

1. Name: The entity identified as the "Customer" in this DPA.
   Address: The address for the Customer associated with its Softledger account or otherwise specified in the DPA or this Agreement.Contact person’s name, position and contact details: The contact details associated with the Customer's account, or otherwise specified in this DPA or the Agreement.Activities relevant to the data transferred under these Clauses: The activities specified in Annex 1(B) below.  Role (controller/processor): Controller
2. Data importer(s):
3. Name: Softledger, Inc. (“Softledger”)Address: 202 Bicknell Ave, Santa Monica, CA 90405 Contact person’s name, position and contact details:
   

   Contact person's name, position and contact details:	Ben Taylor, ben.taylor@softledger.com
   DPO (if applicable) name contact details:	n/a

   Activities relevant to the data transferred under these Clauses: The activities specified in Annex 1(B) below.  Role (controller/processor): Processor

B. DESCRIPTION OF TRANSFER MODULE TWO: Transfer controller to processor

1. Categories of data subjects whose personal data is transferred:
   Customer employees, consultants, agents and authorized third parties to use the Services as "users"  under Customer's account and any other data subjects whose personal data that may be submitted to Softledger by Customer through the Services.
2. Categories of personal data transferred:
   name, email address and other personal data as may be submitted by Customer through the Services, including as Customer Content.
3. Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
   None.
4. The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
   Customer Personal Data may be transferred on a continuous or one-off basis depending on the Customer's use of the Services and the Customer's processing instructions.
5. Nature of the processing
   See below
6. Purpose(s) of the data transfer and further processing
   For Softledger to provide, maintain and improve the Services provided to data exporter pursuant to the Agreement.
7. The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
   Softledger will retain Customer Personal Data for up to 180 days after termination or expiry of the Agreement.
8. For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
   Duration:  The term of the Agreement plus any period after the termination or expiry of the Agreement during which Softledger will process Customer Personal Data in accordance with the Agreement.
   Subject matter: The subject matter of the data processing under this DPA is the Customer Personal Data.
   Nature of the processing:  The provision of the Services as described in the Agreement and initiated by the Customer from time to time.

C. COMPETENT SUPERVISORY AUTHORITY  MODULE TWO: Transfer controller to processor

Identify the competent supervisory authority/ies in accordance with Clause 13

The data exporter's competent supervisory authority will be determined in accordance with the GDPR.