DATA PROCESSING ADDENDUM

1DEFINITIONS, SCOPE AND ROLES

1.1 Definitions. In this DPA:

“Business Day” means any day other than a Saturday, a Sunday or a day on which banking institutions in New York, New York are permitted or required by law to remain closed.

“Customer Data” means the Customer Property (as defined in the Online Master Services Agreement) or the Customer Content (as defined in the Platform Terms of Service), as applicable under the Agreement.

“Data Incident” means a breach of Prime Intellect’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Personal Data in Prime Intellect’s possession or control. Data Incident does not include unsuccessful attempts or activities that do not compromise the security of Personal Data, such as unsuccessful login attempts, pings, port scans, denial of service attacks or other network attacks on firewalls or networked systems.

“Sub-processor” means any third party engaged by Prime Intellect that Processes Personal Data on Customer’s behalf, including third-party data center, compute infrastructure, hosting, networking, storage and support providers.

1.2 Data Processing. In the course of providing the Services to Customer under the Agreement, Prime Intellect may Process, on Customer’s behalf, information included in the Customer Data that constitutes “personal data,” “personal information,” “personally identifiable information” or an analogous term under any applicable privacy and data protection laws (“Personal Data” and “Data Protection Laws”, respectively). Data Protection Laws include the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection (“FADP”), the CCPA and other U.S. state privacy laws, in each case to the extent applicable to the Processing. “Process”, “Processed” and “Processing” mean any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means.

1.3 Subject Matter. The subject matter, nature and purpose of the Processing of Personal Data, the types of Personal Data, and the categories of “Data Subjects” (as defined under applicable Data Protection Laws) are set out in Schedule I, which is an integral part of this DPA.

1.4 Roles. Customer is a “Controller” or “Business” (as defined under applicable Data Protection Laws) and appoints Prime Intellect as a “Processor” or “Service Provider” (as defined under applicable Data Protection Laws) on behalf of Customer. Where Customer acts as a Processor on behalf of a third-party Controller, Prime Intellect is Customer’s Sub-processor, Customer is Prime Intellect’s sole point of contact and is responsible for obtaining any authorization required from that Controller, and Customer warrants that its instructions and its appointment of Prime Intellect have been authorized by that Controller. Customer is responsible for compliance with the requirements of Data Protection Laws applicable to Controllers and Businesses.

1.5 Scope. This DPA applies only to Personal Data that Prime Intellect Processes on behalf of Customer as a Processor or Service Provider in providing the Services. It does not apply to (a) Personal Data that Prime Intellect Processes as an independent Controller or Business for its own business purposes, such as Account registration, billing and business contact information, which Prime Intellect Processes in accordance with its privacy policy and Data Protection Laws; (b) Usage Information, which does not identify Customer or any User; or (c) Personal Data stored or Processed in any compute environment, cloud account or other system that Customer controls and connects to or uses with the Services, except to the extent Prime Intellect or its personnel access or Process that Personal Data in providing the Services.

2PROCESSING INSTRUCTIONS

Prime Intellect shall Process Personal Data on behalf of and solely in accordance with Customer’s documented instructions, unless required to do so by applicable law to which Prime Intellect is subject, in which case Prime Intellect will inform Customer of that legal requirement before Processing unless the law prohibits it. Customer’s complete documented instructions as of the date Customer accepts this DPA are the Agreement (including its provisions restricting the use of Customer Data to train models and governing the Processing of Personal Data), this DPA, each Order (if any), and Customer’s and its Users’ configuration and use of the Services, including through the Platform, the APIs and Customer’s Account. Customer instructs Prime Intellect to Process Personal Data to create Usage Information as described in the Agreement. Any additional instructions must be in writing, consistent with the Agreement and Data Protection Laws, and technically feasible, and are subject to the Parties’ agreement on additional Fees where they materially increase Prime Intellect’s obligations. Prime Intellect will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the affected Processing until Customer withdraws or modifies the instruction.

3CUSTOMER OBLIGATIONS

Customer shall comply with all applicable Data Protection Laws in providing Personal Data to Prime Intellect. Customer represents and warrants that all such Personal Data was collected and at all times Processed and maintained by or on behalf of Customer in compliance with all applicable Data Protection Laws, including with respect to any obligations to provide notice to or obtain consent from Data Subjects. Customer shall notify Prime Intellect without undue delay if Customer determines that the Processing of Personal Data under the Agreement and this DPA does not or will not comply with applicable Data Protection Laws, in which case Prime Intellect is not required to continue Processing that Personal Data. Customer may Process Personal Data subject to non-U.S. Data Protection Laws through the Services only in accordance with this DPA. Customer shall not provide to Prime Intellect, or Process through the Services, any special categories of Personal Data, any other data that the acceptable use policy in the Agreement prohibits, or any protected health information under HIPAA (“PHI”), except as Prime Intellect approves in writing or under a business associate agreement signed by both Parties (“BAA”), as applicable. This DPA does not govern PHI, which is governed solely by the BAA, if any.

4PERSONNEL

Prime Intellect will ensure that all employees and contractors authorized to Process Personal Data are subject to a contractual or statutory obligation of confidentiality.

5LIMITATIONS ON PROCESSING

To the extent required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations (collectively, the “CCPA”):

5.1 Prohibitions. Prime Intellect is prohibited from: (i) retaining, using or disclosing Personal Data for any purpose other than for the specific purposes of performing the Services or in accordance with Customer’s documented instructions (including as set out in the Agreement), or as otherwise permitted for service providers under the CCPA; (ii) retaining, using or disclosing Personal Data outside of the direct business relationship between the Parties; (iii) combining Personal Data with “Personal Information” (as defined under the CCPA) obtained from, or on behalf of, sources other than Customer, except as permitted for service providers under the CCPA; and (iv) “Selling” or “Sharing” (as defined under the CCPA) Personal Data.

5.2 Level of Protection. Prime Intellect shall provide the same level of privacy protection to Personal Data as is required by the CCPA. Prime Intellect shall notify Customer without undue delay if it determines that it can no longer meet its obligations under the CCPA, and Customer has the right to take reasonable and appropriate steps to help ensure that Prime Intellect uses Personal Data in a manner consistent with Customer’s obligations under the CCPA and to stop and remediate any unauthorized use of the Personal Data.

5.3 Certification. Prime Intellect certifies that it understands and will comply with the restrictions in this Section 5. The business purposes for which Prime Intellect Processes Personal Data are the provision of the Services as described in the Agreement and Schedule I.

6SECURITY AND DATA INCIDENTS

6.1 Security. Prime Intellect will implement and maintain the technical and organizational measures described in Schedule I, which are designed to protect Personal Data in Prime Intellect’s possession or control against Data Incidents. Prime Intellect may update those measures from time to time, provided the updates do not materially decrease the overall security of the Services. Security of the Services is subject to the shared responsibility model described in the Agreement, and Customer is responsible for configuring and using the Services, its Account, any sandbox network access, tunnel and secret settings, and any compute environment or other system that Customer connects to or uses with the Services, in a manner appropriate to the Personal Data it Processes.

6.2 Data Incidents. Prime Intellect shall notify Customer in writing without undue delay, and in any event within 72 hours, after becoming aware of a Data Incident, and will provide further information about the Data Incident in phases as more details become available. Prime Intellect will take reasonable steps to contain and mitigate the Data Incident and will provide reasonable assistance to enable Customer to meet its notification obligations to Data Subjects and Supervisory Authorities, at no charge where the Data Incident was caused by Prime Intellect or its Sub-processors and otherwise at Customer’s reasonable cost. Prime Intellect’s notification of or response to a Data Incident is not an acknowledgment of fault or liability. Data Incidents do not include incidents arising from Customer’s or its Users’ credentials, from any compute environment or other system that Customer controls, or from Customer’s use of the tunnel service or any other feature that makes a sandbox reachable outside its isolation boundary.

7SUB-PROCESSING

7.1 Sub-processors. Customer provides general written authorization for Prime Intellect to engage Sub-processors to Process Personal Data, subject to this Section 7. Customer approves the Sub-processors that Prime Intellect uses as of the date Customer accepts this DPA. A current list of Sub-processors is available to Customer on request by email to privacy@primeintellect.ai.

7.2 Sub-processor Agreements. Prime Intellect will enter into a written agreement with each Sub-processor containing, in substance, data protection obligations no less protective than those in this DPA with respect to the protection of Personal Data, to the extent applicable to the nature of the services the Sub-processor provides.

7.3 Sub-processor Changes. Prime Intellect will give Customer at least 10 Business Days’ notice, by email or through the Platform, before appointing a new Sub-processor or replacing an existing one. During that period Customer may object on reasonable and documented grounds relating to the confidentiality or security of Personal Data or the Sub-processor’s compliance with Data Protection Laws; if Customer does not object, Prime Intellect may proceed. If Customer objects, the Parties will discuss Customer’s concerns in good faith. If they cannot resolve the objection within 30 days, Customer may, as its sole and exclusive remedy, terminate the affected Order (or, where Customer uses the affected Services without an Order, stop using them) with respect to the Services that cannot be provided without the new Sub-processor, and Prime Intellect will refund any prepaid Fees for the terminated Services covering the period after termination. Where a replacement is needed urgently to protect the security or availability of the Services, Prime Intellect may replace a Sub-processor immediately and will notify Customer as soon as reasonably practicable.

7.4 Responsibility for Sub-processors. If any Sub-processor fails to fulfil its data protection obligations, Prime Intellect will be liable to Customer for the performance of those obligations, subject to the limitations of liability in the Agreement. Prime Intellect will notify Customer of any failure by a Sub-processor to fulfil its contractual obligations in relation to the Processing of Personal Data.

8ASSISTANCE

Taking into account the nature of the Processing and the information available to Prime Intellect, Prime Intellect will provide reasonable assistance to Customer to satisfy Customer’s obligations under Data Protection Laws, including in connection with implementing appropriate technical and organizational measures, complying with requests from Data Subjects and “Consumers” (as defined under applicable Data Protection Laws), responding to inquiries, complaints and investigations, conducting data protection assessments, and conducting prior consultations with regulators. Customer will first use the self-service features of the Services and the information Prime Intellect makes available, and Customer will reimburse Prime Intellect’s reasonable costs of any additional assistance, except assistance relating to a Data Incident caused by Prime Intellect or its Sub-processors. If Prime Intellect receives a request from a Data Subject relating to Personal Data, it will direct the Data Subject to Customer and will not respond to the request except as instructed by Customer or required by law. Unless prohibited by applicable law, Prime Intellect shall inform Customer without undue delay if Prime Intellect: (i) receives a request, complaint or other inquiry regarding the Processing of Personal Data from a Data Subject or a “Supervisory Authority” (as defined under applicable Data Protection Laws); (ii) receives a binding or non-binding request to disclose Personal Data from law enforcement, courts or any government body, before responding to that request; or (iii) is otherwise unable to comply with Data Protection Laws or this DPA.

9AUDIT

Upon Customer’s written request, no more than once in any 12-month period, Prime Intellect will make available to Customer information in its possession that is reasonably necessary to demonstrate its compliance with this DPA, which may include copies of any third-party certifications or audit reports Prime Intellect then maintains, summaries of its security policies, and written responses to reasonable security questionnaires (together, “Compliance Information”). Compliance Information is Prime Intellect’s Confidential Information. Solely to the extent Data Protection Laws (including Clause 8.9 of the SCCs) or a Supervisory Authority require an audit or inspection that the Compliance Information does not reasonably satisfy, Prime Intellect will allow for and contribute to an audit (an “Audit”), subject to the following: (a) Customer gives at least 30 days’ prior written notice identifying the legal requirement and the proposed scope; (b) the Parties agree the scope, timing and duration in advance; (c) the Audit is conducted by Customer or an independent auditor reasonably acceptable to Prime Intellect and bound by written confidentiality obligations, during normal business hours and without unreasonable disruption to Prime Intellect’s operations; (d) the Audit does not extend to other customers’ data, to Prime Intellect’s proprietary technology beyond what the legal requirement demands, or to facilities operated by Sub-processors, for which Prime Intellect will instead provide any audit reports the Sub-processor makes available; (e) no more than one Audit occurs in any 12-month period, unless required by a Supervisory Authority or following a Data Incident; and (f) Customer bears its own costs and reimburses Prime Intellect’s reasonable costs of the Audit. Customer will provide Prime Intellect a copy of any Audit report, which is Prime Intellect’s Confidential Information.

10INTERNATIONAL DATA TRANSFERS

10.1 European Data Transfers. Customer acknowledges that Prime Intellect is located in the United States and that Prime Intellect and its Sub-processors Process Personal Data in the United States and in the other locations in which they maintain facilities, subject to any location or data residency commitment expressly set out in an applicable Order. A transfer of Personal Data subject to the GDPR, the UK GDPR or the FADP (“European Data Protection Law”) to a country that is not subject to an adequacy decision or regulation recognized under the applicable European Data Protection Law is an “International Data Transfer”. Customer authorizes Prime Intellect and its Sub-processors to conduct International Data Transfers outside the European Economic Area (“EEA”) or Switzerland:

• to any country subject to a valid adequacy decision of the European Commission;
• on the basis of an organization’s binding corporate rules approved by EEA Supervisory Authorities; and
• to any data importer with whom Prime Intellect has entered into the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of June 4, 2021, as amended or replaced from time to time (the “SCCs”).

10.2 European Transfer Mechanisms. To the extent Customer’s transfer of Personal Data to Prime Intellect is an International Data Transfer, Customer and Prime Intellect conclude Module 2 (Controller-to-Processor) of the SCCs and, to the extent Customer is a Processor on behalf of a third-party Controller, Module 3 (Processor-to-Processor) of the SCCs, which are incorporated into this DPA and completed as follows: the “data exporter” is Customer; the “data importer” is Prime Intellect; the optional docking clause in Clause 7 is implemented; Option 2 of Clause 9(a) is implemented and the time period for prior notice is the period specified in Section 7.3 of this DPA; the optional redress clause in Clause 11(a) is struck; Option 1 in Clause 17 is implemented and the governing law is the law of Ireland; the courts in Clause 18(b) are the courts of Ireland; and Annexes I and II to the SCCs are Schedule I to this DPA. For International Data Transfers subject to the FADP, references to the GDPR in the SCCs are to the FADP, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner, and the term “Member State” in the SCCs does not exclude Data Subjects habitually resident in Switzerland from bringing claims in their place of habitual residence.

10.3 UK Data Transfers. Customer authorizes Prime Intellect to perform International Data Transfers outside the United Kingdom:

• to any country subject to a valid adequacy decision issued by the UK Government;
• on the basis of an organization’s binding corporate rules approved by the UK Information Commissioner; and
• to any data importer with whom Prime Intellect has entered into the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under Section 119A(1) of the UK Data Protection Act 2018 (version B1.0, in force March 21, 2022) (the “UK Addendum”) or other standard contractual clauses issued by the UK Information Commissioner, as appropriate.

10.4 UK Transfer Mechanism. Customer and Prime Intellect conclude the UK Addendum, which is incorporated into this DPA and applies to International Data Transfers outside the United Kingdom. Part 1 of the UK Addendum is completed as follows: (a) in Table 1, the “Exporter” is Customer and the “Importer” is Prime Intellect, and their details are set out in this DPA, the Agreement and Customer’s Account; (b) in Table 2, the first option is selected and the “Approved EU SCCs” are the SCCs referred to in Section 10.2 of this DPA; (c) in Table 3, Annexes 1 (A and B), II and III to the “Approved EU SCCs” are Schedule I to this DPA; and (d) in Table 4, both the “Importer” and the “Exporter” may terminate the UK Addendum.

10.5 Other Transfer Mechanisms. If Prime Intellect’s compliance with Data Protection Laws applicable to International Data Transfers is affected by circumstances outside Prime Intellect’s control, including if a legal instrument for International Data Transfers is invalidated, amended or replaced, the Parties will work together in good faith to reasonably resolve the non-compliance. If additional, replacement or alternative standard contractual clauses are approved by a Supervisory Authority or the UK Information Commissioner, Prime Intellect may update this DPA under Section 12 to add or substitute them.

11RETURN AND DELETION

Upon expiration or termination of the Agreement or the applicable Order, Prime Intellect will make Personal Data stored on the Platform available for retrieval by Customer for the retrieval period provided in the Agreement, which constitutes Prime Intellect’s return of that Personal Data, and upon Customer’s written request will return or destroy any Personal Data held for Professional Services in accordance with the Agreement. Within 30 days after the end of that retrieval period, Prime Intellect will delete the remaining Personal Data in its possession or control, except for copies retained in routine automated backup systems until overwritten or deleted in the ordinary course and copies that Prime Intellect is required by applicable law to retain, each of which remains subject to this DPA and the confidentiality obligations in the Agreement for as long as retained. Prime Intellect will provide written confirmation of deletion upon Customer’s written request.

12UPDATES

Prime Intellect may update this DPA from time to time by posting the updated version on its website with a new “Last updated” date. For material changes, Prime Intellect will also notify Customer by email or through the Platform at least 30 days before the changes take effect, except where a change is required by Data Protection Laws or a Supervisory Authority, in which case it takes effect on the date stated in the notice. An update takes effect as to Customer in accordance with the provisions of the Agreement governing updates. Prime Intellect will not update this DPA in a manner that materially reduces the protection of Personal Data under it, except as required by Data Protection Laws or a Supervisory Authority or to implement a transfer mechanism under Section 10.5.

13GENERAL

This DPA remains in effect for as long as Prime Intellect Processes Personal Data on Customer’s behalf. Each Party’s liability arising out of or related to this DPA, the SCCs and the UK Addendum, whether in contract, tort or under any other theory of liability, is subject to the limitations of liability in the Agreement to the extent permitted by Data Protection Laws, and any reference in the Agreement to a Party’s liability includes its liability under this DPA. Nothing in this DPA limits a Data Subject’s rights under the SCCs or the UK Addendum. This DPA is governed by the law, and disputes under it will be resolved in the manner, set out in the Agreement, except as the SCCs or the UK Addendum otherwise require. Customer may request a countersigned copy of this DPA by email to privacy@primeintellect.ai.

SCHEDULE IDESCRIPTION OF THE PROCESSING AND TRANSFER

1. LIST OF PARTIES

Data exporter:

• Name: Customer, as identified in its Account (address and contact details as set out in the Account).
• Activities relevant to the data transferred: Customer receives the Services described in the Agreement and any applicable Orders, which may include compute, inference, sandbox, lab, managed and professional services, and provides Personal Data to Prime Intellect in that context.
• Role (controller/processor): Controller (or, where Customer acts on behalf of a third-party Controller, Processor).

Data importer:

• Name: Prime Intellect, Inc. (contact: privacy@primeintellect.ai).
• Activities relevant to the data transferred: Prime Intellect provides the Services to Customer as described in the Agreement and any applicable Orders, and Processes Personal Data on behalf of Customer in that context.
• Role (controller/processor): Processor on behalf of Customer (or Sub-processor, where Customer acts as a Processor).

2. CATEGORIES OF DATA SUBJECTS

• Users (as defined in the Agreement).
• Customer’s personnel, staff and contractors.
• Individuals whose Personal Data is included in Customer Data or Output, including datasets, prompts and other model inputs, environments, code, files and other content that Customer or its Users submit to or Process on the Platform or provide for Professional Services.
• End users of Customer’s own products and services that are powered by the Services, where the Agreement or an Order permits that use.
• Other individuals as determined by Customer.

3. CATEGORIES OF PERSONAL DATA

• Professional contact details of Customer personnel, such as name, email address and employer.
• Personal Data contained in Customer Data or Output, which may include any category of Personal Data that Customer or its Users elect to include in datasets, prompts, model inputs, environments, workloads, files or other content.
• Any other categories of Personal Data provided to Prime Intellect through the Services as determined by Customer.

4. SENSITIVE DATA

None. Customer may not provide special categories of Personal Data or any other data that the acceptable use policy in the Agreement prohibits, except as Prime Intellect agrees in writing, in which case the restrictions and safeguards set out in that written agreement apply.

5. FREQUENCY OF THE TRANSFER

Continuous.

6. NATURE OF THE PROCESSING

Prime Intellect will Process Personal Data as necessary to provide the Services, including by receiving, storing, hosting, transmitting and deleting it; running Customer’s workloads on GPU and CPU compute capacity; executing code in sandboxes; running inference, training, fine-tuning and evaluation jobs as directed by Customer; and, for any Professional Services, accessing, reviewing and using Customer Data through Prime Intellect’s personnel in accordance with the applicable Order. Prime Intellect will also Process Personal Data to provide support, to monitor and secure the Services as described in the Agreement, and to create Usage Information. Prime Intellect will not use Personal Data to train, fine-tune, post-train, distill or evaluate any model except as permitted by the Agreement.

7. PURPOSES OF THE TRANSFER AND FURTHER PROCESSING

Provision of the Services as described in the Agreement and any applicable Orders, including related support, security and compliance with applicable law.

8. DURATION OF PROCESSING

For the term of the Agreement and the retrieval and deletion periods described in Section 11 of this DPA, subject to the backup and legal retention exceptions in that Section.

9. SUB-PROCESSOR TRANSFERS

For the subject matter and nature of the Processing, see the Agreement and this DPA. The Processing will take place for the duration of the Agreement. Sub-processors provide data center, compute infrastructure, hosting, networking, storage and support services, as further described in the list available on request under Section 7.1 of this DPA.

10. COMPETENT SUPERVISORY AUTHORITY

For Data Subjects located in the EEA, the Supervisory Authority determined in accordance with Clause 13 of the SCCs. For Data Subjects located in the United Kingdom, the UK Information Commissioner. For Data Subjects located in Switzerland, the Swiss Federal Data Protection and Information Commissioner.

11. TECHNICAL AND ORGANIZATIONAL MEASURES

Prime Intellect will implement and maintain the following measures with respect to Personal Data in its possession or control. They apply to the layers of the Services for which Prime Intellect is responsible under the shared responsibility model described in the Agreement and are further described at https://trust.primeintellect.ai/:

• Access control: role-based, least-privilege access to production systems and Customer Data, limited to personnel who need it to provide the Services, with multi-factor authentication and prompt revocation on role change or departure.
• Encryption: encryption in transit for data transmitted to and from the Platform over public networks; encryption in transit and at rest for Customer Data held in Prime Intellect’s own systems for any Professional Services; encrypted secret injection for sandboxes; and secure credential management.
• Isolation: hardware-isolated microVM sandboxes with configurable network access controls, and logical separation designed to prevent any customer from accessing another customer’s workloads, models, adapters, requests or Output on shared infrastructure.
• Monitoring: logging and monitoring of production systems, including endpoint detection and response tooling, and vulnerability management.
• Physical security: data centers operated by Prime Intellect’s Sub-processors with physical access controls, surveillance and environmental protections.
• Incident response: documented incident response procedures, including Data Incident notification as described in Section 6.2 of this DPA.
• Personnel: written confidentiality obligations and security training for personnel with access to Customer Data.
• Sub-processor management: security and privacy due diligence of Sub-processors and written data protection terms as described in Section 7 of this DPA.
• Deletion: deletion of Personal Data as described in Section 11 of this DPA.