Data Processing Addendum

1Scope and Precedence

1.1 Parties and Scope. This Data Processing Addendum (“DPA”) is between Fractal, Inc. (“Fractal”) and the customer legal entity identified in the applicable Order (“Customer”). It forms part of the Agreement and governs Fractal’s processing of Personal Data contained in Customer Data when Fractal provides the Services, including implementation, integrations, Nexus Edge onboarding, support, and activated applications. It applies from Fractal’s first authorized access to Customer Data, including access before production launch.

1.2 Precedence. If this DPA conflicts with the Terms or an Order regarding the processing of Personal Data, this DPA controls. This DPA does not change the fees, subscription dates, or other commercial terms of any Order, and all liability arising out of or relating to this DPA is subject to Section 17 (Limitation of Liability) of the Terms.

2Definitions

Capitalized terms used but not defined in this DPA have the meanings given in the Nexus Website and Platform Terms of Service (the “Terms”).

“Applicable Privacy Law” means any privacy or data protection law that applies to a party’s processing of Personal Data under the Agreement, including, where applicable, the California Consumer Privacy Act, as amended (the “CCPA”), and other U.S. state privacy laws.

“Personal Data” means information within Customer Data that identifies, relates to, describes, or is reasonably capable of being associated with an identified or identifiable individual and that is protected as “personal data,”

“personal information,” or a similar term under Applicable Privacy Law.

“Processing” means any operation performed on Personal Data, such as collection, recording, organization, storage, use, disclosure, transmission, or deletion, and “process” has a corresponding meaning.

“Security Incident” means a confirmed breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data while it is in the control of Fractal or its Subprocessors. Unsuccessful attempts and activities that do not compromise the security of Personal Data, such as pings, port scans, and blocked log-in attempts, are not Security Incidents.

“Subprocessor” means a third party that Fractal engages to process Personal Data on Customer’s behalf.

The terms “controller,” “processor,” “business,” “service provider,” “sell,” and “share” have the meanings given in Applicable Privacy Law.

3Roles and Instructions

3.1 Roles. Customer is the controller (or “business,” under the CCPA) of the Personal Data, and Fractal is a processor (or “service provider”) that processes it on Customer’s behalf. If Customer itself processes Personal Data on behalf of another organization, Customer warrants that it is authorized to engage Fractal as its subprocessor, and Customer is responsible for relaying all instructions and notices between Fractal and that organization. Customer retains ownership of Customer Data.

3.2 Instructions. Fractal will process Personal Data only on Customer’s documented instructions. Customer’s instructions consist of the Agreement, the approved scope and Implementation Records, the permissions that Customer configures, authorized support requests, and actions approved through the Services. Additional instructions require Fractal’s written agreement and may be subject to additional fees. Customer discloses Personal Data to Fractal only for the limited and specified Permitted Purposes described in Section 4.1. Customer is responsible for ensuring that its instructions comply with Applicable Privacy Law.

3.3 Unlawful Instructions and Legal Requirements. Fractal will notify Customer if it believes that an instruction violates Applicable Privacy Law and may suspend the affected processing until Customer withdraws or modifies the instruction. If law requires Fractal to process Personal Data other than on Customer’s instructions, Fractal will inform Customer before the processing unless the law prohibits it.

3.4 Responsibility for Instructions. Fractal is not liable for any claim to the extent it arises from Fractal’s compliance with Customer’s instructions, and any such claim is subject to Customer’s indemnification obligations under the Terms.

4Permitted Purposes and Restrictions

4.1 Permitted Purposes. Fractal may process Personal Data to: read and map authorized source records; configure connectors; transmit and synchronize records; host and organize Customer Data; generate requested reports and AI output; execute approved workflows; provide support and resolve defects; maintain backups; detect, prevent, and investigate security incidents, fraud, and misuse; maintain and improve the quality of the Services, to the extent Applicable Privacy Law permits; and comply with law (collectively, the “Permitted Purposes”). Fractal will limit its processing to what is reasonably necessary and proportionate to the Permitted Purposes.

4.2 Service Provider Restrictions. Fractal will not: (a) sell or share Personal Data; (b) retain, use, or disclose Personal Data for any purpose other than the Permitted Purposes, including for any commercial purpose other than providing the Services, or outside the direct business relationship between Fractal and Customer, except as Applicable Privacy Law permits; or (c) combine Personal Data with personal information that Fractal receives from or on behalf of another person or collects from its own interactions with individuals, except as Applicable Privacy Law permits. Fractal will comply with the obligations that Applicable Privacy Law imposes on service providers, provide the level of privacy protection that Applicable Privacy Law requires, and notify Customer if it determines that it can no longer meet its obligations under Applicable Privacy Law. Upon notice to Fractal, including after any notice from Fractal under this Section, Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data. Fractal certifies that it understands and will comply with the restrictions in this Section 4.2.

4.3 AI Training. Fractal will not use Personal Data or other Customer Data, other than de-identified or aggregated data under Section 4.4, to train general-purpose artificial intelligence models without Customer’s separate, express written authorization that identifies the data, purpose, recipients, and retention period. Routine use of the Services and acceptance of this DPA are not that authorization.

4.4 De-identified and Aggregated Data. Fractal may create de-identified or aggregated data from Customer Data and use it as the Terms permit, provided that Fractal (a) takes reasonable measures to ensure that the data cannot be associated with Customer or any individual; (b) publicly commits to maintain and use the data only in de-identified form and not to attempt to re-identify it, except as Applicable Privacy Law permits; and (c) contractually requires any recipient of the data to comply with these requirements. De-identified and aggregated data is not Personal Data under this DPA.

5Customer Responsibilities

5.1 Lawful Basis and Notices. Customer will establish and maintain a lawful basis for the processing, provide all required notices, and obtain all required consents and permissions from its employees, customers, vendors, and other individuals, and Customer will ensure that its collection of Personal Data and its transfer of Personal Data to Fractal comply with Applicable Privacy Law. Customer represents and warrants that it has done so and will continue to do so.

5.2 System Access and Controls. Customer will authorize access to its source systems, keep its Administrators and user permissions current, decide whether each proposed integration or automated action is appropriate, and review and approve payments, payroll, accounting entries, credit decisions, and other consequential actions under its own controls.

5.3 Restricted Data. Customer will not submit Restricted Data (as defined in the Terms) unless an Order and any required supplemental terms expressly permit it. Payroll, employment, credit, and banking capabilities require their own activated scope and applicable supplemental terms. Approved payment integrations may process tokens and appropriately minimized transaction records. Fractal’s obligations for Restricted Data submitted in violation of this Section are limited to the safeguards that apply to Customer Data generally.

5.4 Data Minimization. Customer will configure its integrations to transmit only the Personal Data reasonably necessary for the Services.

6Fractal Personnel

Fractal will limit access to Personal Data to personnel who need it to perform the Services, who are bound by written confidentiality obligations, and who have received appropriate privacy and security training.

7Security Measures

7.1 Safeguards. Fractal will implement and maintain reasonable administrative, technical, and physical safeguards appropriate to the nature of the Personal Data and the risks of the processing. These safeguards will include role-based access controls; confidentiality obligations; protection of administrative access, including multi-factor authentication; encryption of data in transit over public networks; protection of stored information; vulnerability and change management; logging appropriate for security investigations; and backup and recovery procedures. The specific controls, access paths, and recovery arrangements for Customer’s deployment may be documented in Annex 1 or in the Implementation Records.

7.2 Updates. Fractal may update its safeguards from time to time, provided that the updates do not materially reduce the overall protection of Personal Data.

7.3 Customer Security Responsibilities. Customer is responsible for its endpoints, networks, accounts, credentials, licenses, and source-system backups, and for its use of the security features available in the Services, except to the extent the approved scope expressly assigns a responsibility to Fractal.

7.4 No Additional Commitments. Nothing in this DPA is an uptime, recovery-time, certification, or data-residency commitment unless that commitment is stated in a separate signed document.

8Subprocessors

8.1 Authorization. Customer generally authorizes Fractal to engage Subprocessors. The Subprocessors in place when the applicable Order is signed are listed in Fractal’s subprocessor register at [subprocessor register link], which identifies each Subprocessor, its function, its processing location, and the categories of data it receives.

8.2 Subprocessor Obligations. Fractal will impose on each Subprocessor written data protection obligations that are no less protective of Personal Data than those in this DPA, to the extent applicable to the services the Subprocessor provides. Fractal remains responsible for each Subprocessor’s performance of those obligations.

8.3 Changes and Objections. Fractal will give at least 30 days’ notice, through the register’s notification mechanism or by email, before a new Subprocessor begins processing Personal Data, except that Fractal may engage a replacement Subprocessor on shorter notice when necessary to protect or continue the Services and will give notice as soon as reasonably practicable. Customer may object in writing on reasonable data protection grounds within the notice period. The parties will discuss the objection in good faith, and Fractal may propose a reasonable alternative. If no alternative is reasonably available within 30 days after Customer’s objection, Customer may terminate the affected Service by written notice and receive a refund of prepaid subscription fees for that Service covering the period after termination. That termination and refund are Customer’s sole and exclusive remedy for its objection. If Customer does not object within the notice period, Customer is deemed to have approved the Subprocessor.

9Processing Locations and International Transfers

9.1 Locations. Fractal will process Personal Data in the United States and in the other locations identified in the subprocessor register or Annex 1. A private or dedicated environment does not by itself mean that data never leaves Customer’s network or that all AI processing occurs locally.

9.2 Transfers. If Applicable Privacy Law requires a transfer mechanism for Personal Data transferred outside a particular jurisdiction, the parties will cooperate to put a lawful transfer mechanism in place before the restricted transfer occurs. This DPA does not itself include the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or any other transfer instrument.

10Security Incidents

10.1 Notice. Fractal will notify Customer without undue delay after becoming aware of a Security Incident. Fractal may give an initial notice before its investigation is complete and will supplement it as information becomes available.

10.2 Information and Cooperation. To the extent the information is available, Fractal will describe the nature of the Security Incident, the categories and approximate number of affected records and individuals, its likely consequences, the measures taken or proposed to contain and remediate it, and a contact for further information. Fractal will take reasonable steps to contain, investigate, and remediate the Security Incident, will preserve relevant evidence, and will cooperate reasonably with Customer.

10.3 Notifications to Others. Customer is responsible for deciding whether to notify affected individuals, regulators, or others, and for making those notifications, except where law independently requires Fractal to give notice. Fractal will not publicly identify Customer in connection with a Security Incident without Customer’s consent unless law requires it.

10.4 No Admission. Fractal’s notice of, or response to, a Security Incident is not an admission of fault or liability.

10.5 Costs. If a Security Incident results from Fractal’s breach of this DPA, Fractal will bear its own costs of investigating and remediating the Security Incident. Any other costs or losses are recoverable only as damages, subject to Section 17 of the Terms.

11Requests and Assistance

11.1 Individual Requests. If Fractal receives a request from an individual to exercise rights under Applicable Privacy Law concerning Personal Data, Fractal will promptly forward the request to Customer, unless law prohibits it, and will not respond to the individual except to direct the individual to Customer, on Customer’s instructions, or as required by law.

11.2 Assistance. Taking into account the nature of the processing and the information available to Fractal, Fractal will provide reasonable assistance to Customer, through the self-service tools in the Services where available, in responding to individual requests and with any data protection impact assessment, security assessment, or consultation with a regulator that Applicable Privacy Law requires.

11.3 Legal and Regulatory Requests. If Fractal receives a subpoena, court order, or regulatory inquiry concerning Personal Data, Fractal will promptly notify Customer unless legally prohibited and will cooperate reasonably, at Customer’s expense, with Customer’s efforts to limit disclosure.

11.4 Fees for Assistance. Customer will first use the self-service tools available in the Services. Fractal may charge reasonable fees, at its then-current rates, for assistance beyond those tools, but only if Fractal describes the assistance and Customer approves the fees in advance. Fractal will not charge for assistance needed to remedy its own breach, and neither party will use fees to avoid cooperation that law requires.

12Compliance Information and Audits

12.1 Compliance Information. On written request, no more than once a year, Fractal will make available information reasonably necessary to demonstrate its compliance with this DPA, which may include independent assessment reports, security summaries, completed questionnaires, and remediation information. Each report will accurately describe the entity, systems, period, and scope it covers, and a third party’s certification does not certify every Nexus service. All information provided under this Section is Fractal’s Confidential Information.

12.2 Audits. If the information provided under Section 12.1 is not sufficient to demonstrate Fractal’s compliance, or if a regulator requires it, Customer may audit Fractal’s compliance with this DPA, subject to the following conditions: (a) Customer gives at least 30 days’ advance written notice and a proposed scope; (b) the audit is conducted during normal business hours by Customer or by an independent auditor reasonably acceptable to Fractal, in either case bound by confidentiality obligations; (c) the audit does not access other customers’ data, Fractal’s privileged information, or systems unrelated to the Services, and it minimizes disruption to Fractal’s operations; (d) routine audits occur no more than once in any 12-month period, except following a material Security Incident, where there is reasonable evidence of noncompliance, or when a regulator requires it; and (e) Customer gives Fractal a copy of any audit report, which is Fractal’s Confidential Information.

12.3 Audit Costs. Customer bears its own audit costs. Unless the audit reveals a material breach of this DPA by Fractal, Customer will reimburse Fractal, at Fractal’s then-current professional services rates, for time that Fractal personnel spend supporting an on-site audit beyond one business day, and for all reasonable costs of any audit beyond one in a 12-month period. Nothing in this Section limits a regulator’s powers.

13Return and Deletion

13.1 Export. After the relevant Services end, Fractal will make Customer Data available for export as provided in Section 18.6 of the Terms. Customer must retrieve the export within that period or agree to a different arrangement in writing.

13.2 Deletion. After the export period, Fractal will delete Customer Data from its active systems within 90 days after the relevant Services end and from its backups in accordance with its routine backup rotation, within 180 days after the relevant Services end. Fractal may retain Personal Data to the extent law requires it, and in backups until they are overwritten, but it will keep retained data protected and access-restricted, will not use it for any other purpose, and will delete it when retention is no longer required. Restored backup data remains subject to this Section. Fractal will confirm deletion on Customer’s written request.

14Fractal’s Independent Processing

Fractal acts as an independent controller (or business) for business contact information, account administration records, billing records, fraud and security records, and website activity that it processes for its own legitimate business operations. That processing is described in the Privacy Notice and is not governed by this DPA, and it does not convert Customer’s operational records into Fractal’s marketing data. Payment processors and financial service providers may process data under their own roles and terms. Customer’s authorization to pay for its Nexus subscription does not authorize debits from Customer’s own customers or create a merchant processing, bank account, lending, or payroll relationship.

15Liability

Each party’s liability arising out of or relating to this DPA, whether in contract, tort, or under any other theory, is subject to the exclusions and limitations of liability in the Terms, and claims under this DPA and the Terms are aggregated under a single limitation of liability. This DPA does not create a separate or additional liability cap. Nothing in this DPA limits any right of an individual or a regulator that cannot be limited by contract.

16Term and Changes

This DPA remains in effect for as long as Fractal processes Personal Data on Customer’s behalf, and its obligations survive for as long as Fractal retains Customer Data. Fractal may update this DPA by notice to Customer to comply with changes in Applicable Privacy Law or to reflect changes in its Subprocessor practices, provided that the update does not materially reduce the protection of Personal Data. Any other update applies as described in Section 19 of the Terms.

A1Annex 1 Processing Details

Complete this Annex before Fractal first accesses Customer Data. Additional data categories, systems, or locations require documented approval by Customer’s authorized approver.