Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement, order form, technology license, services agreement or other written agreement (the “Agreement”) between Impact Fund LLC, a Wyoming limited liability company, doing business as Tech-Enabled Capital (“TEC”), and the customer identified in the Agreement (“Customer”).

This DPA applies only to the extent TEC Processes Customer Personal Data on behalf of Customer in connection with the Services.

2.1 Roles. Where Customer determines the purposes and means of Processing Customer Personal Data, Customer is the Controller and TEC is the Processor. Where Customer acts as a Processor for another Controller, TEC acts as Customer’s Subprocessor. Terms such as “business,” “service provider” and “contractor” will be interpreted consistently with applicable U.S. state privacy law where required.

2.2 Customer instructions. The Agreement, this DPA, applicable order forms, Customer’s authorized configuration of the Services, and documented instructions consistent with the Agreement constitute Customer’s instructions to TEC. TEC will Process Customer Personal Data only:

• to provide, secure, support, maintain and operate the Services for Customer;
• in accordance with Customer’s documented instructions;
• as necessary to prevent or address fraud, abuse, security incidents or technical failures;
• as required by applicable law.

If TEC reasonably believes an instruction violates Applicable Data Protection Law, TEC may suspend affected Processing and notify Customer.

2.3 Customer responsibility. Customer is responsible for:

• having all rights, notices, consents, authorizations and legal bases necessary for TEC to Process Customer Personal Data;
• determining whether the Services are appropriate for Customer’s intended use;
• configuring Customer systems and permissions appropriately;
• responding to Data Subjects except to the extent TEC is required to assist;
• ensuring Customer instructions comply with law.

Customer will not knowingly provide Restricted Data unless the Agreement expressly authorizes that category and the parties have agreed required controls. Restricted Data may include payment-card data subject to PCI DSS, protected health information subject to HIPAA, biometric identifiers used for identification, precise geolocation, government-issued identity numbers, children’s data, or other specially regulated data designated in an Order Form.

TEC is under no obligation to authorize any category of Restricted Data. Nothing in this DPA is an undertaking to enter into a business associate agreement, to make the Services suitable for a special-regime data category, or to represent that they are.

TEC will not, except as permitted by Applicable Data Protection Law and the Agreement:

• sell Customer Personal Data;
• share Customer Personal Data for cross-context behavioral advertising;
• retain, use or disclose Customer Personal Data outside the direct business relationship for an independent commercial purpose;
• combine identifiable Customer Personal Data with identifiable personal data from another customer for purposes unrelated to providing the Services;
• use identifiable Customer Personal Data to train a generalized model for the independent benefit of TEC or a third-party model provider unless Customer expressly authorizes that use in writing.

TEC may use De-Identified Data and generalized learnings that do not identify Customer or any individual, to the extent permitted by the Agreement and Applicable Data Protection Law.

TEC will ensure personnel authorized to Process Customer Personal Data are subject to confidentiality obligations.

Access will be limited to personnel and contractors who require access for an authorized business purpose.

Customer Data is Customer Confidential Information under the Agreement.

TEC will maintain reasonable and appropriate technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, alteration or disclosure, taking into account the nature of Processing, available technology, cost of implementation and risk.

The baseline security measures are summarized in Schedule 2.

TEC may update security measures during the Agreement provided the overall level of protection is not materially reduced.

Nothing in this DPA represents that TEC holds a certification, audit report or regulatory designation unless TEC expressly confirms it in writing.

6.1 General authorization. Customer grants TEC general written authorization to engage Subprocessors necessary to provide the Services. Before Processing begins under an Order Form, and at any time on Customer’s request thereafter, TEC will identify in writing the material Subprocessors that Process that Customer’s Personal Data in the relevant production Service, together with each provider’s purpose, processing locations and the scope of data it handles. Those providers may include cloud infrastructure, AI and model inference, storage, security, monitoring, communications and related providers, and they differ between customers, workloads, deployments and configurations.

6.2 Contractual flow-down. TEC will impose written data-protection obligations on each Subprocessor materially consistent with TEC’s obligations under this DPA to the extent applicable to the services performed. TEC remains responsible for its Subprocessors’ performance of those obligations to the extent required by Applicable Data Protection Law and subject to liability limitations in the Agreement.

6.3 New Subprocessors. TEC will provide reasonable prior notice of a new material Subprocessor that will Process Customer Personal Data. Unless another period is stated in the Agreement, Customer may object within 15 days of notice based on reasonable, documented data-protection or security grounds. The parties will work in good faith to address the objection.

If TEC cannot reasonably provide the affected Services without the Subprocessor, TEC may discontinue the affected feature or terminate the affected portion of the Services, and Customer’s exclusive remedy will be a pro rata refund of prepaid fees for the terminated, unused portion, unless the Agreement provides another remedy.

TEC may route workloads among different model providers, private or local models, deterministic software, or other execution systems according to the Services and Customer configuration.

Where a third-party AI or model provider Processes Customer Personal Data as a Subprocessor:

• TEC will use business, API or other contractually appropriate services where available;
• TEC will not intentionally authorize the provider to use identifiable Customer Personal Data to train generalized provider models for the provider’s independent benefit unless Customer expressly agrees;
• the provider will be subject to the Subprocessor provisions of this DPA.

Customer acknowledges that provider selection can change over time and that different workloads can use different providers.

If TEC receives a request from a Data Subject concerning Customer Personal Data, TEC may direct the Data Subject to Customer unless law requires TEC to respond.

Taking into account the nature of Processing, TEC will provide reasonable assistance to Customer in responding to verified Data Subject requests where Customer cannot reasonably fulfill the request through the Services.

TEC may charge reasonable costs for unusually burdensome assistance or assistance outside standard product functionality except where Applicable Data Protection Law prohibits such charge.

Taking into account the nature of Processing and information available to TEC, TEC will provide reasonable assistance with data protection impact assessments, prior consultations and regulator inquiries where required by Applicable Data Protection Law and directly related to TEC’s Processing.

Customer remains responsible for its own compliance assessment and legal obligations.

TEC will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data. TEC will not wait until an investigation is complete before giving notice. The notice will, to the extent reasonably available at the time it is given, describe:

• the nature of the Security Incident;
• categories of Customer Personal Data or Data Subjects affected;
• likely consequences;
• mitigation or remediation measures taken or proposed.

Where it is not possible to provide all of that information at the same time, TEC will provide what is available and supply the remainder in phases without undue further delay. Notification does not constitute an admission of fault or liability.

Customer is responsible for determining whether Customer must notify regulators, Data Subjects or other parties, except where law directly requires TEC to do so.

During the term, Customer may use available functionality to retrieve Customer Data where the Services provide export functionality.

Customer chooses. After the end of the provision of the Services, TEC will return Customer Personal Data to Customer or delete it, at Customer’s choice, and will delete existing copies except where retention is required by applicable law. Where Customer chooses return, TEC will make an export of Customer Data then available in a standard format; Customer should tell TEC its choice within 30 days of termination or expiration so that the export can be produced before deletion runs.

Absent a choice, TEC will delete Customer Personal Data from active systems within 60 days after termination or expiration. Retention beyond that is limited to what applicable law requires, together with what is reasonably necessary to resolve a then-pending dispute, enforce the Agreement, or defend a legal claim, and to copies present in backups under ordinary backup cycles.

Backup copies may persist until overwritten under normal retention cycles, provided they remain protected and are not restored except for legitimate recovery.

Upon reasonable written request, TEC will provide information reasonably necessary to demonstrate compliance with this DPA.

Where TEC has relevant third-party audit reports, certifications, penetration-test summaries or standardized security materials, TEC may satisfy an audit request by providing those materials subject to confidentiality restrictions.

If those materials are insufficient and Applicable Data Protection Law requires an additional audit:

• Customer may conduct one audit in any 12-month period, unless a regulator or confirmed Security Incident requires more;
• Customer must provide at least 30 days’ notice where practicable;
• the audit must occur during normal business hours;
• the auditor must be independent and bound by confidentiality;
• the audit must not access other customers’ data, proprietary source code, penetration tooling, or information that would materially compromise TEC’s security;
• Customer bears its own audit costs and TEC’s reasonable costs unless law requires otherwise or the audit reveals material noncompliance by TEC.

No customer may conduct intrusive penetration testing or vulnerability scanning without TEC’s express written authorization.

Where Customer Personal Data subject to GDPR is transferred to a country without an applicable adequacy mechanism, the parties incorporate the European Commission’s 2021 Standard Contractual Clauses (“EU SCCs”) as required.

• Module 2 applies where Customer is a Controller and TEC is a Processor.
• Module 3 applies where Customer is a Processor and TEC is a Subprocessor.
• General written authorization for Subprocessors applies.

The EU SCCs take effect through a completed Appendix. The Parties will complete and execute it for the applicable module: Annex I.A identifying the parties, Annex I.B describing the transfer, its categories, purposes, frequency, duration and retention, Annex I.C identifying the competent supervisory authority, Annex II setting out the technical and organizational measures, and Annex III listing authorized subprocessors where the module requires it. The Schedules to this DPA are the starting point for that Appendix; this DPA does not by itself complete the annexes, and the completed Appendix agreed with Customer governs.

For UK restricted transfers, the applicable UK International Data Transfer Addendum will supplement the EU SCCs. For Swiss transfers, the EU SCCs will be interpreted and adapted as required by Swiss law. For UAE or other cross-border transfers, TEC and Customer will use a legally recognized transfer mechanism where required.

If a required transfer mechanism is replaced or invalidated, the parties will cooperate in good faith to implement a valid replacement.

To the extent Customer Personal Data is subject to a U.S. state privacy law imposing contractual requirements on service providers, contractors or processors:

• TEC acts only for the limited and specified business purposes stated in the Agreement and this DPA;
• TEC will not sell or share Customer Personal Data except as permitted by law;
• TEC will not retain, use or disclose Customer Personal Data outside the direct business relationship except as permitted by law;
• TEC will provide reasonable compliance assistance as required by applicable law;
• Customer may take reasonable and appropriate steps to help ensure TEC uses Customer Personal Data consistently with Customer’s obligations under applicable law.

The parties intend this DPA to satisfy applicable processor and service-provider contractual requirements.

Where TEC receives or creates De-Identified Data regulated by Applicable Data Protection Law, TEC will maintain required de-identification measures and will not attempt to re-identify the data except to test de-identification where legally permitted or otherwise authorized by law.

Nothing in this DPA transfers ownership of Customer’s underlying source data to TEC.

The liability exclusions and caps in the Agreement apply to this DPA to the maximum extent permitted by law. This DPA does not create a separate or additional liability cap.

If this DPA conflicts with the Agreement on a data-protection matter, this DPA controls to the extent of the conflict.

If applicable EU SCCs or another mandatory transfer mechanism conflicts with this DPA, the mandatory transfer mechanism controls to the extent required by law.

Subprocessor objections under clause 6, audit requests under clause 12, transfer-mechanism questions under clause 13 and any other notice required by this DPA should be sent to legal@techenabledcapital.com, with a copy to the contact identified in the Agreement. Privacy rights requests are handled through privacy@techenabledcapital.com as described in the Privacy Policy.

This DPA remains in effect for as long as TEC Processes Customer Personal Data on behalf of Customer.

TEC will maintain controls appropriate to the risk of the applicable Processing, which may include, as applicable to the deployed Services:

Governance and access. Defined security responsibilities; confidentiality obligations; access limited according to job function and business need; authentication and credential controls; timely removal of unnecessary access.

Data protection. Reasonable protection of Customer Data in transit and at rest where technically appropriate; logical separation between customer environments or data; restrictions on production access; secrets and credential management appropriate to the environment.

Development and change management. Controlled deployment practices; code and version management; testing appropriate to the change; rollback or recovery procedures for material production changes.

Monitoring and incident response. Operational logging appropriate to the Services; monitoring for material failures and security events; an incident-response process; escalation and remediation procedures.

Availability and recovery. Backup or recovery mechanisms appropriate to authoritative data and production state; recovery procedures appropriate to the Services; controlled retries and failure handling where relevant.

Vendor management. Reasonable diligence of material Subprocessors; contractual confidentiality and data-protection obligations; review of vendor security posture appropriate to the access granted.

TEC will identify its material Subprocessors for a Customer in writing under clause 6.1 — before Processing begins under an Order Form, and on request thereafter — giving for each provider its purpose, its processing locations and the scope of data it handles. That identification is made per engagement rather than published here, because the providers differ by customer, workload, deployment and geography.

A provider is identified only where it actually Processes Customer Personal Data in the relevant production service. A vendor being technologically available to TEC does not make it a Subprocessor.