Data Processing Addendum

In plain English. When you use Pazau, you decide what personal data goes into the platform and why. We process it only to run the Services for you, on your documented instructions. This Addendum sets out the rules. We keep personal data confidential and secure. We tell you about sub-processor changes 30 days in advance and you can object. We notify you of a personal data breach without undue delay and no later than 72 hours after we become aware of it. We help you answer data subject requests and complete DPIAs. We never use your data to train foundation models. International transfers are covered by the EU Standard Contractual Clauses, the UK Addendum, Swiss adjustments and the EU-U.S. Data Privacy Framework. You can host in our US or EU region. After termination you have 30 days to export, and we delete everything within 90 days. This summary is for convenience only. The text below governs.

This Data Processing Addendum (the "DPA") forms part of the Pazau Subscription Agreement or other written agreement between Customer and Pazau governing Customer's use of the Services (the "Agreement"), available at Subscription Agreement. It applies automatically when Customer accepts the Agreement or signs an Order Form that references it, and no separate signature is required. Where Customer requires a countersigned copy, Customer may request one from privacy@pazau.com.

"Pazau" means the Pazau entity identified on the applicable Order Form: Pazau, Inc., a Delaware corporation with its principal place of business at 350 Brannan Street, Suite 400, San Francisco, CA 94107, United States; or, for Customers domiciled in the European Economic Area, the United Kingdom or Switzerland, Pazau Ireland Limited, a company incorporated in Ireland with its registered office at 14 Hanover Quay, Dublin 2, D02 X5C4, Ireland.

1. Definitions and interpretation

1.1 Capitalized terms used but not defined in this DPA have the meanings given in the Agreement. In this DPA:

• "Applicable Data Protection Law" means all laws and regulations relating to privacy, data protection and the security of Personal Data that apply to a party's Processing of Customer Personal Data under the Agreement, including, to the extent applicable, the GDPR, the UK GDPR, the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection of 25 September 2020 ("FADP"), the EU ePrivacy Directive 2002/58/EC and its national implementations, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 and its implementing regulations ("CCPA"), and other U.S. state comprehensive privacy laws, in each case as amended or replaced from time to time.
• "Controller", "Processor", "Data Subject", "Personal Data Breach", "Processing" (and "Process"), and "Supervisory Authority" have the meanings given in the GDPR, and their cognate terms under other Applicable Data Protection Law ("business", "service provider", "consumer", "personal information", and similar) shall be construed accordingly.
• "Customer Personal Data" means Personal Data contained in Customer Data that Pazau Processes on behalf of Customer in the course of providing the Services.
• "Data Privacy Framework" or "DPF" means the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, each as administered by the U.S. Department of Commerce.
• "EEA" means the European Economic Area.
• "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council.
• "Personal Data" means any information relating to an identified or identifiable natural person, and includes "personal information" and equivalent terms as defined under Applicable Data Protection Law.
• "Personal Data Breach" means a Security Incident that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise Processed by Pazau or its Sub-processors.
• "Restricted Transfer" means a transfer of Customer Personal Data from the EEA, the United Kingdom or Switzerland to a country that has not been recognized as providing an adequate level of protection for Personal Data under Applicable Data Protection Law, or an onward transfer from such a country, in each case where a transfer mechanism is required.
• "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission by Implementing Decision (EU) 2021/914 of 4 June 2021.
• "Sub-processor" means any third party (including any Pazau Affiliate) engaged by Pazau to Process Customer Personal Data on Customer's behalf. Model Providers that Process Customer Personal Data are Sub-processors.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0) issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018, in force 21 March 2022.
• "UK GDPR" means the GDPR as retained in the law of the United Kingdom by the European Union (Withdrawal) Act 2018.

1.2 The words "include" and "including" mean "including without limitation". References to a law include that law as amended, replaced or re-enacted.

2. Scope and roles of the parties

2.1 Roles. With respect to Customer Personal Data, Customer is the Controller (or a Processor acting on behalf of its own Controllers, including its Affiliates) and Pazau is a Processor (or, where Customer is a Processor, a Sub-processor). Where Customer acts as a Processor, Customer warrants that its Controller has authorized Customer's instructions to Pazau, including the appointment of Pazau as a Sub-processor, and Customer shall serve as the sole point of contact for Pazau with respect to that Controller.

2.2 Pazau as independent controller. Pazau acts as an independent Controller only in respect of (a) Personal Data relating to Customer's account administration, billing and business relationship (such as the names and contact details of Customer's personnel who manage the account); (b) Service usage and telemetry data that does not contain the content of Customer Data, used to operate, secure and improve the Services; and (c) Processing required to comply with Pazau's legal obligations. That Processing is governed by the Pazau Privacy Policy and not by this DPA, except that Pazau will Process that Personal Data in compliance with Applicable Data Protection Law.

2.3 Details of Processing. The subject matter, duration, nature and purpose of Processing, the types of Customer Personal Data and the categories of Data Subjects are set out in Annex I.

2.4 Customer responsibilities. Customer is responsible for (a) the lawfulness of Customer Personal Data and the means by which Customer acquired it; (b) establishing a lawful basis for Processing, including providing any notices to and obtaining any consents from Data Subjects required under Applicable Data Protection Law, including any notice to End Users that they are interacting with an AI system as described in the AI Addendum; (c) the accuracy and quality of Customer Personal Data; and (d) its configuration of the Services, including Procedures, Actions, retention settings, data residency region, and Pazau Guard redaction policies. Customer shall not submit special categories of Personal Data except as permitted by Section 2.5.

2.5 Special categories and regulated data. Customer may submit (a) health information, including Protected Health Information, only where Customer has entered into a Business Associate Agreement with Pazau and uses a HIPAA-enabled workspace configured as described in the BAA and Documentation; and (b) payment card data only through Pazau Voice's PCI DSS-scoped secure payment flow, which tokenizes cardholder data before it reaches the Pazau platform. Customer shall not otherwise submit special categories of Personal Data, Personal Data relating to criminal convictions and offences, government identification numbers, or financial account credentials unless expressly agreed in an Order Form, and shall configure Pazau Guard redaction policies to minimize incidental collection of such data in conversations.

3. Processing instructions

3.1 Documented instructions. Pazau shall Process Customer Personal Data only on Customer's documented instructions, including with regard to Restricted Transfers, unless required to do so by Union or Member State law or other law to which Pazau is subject, in which case Pazau shall inform Customer of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.

3.2 Scope of instructions. Customer instructs Pazau to Process Customer Personal Data (a) to provide, maintain, secure and support the Services in accordance with the Agreement, the Documentation and any Order Form; (b) as initiated by Authorized Users through their use of the Services, including through Procedures and Actions configured by Customer; (c) to execute Actions against Customer's systems and third-party systems as configured and authorized by Customer; (d) to generate, store and make available Traces; (e) to prevent, detect and remediate fraud, abuse, security threats and technical issues; and (f) as otherwise agreed in writing by the parties. The Agreement, this DPA and Customer's configuration of the Services constitute Customer's complete instructions. Additional or alternative instructions require prior written agreement, including agreement on any additional fees.

3.3 Unlawful instructions. Pazau shall immediately inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. Pazau is not obliged to perform a comprehensive legal examination of Customer's instructions, and may suspend performance of the relevant instruction until Customer confirms or modifies it.

3.4 No model training. Pazau shall not use Customer Personal Data or any other Customer Data to train, retrain or fine-tune any foundation model or general-purpose model, whether operated by Pazau or by a Model Provider. Pazau shall require Model Providers to Process Customer Data on a zero-data-retention basis, as further described in the AI Addendum. Any optional per-customer model improvement is available only if Customer affirmatively opts in, is isolated to Customer's tenant, and is subject to the AI Addendum.

3.5 No sale or sharing. Pazau shall not sell, rent or share (as those terms are defined under the CCPA) Customer Personal Data, and shall not combine Customer Personal Data with Personal Data that Pazau receives from or on behalf of another person, except as permitted for a service provider under the CCPA.

4. Pazau personnel

4.1 Confidentiality. Pazau shall ensure that all personnel authorized to Process Customer Personal Data are bound by written obligations of confidentiality or are under an appropriate statutory obligation of confidentiality, and that such obligations survive the end of their engagement.

4.2 Access on a need-to-know basis. Pazau shall limit access to Customer Personal Data to personnel who require access to perform the Services, to support Customer, or to maintain the security and integrity of the Services. Production access is granted just-in-time, requires approval, is time-bound and is logged, as described in Annex II.

4.3 Screening and training. Pazau shall conduct background checks on personnel with access to Customer Personal Data to the extent permitted by applicable law, and shall provide security and privacy training at onboarding and at least annually thereafter.

4.4 Data Protection Officer. Pazau has appointed a Data Protection Officer, Aoife Brennan, based in Dublin, Ireland, who can be contacted at privacy@pazau.com. Pazau Ireland Limited acts as Pazau, Inc.'s representative in the European Union under Article 27 GDPR, and Pazau's London office acts as its representative in the United Kingdom under Article 27 UK GDPR.

5. Security

5.1 Security measures. Pazau shall implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against Personal Data Breaches and to preserve its confidentiality, integrity and availability, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. Those measures include the measures described in Annex II and the Security Addendum.

5.2 Updates. Pazau regularly monitors and updates its security measures. Pazau may modify them from time to time, provided that no modification will materially decrease the overall level of protection of Customer Personal Data.

5.3 Customer security responsibilities. Customer is responsible for its use of the Services, including securing its account credentials, configuring SSO and role-based access controls, managing Authorized Users, securing the credentials Customer supplies for Actions and integrations, and protecting Customer Personal Data outside the Services. Customer agrees that the security measures in Annex II, together with the features and controls made available through the Services, provide a level of security appropriate to the risk of Customer's Processing.

6. Sub-processors

6.1 General authorization. Customer grants Pazau general written authorization to engage Sub-processors, including Pazau's Affiliates and the Sub-processors listed at Sub-processors as of the effective date of the Agreement (the "Sub-processor List").

6.2 Sub-processor obligations. Pazau shall (a) carry out appropriate due diligence on each Sub-processor's security, privacy and confidentiality practices before engagement and periodically thereafter; (b) enter into a written agreement with each Sub-processor that imposes data protection obligations no less protective of Customer Personal Data than those in this DPA, to the extent applicable to the nature of the services provided by that Sub-processor; and (c) remain liable to Customer for the performance of each Sub-processor's obligations to the same extent Pazau would be liable if performing those services itself, subject to the limitations of the Agreement.

6.3 Notice of new Sub-processors. Pazau shall notify Customer of any intended addition or replacement of a Sub-processor at least 30 days before that Sub-processor begins Processing Customer Personal Data. Pazau shall provide notice by updating the Sub-processor List and sending an email to Customers who have subscribed to updates through the Sub-processor page or have designated a privacy contact in the Services. Customer is responsible for subscribing and keeping its contact details current.

6.4 Right to object. Customer may object to a new Sub-processor on reasonable grounds relating to data protection by notifying Pazau in writing at privacy@pazau.com within the 30-day notice period. If Customer objects, the parties shall discuss Customer's concerns in good faith with a view to achieving a commercially reasonable resolution, which may include Pazau offering to provide the affected Services without use of the new Sub-processor or recommending a change to Customer's configuration.

6.5 Termination remedy. If the parties cannot resolve Customer's objection within 30 days after Pazau's receipt of it, Customer may, as its sole and exclusive remedy, terminate the Order Form(s) for the Services that cannot be provided without the objected-to Sub-processor by written notice to Pazau. Pazau shall refund to Customer any prepaid fees covering the remainder of the Subscription Term for the terminated Services following the effective date of termination, and shall not impose any termination penalty.

6.6 Emergency replacement. Where Pazau must replace a Sub-processor urgently to maintain the security, availability or integrity of the Services, or because a Sub-processor has ceased to operate, Pazau may do so on shorter notice, provided that Pazau notifies Customer as soon as reasonably practicable and Customer's rights under Sections 6.4 and 6.5 apply from the date of that notice.

6.7 Copies of Sub-processor agreements. Where required for Customer to comply with Clause 9(c) of the SCCs, Pazau shall provide copies of relevant Sub-processor agreements on request, from which commercial terms and information unrelated to data protection may be removed.

7. Personal Data Breach notification

7.1 Notice. Pazau shall notify Customer of a Personal Data Breach without undue delay, and in any event no later than 72 hours after becoming aware of it. Notice shall be delivered to the security and privacy contacts designated by Customer in the Services, and to Customer's account owner by email.

7.2 Content of notice. To the extent the information is available at the time, Pazau's notice shall describe (a) the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects and records concerned; (b) the name and contact details of Pazau's point of contact; (c) the likely consequences of the Personal Data Breach; and (d) the measures taken or proposed to be taken by Pazau to address it and to mitigate its possible adverse effects. Where the information cannot be provided at the same time, Pazau may provide it in phases without undue further delay.

7.3 Response and cooperation. Pazau shall promptly take reasonable steps to contain, investigate and remediate the Personal Data Breach, shall provide Customer with regular updates, and shall provide reasonable assistance to enable Customer to meet its own obligations to notify Supervisory Authorities and affected Data Subjects. Within 30 days after closing its investigation, Pazau shall provide Customer with a written summary of the root cause and remediation measures.

7.4 Communications. Except as required by law, Pazau shall not notify Supervisory Authorities, Data Subjects or the public of a Personal Data Breach that affects only Customer Personal Data without first consulting Customer. Customer controls the content of any notification to its End Users.

7.5 No acknowledgment of fault. Pazau's notification of or response to a Personal Data Breach is not an acknowledgment by Pazau of any fault or liability.

7.6 Unsuccessful attempts. A Personal Data Breach does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including unsuccessful log-in attempts, pings, port scans, denial-of-service attacks and other network attacks on firewalls or networked systems.

8. Assistance to Customer

8.1 Data Subject requests. Taking into account the nature of the Processing, Pazau shall assist Customer by appropriate technical and organizational measures, insofar as this is possible, to fulfil Customer's obligation to respond to requests from Data Subjects to exercise their rights under Applicable Data Protection Law. Pazau makes self-service tools available in the Services and through the API to search for, export, correct and delete Customer Personal Data associated with an End User or contact, including in conversations and Traces. Where Customer cannot fulfil a request using those tools, Pazau shall provide reasonable additional assistance on request.

8.2 Requests received by Pazau. If Pazau receives a request from a Data Subject relating to Customer Personal Data, Pazau shall, to the extent legally permitted and where the Data Subject identifies Customer, promptly redirect the Data Subject to Customer and notify Customer within five business days. Pazau shall not respond to the request itself except on Customer's instructions or as required by law.

8.3 DPIAs and prior consultation. Pazau shall provide reasonable assistance to Customer, taking into account the nature of the Processing and the information available to Pazau, with any data protection impact assessment and prior consultation with a Supervisory Authority that Customer is required to carry out under Applicable Data Protection Law in connection with the Services. Pazau makes available through its Trust Center at /security a standard DPIA support pack, AI system documentation prepared under its ISO 42001 management system, and completed industry-standard security questionnaires. Additional assistance beyond these materials may be subject to reasonable fees where it requires material effort.

8.4 Records. Pazau shall maintain records of its Processing activities as a Processor as required by Article 30(2) GDPR and shall make them available to a Supervisory Authority on request.

9. Audits

9.1 Audit reports. Pazau engages independent third-party auditors to assess its controls at least annually. On written request, and no more than once in any 12-month period, Pazau shall make available to Customer, subject to the confidentiality obligations of the Agreement, (a) its most recent SOC 2 Type II report; (b) its ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001 certificates and statements of applicability; (c) its PCI DSS attestation of compliance for Pazau Voice payment flows; (d) an executive summary of its most recent third-party penetration test; and (e) reasonable written responses to Customer's security and privacy questionnaire (collectively, "Audit Reports"). The parties agree that the Audit Reports shall be used to satisfy Customer's audit and inspection rights under this DPA and Applicable Data Protection Law, including Clause 8.9 of the SCCs, except as provided in Sections 9.2 and 9.3.

9.2 On-site audits after a Personal Data Breach. Following a Personal Data Breach affecting Customer Personal Data, or where Audit Reports are insufficient to demonstrate compliance because of a specific, documented deficiency, Customer may conduct an on-site audit of the facilities and systems used to Process Customer Personal Data, subject to the following conditions: (a) Customer shall give at least 30 days' prior written notice and propose a reasonable scope, plan and timing; (b) the audit shall be conducted during normal business hours, no more than once in any 12-month period, in a manner that does not unreasonably disrupt Pazau's operations or compromise the security of other customers' data; (c) the audit shall be performed by Customer or an independent auditor reasonably acceptable to Pazau that is bound by written confidentiality obligations and is not a competitor of Pazau; (d) facilities operated by AWS and other hyperscale Sub-processors are audited through their own third-party reports, not on-site; and (e) Customer shall bear all costs of the audit, including Pazau's reasonable costs of personnel time beyond one business day.

9.3 Regulator audits. Nothing in this DPA restricts the right of a Supervisory Authority or other regulator with jurisdiction over Customer to audit or inspect Pazau's Processing of Customer Personal Data. Pazau shall cooperate with such an audit on reasonable notice, and Sections 9.1 and 9.2 do not limit it, except that Pazau may require reasonable confidentiality protections consistent with the regulator's procedures.

9.4 Findings. Customer shall promptly provide Pazau with a copy of any audit report produced under Section 9.2, which shall be Pazau's Confidential Information. Pazau shall address any material non-compliance identified by the audit within a reasonable, mutually agreed period.

10. International data transfers

10.1 Hosting and data residency. Pazau hosts the Services on Amazon Web Services. Customer may select one of the following hosting regions for its workspace, as described in the Order Form and Documentation:

10.2 EU region commitments. Where Customer selects the EU region, Pazau shall store Customer Data at rest, including conversations, attachments, Traces, call recordings and backups, only in the EU region. Pazau shall route model inference for EU-region workspaces to Model Providers' EU endpoints where available, as identified on the Sub-processor List. Limited remote access to EU-region Customer Data by Pazau personnel and Sub-processors located outside the EEA (for example, to provide follow-the-sun support or to respond to an incident) is a Restricted Transfer and is governed by this Section 10.

10.3 Transfer mechanisms. Pazau shall not make a Restricted Transfer unless it is made in compliance with Applicable Data Protection Law. The parties agree that the following mechanisms apply, in the following order of precedence to the extent applicable: (a) an adequacy decision covering the recipient, including the Data Privacy Framework; and (b) the SCCs, the UK Addendum and the Swiss adjustments, each as set out in this Section 10.

10.4 Data Privacy Framework. Pazau, Inc. self-certifies to the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. Data Privacy Framework. Pazau shall maintain its certification for the term of the Agreement or promptly notify Customer if it ceases to be certified, in which case the SCCs shall apply automatically as the transfer mechanism.

10.5 EU Standard Contractual Clauses. To the extent a Restricted Transfer of Customer Personal Data subject to the GDPR is not covered by an adequacy decision, the SCCs are incorporated into this DPA by reference and completed as follows:

• (a) Module Two (controller to processor) applies where Customer is a Controller, and Module Three (processor to processor) applies where Customer is a Processor. Module One and Module Four do not apply to Processing under this DPA.
• (b) Clause 7 (docking clause): the optional docking clause applies.
• (c) Clause 9(a): Option 2 (general written authorization) applies, and the time period for prior notice of Sub-processor changes is 30 days, as set out in Section 6.
• (d) Clause 11(a): the optional language permitting Data Subjects to lodge complaints with an independent dispute resolution body does not apply.
• (e) Clause 13: where Customer is established in an EU Member State, the supervisory authority of that Member State; where Customer is not established in the EU but has appointed a representative under Article 27(1) GDPR, the supervisory authority of the Member State in which the representative is established; otherwise, the Data Protection Commission of Ireland.
• (f) Clause 17: Option 1 applies, and the SCCs are governed by the laws of Ireland.
• (g) Clause 18(b): disputes shall be resolved before the courts of Ireland.
• (h) Annex I of the SCCs is completed with the information in Annex I of this DPA; Annex II of the SCCs is completed with Annex II of this DPA; and Annex III of the SCCs is completed with Annex III of this DPA.
• (i) The audit described in Clause 8.9 shall be carried out in accordance with Section 9 of this DPA; the certification of deletion described in Clauses 8.5 and 16(d) shall be provided on Customer's written request; and Customer's authorization of Sub-processors under Clause 9 is given in accordance with Section 6.

10.6 UK transfers. To the extent a Restricted Transfer of Customer Personal Data is subject to the UK GDPR, the SCCs apply as amended by the UK Addendum, which is incorporated by reference. Tables 1 to 3 of the UK Addendum are completed with the information in Section 10.5 and the Annexes of this DPA, and in Table 4 either party may end the UK Addendum as set out in Section 19 of the UK Addendum. The mandatory clauses of the UK Addendum prevail over any conflicting term of this DPA.

10.7 Swiss transfers. To the extent a Restricted Transfer of Customer Personal Data is subject to the FADP, the SCCs apply with the following adjustments: (a) references to the GDPR shall be read as references to the FADP to the extent the transfer is subject to the FADP; (b) the competent supervisory authority under Clause 13 is the Swiss Federal Data Protection and Information Commissioner ("FDPIC"); (c) the term "Member State" shall not be interpreted to exclude Data Subjects in Switzerland from exercising their rights in their place of habitual residence under Clause 18(c); and (d) the governing law and forum remain Irish law and the courts of Ireland, save that Data Subjects in Switzerland may bring claims before the Swiss courts.

10.8 Transfer impact assessment. Pazau has conducted, and on request shall make available, a transfer impact assessment addressing the laws and practices of the destination countries relevant to Pazau's Processing. Pazau shall (a) review and, where appropriate, challenge any request by a public authority for access to Customer Personal Data; (b) notify Customer of any such request unless legally prohibited; (c) disclose only the minimum Customer Personal Data required; and (d) publish an annual transparency report on government data requests on its Trust Center. As of the date of this DPA, Pazau has received no requests from public authorities for Customer Personal Data.

10.9 Conflict. If there is any conflict between this DPA and the SCCs (including as amended by the UK Addendum or the Swiss adjustments), the SCCs prevail.

11. Return and deletion of Customer Personal Data

11.1 During the Subscription Term. Customer may export Customer Data, including conversations, contacts, Procedures, and Traces, at any time during the Subscription Term using the export tools and APIs described in the Documentation, and may delete Customer Data subject to its configured retention settings.

11.2 After termination. For 30 days following expiration or termination of the Agreement, Pazau shall, on request, make Customer Data available for export in a structured, commonly used, machine-readable format (JSON and CSV, with call recordings in their native audio format). Following that period, Pazau shall delete Customer Personal Data from its production systems, and in any event shall complete deletion of Customer Personal Data, including from backups, within 90 days after expiration or termination, unless retention is required by Union, Member State or other applicable law. Backups are encrypted, access-restricted, and roll off automatically within that 90-day window.

11.3 Retained data. Where applicable law requires Pazau to retain any Customer Personal Data, Pazau shall continue to protect it in accordance with this DPA, isolate it from further Processing except as required by that law, and delete it once the retention requirement ends.

11.4 Certification. On Customer's written request, Pazau shall certify in writing that it has deleted Customer Personal Data in accordance with this Section 11.

12. U.S. state privacy law terms

12.1 Service provider. To the extent Customer Personal Data is subject to the CCPA or another U.S. state comprehensive privacy law, Pazau is a "service provider" or "processor" (as applicable) and Customer is a "business" or "controller". Customer discloses Customer Personal Data to Pazau only for the limited and specified business purposes of providing the Services as described in the Agreement and Annex I.

12.2 Restrictions. Pazau shall not (a) sell or share Customer Personal Data; (b) retain, use or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the business purposes specified in the Agreement or as otherwise permitted by the CCPA; (c) retain, use or disclose Customer Personal Data outside the direct business relationship between Customer and Pazau; or (d) combine Customer Personal Data with Personal Data that Pazau receives from or on behalf of any other person or collects from its own interactions with consumers, except as permitted by the CCPA and its regulations.

12.3 Compliance and notice. Pazau shall comply with applicable obligations under the CCPA and shall provide the same level of privacy protection as is required of businesses by the CCPA. Pazau shall notify Customer if it determines that it can no longer meet its obligations under the CCPA. Customer may, on notice, take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data, including through the audit mechanisms in Section 9.

12.4 Consumer requests and deidentified data. Pazau shall assist Customer in responding to verifiable consumer requests in accordance with Section 8. Where Pazau receives deidentified data from Customer, Pazau shall not attempt to reidentify it and shall maintain it in deidentified form.

12.5 Certification. Pazau certifies that it understands and will comply with the restrictions in this Section 12.

13. Liability and general terms

13.1 Liability. Each party's liability arising out of or relating to this DPA, including under the SCCs to the extent permitted by law, is subject to the exclusions and limitations of liability in Section 15 of the Agreement, including the Data Protection Cap in Section 15.3. Nothing in this Section 13.1 limits either party's liability to Data Subjects under the third-party beneficiary provisions of the SCCs, or any liability that cannot be limited under applicable law.

13.2 Order of precedence. In the event of any conflict between this DPA and the Agreement, this DPA prevails with respect to the Processing of Customer Personal Data. In the event of any conflict between this DPA and the Business Associate Agreement with respect to Protected Health Information, the Business Associate Agreement prevails. The SCCs prevail as set out in Section 10.9.

13.3 Affiliates. Customer enters into this DPA on its own behalf and, to the extent required under Applicable Data Protection Law, in the name and on behalf of its Affiliates that are permitted to use the Services under the Agreement. Customer shall exercise any rights under this DPA on behalf of its Affiliates and remain responsible for their compliance.

13.4 Changes in law. If a change in Applicable Data Protection Law, or a decision of a competent court or Supervisory Authority, requires an amendment to this DPA or invalidates a transfer mechanism relied on in Section 10, the parties shall negotiate in good faith to amend this DPA or to implement an alternative transfer mechanism. Pazau may update this DPA to reflect such changes, provided the update does not materially decrease the protection of Customer Personal Data.

13.5 Term. This DPA remains in effect for as long as Pazau Processes Customer Personal Data, and the obligations in Sections 7, 11 and 13 survive termination of the Agreement until Customer Personal Data is deleted.

13.6 Governing law. Except as required by the SCCs or Applicable Data Protection Law, this DPA is governed by the law and subject to the jurisdiction specified in Section 18 of the Agreement.

Annex I: Details of processing

A. List of parties

B. Description of processing

C. Competent supervisory authority

As determined under Clause 13 of the SCCs in accordance with Section 10.5(e) of this DPA. For transfers subject to the UK GDPR, the UK Information Commissioner's Office. For transfers subject to the FADP, the FDPIC.

Annex II: Technical and organizational measures

Pazau maintains an information security program certified to ISO/IEC 27001, a privacy information management system certified to ISO/IEC 27701, and an AI management system certified to ISO/IEC 42001. Its controls are independently audited annually under SOC 2 Type II (Security, Availability, Confidentiality and Privacy trust services criteria). Pazau Voice payment flows are assessed under PCI DSS (SAQ-D), and Pazau supports HIPAA compliance for Customers with a BAA. The measures below are further detailed in the Security Addendum.

Annex III: Sub-processors

Customer authorizes the Sub-processors listed on Pazau's Sub-processors page, which identifies for each Sub-processor its name, the services it provides, the location of Processing, the hosting regions it serves (US, EU or both), and whether it is a Model Provider. The Sub-processor page, as updated in accordance with Section 6, is incorporated into this DPA by reference and constitutes Annex III of the SCCs.