Master Data Processing Addendum

This Master Data Processing Addendum (the “DPA”) forms part of the agreement (the “Agreement”) between Tracer Labs, Inc., a Wyoming corporation doing business as Trust ID (“Trust ID”), and the customer identified in the applicable account registration, checkout flow, Order Form, enterprise agreement, or other ordering document (“Customer”). This DPA applies only to the extent Trust ID processes Personal Data on behalf of Customer in connection with the Services, including where Trust ID acts as a processor, service provider, or equivalent role under applicable data protection laws (such Personal Data, “Customer Personal Data”).

This DPA is intended to apply across Trust ID’s self-service and enterprise offerings. It may be incorporated electronically into self-service terms or attached to or incorporated by reference into an enterprise Order Form. An Order Form, signed amendment, security exhibit, international-transfer addendum, or other written agreement signed or otherwise accepted by both parties may supplement or modify this DPA only for the Customer, Services, and processing activities it expressly identifies and only to the extent it expressly states that it supplements or modifies this DPA.

If there is a conflict between this DPA and the Agreement regarding the processing of Customer Personal Data, this DPA will control solely with respect to that processing, except to the extent a document described in the preceding paragraph expressly supplements or modifies this DPA for the relevant Customer, Services, or processing activities. Except as modified by this DPA, the Agreement will remain in full force and effect. Capitalized terms not defined in this DPA will have the meanings given in the Agreement.

1. Definitions

2. Roles and Scope

2.1 Customer-directed processing

As between the parties, Customer determines the purposes and means for which it deploys and uses the Services and the Customer Personal Data that Customer submits to, or otherwise causes Trust ID to process through, the Services. To the extent Trust ID processes Customer Personal Data on Customer’s behalf and in accordance with Customer’s documented instructions, Customer acts as Controller and Trust ID acts as Processor. Where Customer processes Customer Personal Data on behalf of another Controller, Customer is responsible for ensuring that it is authorized to appoint Trust ID as a Subprocessor, and Trust ID will act as Customer’s Subprocessor with respect to such processing.

Nothing in this DPA is intended to alter a party’s legal role where Applicable Data Protection Law assigns a different role based on the actual facts, purposes, or means of the relevant processing.

2.2 Trust ID’s intended service-provider posture

When Trust ID acts as Customer’s Processor, service provider, contractor, or equivalent role, Trust ID will process Customer Personal Data only for the limited and specified purposes set out in this DPA, the Agreement, Customer’s documented instructions, and as otherwise permitted or required by Applicable Data Protection Law. Trust ID will not sell or share Customer Personal Data, retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer, or retain, use, disclose, market, license, or otherwise commercialize Customer Personal Data or Customer-specific consumer profiles for Trust ID’s own independent commercial purposes, except as expressly permitted by Applicable Data Protection Law.

Trust ID may process personal data in an independent Controller, business, or equivalent capacity to the extent the processing concerns Trust ID’s own account administration, billing, corporate operations, legal compliance, security, fraud prevention, sales or relationship management with Customer personnel, or other purposes expressly disclosed in Trust ID’s applicable privacy notice and permitted by Applicable Data Protection Law. For clarity, this independent processing is limited to data for which Trust ID determines the purposes and means of processing and does not convert Customer Personal Data processed on Customer’s behalf into Trust ID’s independent data or permit Trust ID to use such Customer Personal Data for purposes other than those authorized under this DPA, the Agreement, Customer’s documented instructions, or Applicable Data Protection Law.

3. Documented Instructions and Specific Business Purposes

Customer instructs Trust ID to process Customer Personal Data as reasonably necessary to provide, configure, operate, maintain, support, secure, and improve the Services for Customer, provided that any processing to improve the Services remains strictly within the purposes and restrictions permitted for a processor, service provider, or similar role under Applicable Data Protection Law and Customer’s documented instructions, and to perform the specific processing activities Customer enables, requests, or authorizes. The Agreement, this DPA, applicable Order Forms and statements of work, Customer’s configuration of the Services, API calls, integrations, administrative selections, feature settings, and other authorized use of the Services constitute Customer’s documented instructions.

The specific business purposes for processing may include, as applicable:

• collecting, receiving, organizing, pseudonymizing, recognizing, and maintaining website, application, device, session, account, customer, and interaction context;
• performing live visitor recognition and, where Customer enables it and law permits, identity resolution before a visitor supplies a first-party identifier, subject to Customer having provided all necessary notices and obtained all required consents under Applicable Data Protection Law;
• binding first-party identifiers to prior permitted visitor or customer context after signup, login, form submission, purchase, registration, or another Customer-authorized event;
• performing individual, batch, CRM, CDP, API, file, database, data-warehouse, or other Customer-directed resolution, matching, validation, enrichment, and refresh activities;
• creating or maintaining Customer-specific profiles, customer context, identity links, journeys, audiences, intent signals, scores, analytics, attribution, recommendations, reports, and other Service outputs;
• transmitting, receiving, synchronizing, routing, or activating Customer Personal Data through Customer-authorized integrations, systems, channels, destinations, or workflows;
• facilitating Customer Group processing, an Authorized Data Collaboration, or Consumer Direction where enabled, documented, and legally permitted;
• issuing, storing, synchronizing, retrieving, presenting, verifying, revoking, or routing data, permissions, or credentials through a Consumer-Controlled Feature if and when such functionality is offered and enabled;
• providing support, implementation, migration, troubleshooting, service administration, metering, billing support, and operational communications;
• preventing, detecting, investigating, and remediating fraud, abuse, security incidents, malicious activity, unauthorized access, and violations of the Agreement;
• maintaining reliability, service quality, performance, availability, and product functionality, including internal improvement only to the extent permitted for a processor, service provider, or similar role under Applicable Data Protection Law and without retaining, using, or disclosing Customer Personal Data to build, augment, or modify profiles for use in providing services to another Customer or across different Customers, except to the extent expressly permitted by Applicable Data Protection Law and Customer’s documented instructions; and
• complying with law, legal process, regulatory obligations, and Customer’s documented privacy-rights instructions.

Trust ID will promptly notify Customer if, in Trust ID’s opinion, a documented instruction violates Applicable Data Protection Law, unless prohibited from doing so by law. Trust ID is not required to perform, and may decline or suspend, an instruction to the extent Trust ID reasonably determines that performing the instruction would require Trust ID to violate Applicable Data Protection Law or other applicable law, or to assume a regulated role or obligation that Trust ID has not agreed to assume.

4. Customer Responsibilities

Customer is responsible for the lawfulness of Customer’s instructions and use of the Services under Applicable Data Protection Law. Customer represents and warrants that:

• Customer has all rights, permissions, legal bases, notices, disclosures, and consents necessary under Applicable Data Protection Law for Trust ID to process Customer Personal Data as instructed in each applicable deployment environment;
• Customer has authority to deploy Trust ID technology on each website, application, domain, property, system, database, or environment where the Services are enabled, and such deployment complies with Applicable Data Protection Law;
• Customer has implemented all consent, opt-out, preference, suppression, and consumer-rights mechanisms required by Applicable Data Protection Law, including for tracking, recognition, identity resolution, enrichment, advertising, or other processing in each applicable deployment environment;
• Customer may lawfully submit, connect, or cause Trust ID to process CRM, customer, prospect, account, transaction, interaction, or other records used for bulk or individual enrichment under Applicable Data Protection Law;
• any Customer-requested sharing among Authorized Affiliates or participants in an Authorized Data Collaboration is permitted under Applicable Data Protection Law and supported by all required agreements, disclosures, consents, and legal bases;
• Customer will not instruct Trust ID to use Customer Personal Data for unlawful discrimination, including in violation of applicable anti-bias, civil rights, or fair lending laws, unlawful surveillance, consumer reporting, credit, employment, housing, insurance, or other eligibility determinations subject to the Fair Credit Reporting Act, analogous state consumer reporting laws, or similar laws, or any other prohibited purpose; and
• Customer will not submit, make available, or cause Trust ID to process, and will implement reasonable controls designed to prevent the unauthorized ingestion of, highly regulated sensitive information, protected health information regulated by HIPAA, biometric data or biometric templates, payment authentication data regulated by PCI DSS, precise sensitive eligibility data, or children’s data regulated by COPPA, GDPR, or other Applicable Data Protection Law, unless Trust ID has expressly approved the relevant processing in writing and the parties have implemented any required safeguards.

5. Processing Limitations; No Independent Consumer-Data Resale

5.1 No sale or independent commercialization

When Trust ID acts as Customer’s Processor, service provider, contractor, or equivalent role, Trust ID will not sell or share Customer Personal Data, as those terms are defined under Applicable Data Protection Law. For clarity, a disclosure of Customer Personal Data that is expressly directed by Customer, expressly directed by the individual through a legally recognized Consumer Direction, or made to a Subprocessor to provide the Services does not constitute a sale or sharing by Trust ID when made in accordance with this DPA, the Agreement, Customer’s documented instructions, and Applicable Data Protection Law.

Trust ID will not independently acquire Customer Personal Data under this DPA for the purpose of reselling consumer profiles to unrelated third parties, and will not use identifiable Customer Personal Data of one Customer to provide individual-level services to another Customer except to the extent the processing is authorized through the applicable Customer’s documented instruction, a legally permitted Authorized Data Collaboration, a Consumer Direction, an applicable Customer Group arrangement, or another basis permitted by Applicable Data Protection Law, and in each case subject to the restrictions in this Section 5.

5.2 Direct-business-relationship and combination restrictions

Trust ID will not retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement and Customer’s documented instructions, or outside the direct business relationship with Customer, except as permitted by Applicable Data Protection Law. Trust ID will not combine Customer Personal Data with Personal Data received from another person or collected from Trust ID’s own independent interaction with an individual except to the extent expressly permitted for a Processor, service provider, contractor, or equivalent role under Applicable Data Protection Law and consistent with the business purposes specified in the agreement and Customer’s documented instructions.

Nothing in this subsection prohibits shared technical infrastructure, pseudonymous identifiers, routing systems, security signals, suppression controls, or other operational components that do not result in unauthorized use or disclosure of Customer Personal Data.

5.3 Aggregated and de-identified information

Trust ID may create and use information that has been lawfully aggregated, anonymized, or de-identified so that it no longer constitutes Customer Personal Data, subject to Applicable Data Protection Law. To the extent required by Applicable Data Protection Law, Trust ID will maintain reasonable measures designed to ensure that de-identified information cannot be associated with an identified or identifiable consumer, household, device, or individual; will maintain and use such information only in de-identified form; will not attempt to reidentify such information except solely to test or validate de-identification processes where permitted by Applicable Data Protection Law; and will contractually require any subsequent recipient of such de-identified information to comply with equivalent restrictions and commitments.

6. Architecture, Storage, and Data Location Flexibility

The parties agree that this DPA governs legal obligations and permitted processing rather than requiring a particular technical architecture. Trust ID may determine and change the architecture used to provide the Services, subject to the Agreement, this DPA, and Applicable Data Protection Law, provided that such changes do not materially degrade the overall security of the Services, violate agreed data transfer mechanisms or cross-border transfer restrictions, or breach Applicable Data Protection Law.

Subject to the Agreement, this DPA, and Applicable Data Protection Law, Customer Personal Data may, as appropriate to the Services and Customer configuration, be stored, processed, replicated, cached, partitioned, sharded, indexed, backed up, routed, synchronized, or otherwise handled through centralized, decentralized, distributed, federated, shared, dedicated, multi-tenant, single-tenant, Customer-hosted, Trust-ID-hosted, provider-hosted, consumer-controlled, or hybrid environments.

Trust ID may use full records, partial records, caches, derived values, pseudonymous identifiers, hashed or tokenized values, credentials, references, permissions, consent records, routing metadata, or other technical representations as appropriate to provide the Services, subject to the Agreement, this DPA, and Applicable Data Protection Law. The applicable privacy, confidentiality, security, use, and disclosure obligations under the Agreement, this DPA, and Applicable Data Protection Law apply to Customer Personal Data regardless of the technical form or architecture in which it is processed.

Except where an Order Form, data-residency exhibit, security exhibit, the Agreement, this DPA, or Applicable Data Protection Law expressly requires otherwise, Customer is not entitled to a particular cloud provider, storage technology, physical segregation model, database topology, system design, processing pipeline, or geographic region. Trust ID may select infrastructure and migrate or re-architect the Services without amending this DPA, provided Trust ID continues to comply with the applicable obligations of the Agreement, this DPA, and Applicable Data Protection Law, and provided further that such selection, migration, or re-architecture does not materially degrade the overall security of the Services, violate agreed data transfer mechanisms or cross-border transfer restrictions, or breach Applicable Data Protection Law.

7. Consumer-Controlled Data and Future Digital Wallet Model

7.1 Product direction without current commitment

The Services may evolve to include Consumer-Controlled Features, including digital wallets, personal data stores, verifiable credentials, portable identity or preference records, delegated agents, or similar mechanisms through which an individual may exercise technical control over what data or credentials are held, presented, verified, or shared.

This DPA preserves the ability to support those models, subject to the Agreement, this DPA, and Applicable Data Protection Law, but does not represent that any Consumer-Controlled Feature is currently available, included in a particular plan, suitable for every Customer, or subject to any separate binding delivery commitment. Trust ID may limit such functionality to enterprise deployments, specific jurisdictions, specific use cases, or separately agreed feature terms.

7.2 Consumer direction and data portability

Where a Consumer-Controlled Feature is enabled, an individual may be permitted to authorize Trust ID or participating systems to issue, store, retrieve, present, verify, revoke, route, or share data or credentials according to that individual’s valid Consumer Direction and applicable legal requirements. Depending on the implementation, the underlying information may be held by the individual, by Customer, by Trust ID, by one or more service providers, or through a hybrid or distributed architecture.

A Consumer Direction may, where legally permitted and supported by the applicable feature, allow an individual to present or make data or credentials available to another participating brand, organization, customer, or third party. Trust ID’s facilitation of such a direction must adhere to the applicable valid Consumer Direction and applicable legal requirements, does not grant Trust ID an independent right to commercialize the individual’s data, and is not intended to permit Trust ID to repurpose one customer’s Customer Personal Data for another customer or third party on Trust ID’s own initiative.

7.3 Legal roles for future consumer-facing processing

This DPA applies only to processing performed by Trust ID on Customer’s behalf. If a future Consumer-Controlled Feature creates a direct relationship between Trust ID and an individual or causes Trust ID to process Personal Data for purposes or on instructions that are not solely Customer-directed, that separate processing may fall outside this DPA and may be governed by separate consumer-facing terms, privacy notices, consent mechanisms, or feature-specific agreements. Any such separate processing does not limit or dilute Trust ID’s obligations under this DPA with respect to Customer Personal Data processed on Customer’s behalf.

Nothing in this DPA characterizes Personal Data as property where Applicable Data Protection Law does not recognize such ownership, or limits Customer’s rights under the Agreement with respect to Customer Personal Data. Trust ID does not claim ownership of Personal Data merely because Trust ID processes, stores, routes, verifies, or synchronizes it.

8. Authorized Affiliates, Cross-Brand Sharing, and Data Collaborations

Customer may instruct Trust ID to make approved customer context available among Authorized Affiliates where the participating entities are legally permitted to disclose, receive, and use the information for the stated purpose and Customer has provided a valid documented instruction. Trust ID may require the participating entities, brands, domains, purposes, data categories, applicable legal bases or permissions, and relevant technical controls to be identified through an Order Form, account configuration, implementation record, or other written instruction. Customer remains responsible for ensuring that its instruction and each Authorized Affiliate’s use of the information comply with Applicable Data Protection Law, the Agreement, and any applicable third-party or upstream rights.

Separate Customers may request an Authorized Data Collaboration under Section 8 of the Trust ID Terms. The standard legal terms for such collaborations are incorporated into the Terms and this DPA; a separate data-collaboration addendum is not required for an ordinary collaboration unless required by Applicable Data Protection Law, an upstream right, or the parties’ written agreement. The specific participants, purposes, categories of data, sources and destinations, duration, permissions or legal bases, allocation of applicable roles, and technical and organizational controls may be documented through an Order Form, account configuration, administrator workflow, electronic acceptance, written instruction accepted by Trust ID, consumer permission record, or other verifiable Collaboration Instruction. Each participating Customer is responsible for ensuring that it has all required rights, notices, consents, authorizations, and legal bases for the disclosure, receipt, and use of the relevant data in the authorized Data Collaboration. A bespoke amendment may be used where the parties agree or where applicable law or an upstream right requires additional terms.

Trust ID will not initiate cross-brand use of Customer Personal Data solely for Trust ID’s own commercial purposes or combine, sell, share, or repurpose one Customer’s Customer Personal Data for another Customer or third party except as expressly authorized by a valid Customer instruction, Collaboration Instruction, Consumer Direction, the Agreement, this DPA, and Applicable Data Protection Law. Customer-directed or consumer-directed portability, matching, linking, presentation, verification, or sharing may be supported where legally permitted, technically enabled, supported by required notices, permissions, and legal bases, and consistent with applicable provider rights and the Agreement.

9. Subprocessors and Customer-Directed Third Parties

9.1 General authorization

Customer generally authorizes Trust ID to engage Subprocessors as reasonably necessary to provide the Services. Trust ID may add, remove, replace, or change Subprocessors as the Services evolve. Trust ID will require each Subprocessor that processes Customer Personal Data on Trust ID’s behalf to be bound by written contractual terms imposing data-protection obligations no less protective than those imposed on Trust ID under this DPA, to the extent applicable to the nature of the Subprocessor’s processing, and consistent with Applicable Data Protection Law. Trust ID remains responsible and liable to Customer for the performance of its Subprocessors’ data-protection obligations with respect to Customer Personal Data.

Trust ID may maintain and update a then-current Subprocessor list separately from this DPA through its website, customer portal, security documentation, or another reasonable mechanism. Before authorizing a new Subprocessor to process Customer Personal Data, Trust ID will provide prior notice through email notification, an update mechanism, a subscriber or customer portal, security documentation, or another reasonable mechanism, and will provide Customer a reasonable opportunity to object.

Any objection must be based on reasonable documented data-protection grounds. If the parties cannot amicably resolve a valid objection, Trust ID may modify the affected processing to avoid use of the objected-to Subprocessor, and, if Trust ID cannot reasonably do so, Customer may, without penalty, suspend or terminate only the affected Service, feature, or portion of the Services that cannot be provided without the objected-to Subprocessor, as permitted by Applicable Data Protection Law and the Agreement.

9.2 Customer-directed providers and integrations

Customer may direct Trust ID to connect with or exchange Customer Personal Data with applications, platforms, systems, data providers, APIs, wallets, agents, or other third parties selected, contracted with, or controlled by Customer. A Customer-directed third party is not a Trust ID Subprocessor solely because Trust ID facilitates Customer’s connection to that third party. Customer is responsible for the lawfulness of its instructions and its agreements with Customer-directed third parties. Trust ID is not responsible or liable for the processing, security, privacy practices, availability, or handling of Customer Personal Data after it is transmitted to, made available to, or accessed by a customer-directed third party, platform, integration, or other recipient in accordance with Customer’s instructions.

10. Security and Confidentiality

Trust ID will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, alteration, unauthorized disclosure of, or access to, Customer Personal Data, taking into account the state of the art, implementation costs, the nature of the Services, and the nature, scope, context, purposes, and risks of the processing.

Such measures may include, as appropriate and taking into account the nature of the Services and relevant risks, industry-standard administrative, technical, and organizational controls, including access controls, authentication and authorization, logical separation, encryption or equivalent protections in transit and, where appropriate, at rest, secure configuration, vulnerability and change management, logging and monitoring, backup and recovery, incident response, personnel confidentiality obligations, and provider diligence.

Security controls may evolve as the Services, architecture, technology, risks, and legal requirements change, provided that any such modification does not materially degrade or reduce the overall security of the Services or Trust ID’s compliance with Applicable Data Protection Law or an applicable security commitment.

Customer is responsible for implementing and maintaining appropriate security measures for Customer-controlled systems, accounts, endpoints, credentials, integrations, wallets, websites, applications, cloud environments, and other environments under Customer’s control, including safeguarding access credentials and configurations, except to the extent Trust ID is responsible for such measures under the Agreement or this DPA.

11. Security Incidents

Trust ID will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data where notification is required by Applicable Data Protection Law or the Agreement. Trust ID will provide information reasonably available to Trust ID concerning the nature of the Security Incident, affected categories of Personal Data or Data Subjects where known, measures taken or proposed to contain, investigate, mitigate, and remediate the Security Incident, and information reasonably necessary for Customer to satisfy applicable legal obligations. To the extent such information is not available at the time of initial notice, Trust ID will provide relevant updates as additional material information becomes reasonably available.

Trust ID will take commercially reasonable measures designed to contain, investigate, mitigate, and remediate any Security Incident within Trust ID’s control and will reasonably cooperate with Customer in connection with Customer’s assessment of the Security Incident and related legal obligations. Any notification cooperation, or remediation activity under this section will not constitute an admission of fault or liability by Trust ID.

12. Data Subject and Consumer Rights

Customer is responsible for evaluating, verifying, and responding to Data Subject requests to the extent Customer is legally responsible for the response under Applicable Data Protection Law. Taking into account the nature of the processing, the functionality of the Services, and the information available to Trust ID, Trust ID will provide commercially reasonable assistance to Customer with valid access, correction, deletion, portability, restriction, objection, opt-out, limitation, withdrawal, or other legally required privacy-rights requests, in each case to the extent required by Applicable Data Protection Law and reasonably supported by the Services.

If Trust ID receives a request directly from an individual concerning Customer Personal Data processed solely on Customer’s behalf, Trust ID will, to the extent legally permitted, either promptly notify Customer, direct the individual to Customer, or act on Customer’s documented instructions. Trust ID will not independently fulfill such request unless authorized by Customer or required by Applicable Data Protection Law.

Consumer-Controlled Features may provide additional self-directed access, portability, permissions, revocation, presentation, or consent-management functionality. Such functionality is intended to supplement, and does not eliminate or replace, Customer’s legally required privacy-rights, consent, notice, or compliance processes unless Applicable Data Protection Law expressly provides otherwise. Customer remains responsible for determining whether and how such functionality satisfies Customer’s legal obligations in the relevant context.

13. Regulatory, Assessment, and Audit Assistance

Taking into account the nature of the processing and the information available to Trust ID, Trust ID will provide reasonable assistance to Customer, upon reasonable request and to the extent required by Applicable Data Protection Law, in connection with data-protection impact assessments, risk assessments, legally required cybersecurity audits, regulatory inquiries or consultations concerning Trust ID’s processing of Customer Personal Data on Customer’s behalf, and Customer’s demonstration of compliance with applicable controller, business, processor, or service-provider obligations.

Upon reasonable written request, Trust ID will make available information reasonably necessary to demonstrate Trust ID’s compliance with this DPA and with Applicable Data Protection Law applicable to Trust ID in its role as a processor, service provider, contractor, or comparable role. Trust ID may satisfy audit or diligence requests through available security documentation, questionnaires, independent reports or assessments, certifications or attestations, summaries of controls, subprocessor or provider compliance information, or other reasonably sufficient information, except to the extent Applicable Data Protection Law requires a different audit mechanism.

If Applicable Data Protection Law requires an additional audit or inspection that cannot reasonably be satisfied through available documentation, Trust ID will permit and reasonably contribute to such audit or inspection by Customer or an independent auditor appointed by Customer, subject to reasonable written notice and the parties’ good-faith cooperation regarding reasonable scope, timing, confidentiality, security, and allocation of costs to the extent permitted by Applicable Data Protection Law. Audits may not unreasonably interfere with Trust ID’s operations, expose information concerning other customers, disclose Trust ID’s trade secrets or highly sensitive security information except where legally required and subject to appropriate safeguards, or create avoidable security risk. Trust ID will use commercially reasonable efforts to address any material verified noncompliance identified through such audit.

14. Return, Deletion, and Retention

Trust ID will retain Customer Personal Data only for the duration necessary to provide the Services, as specified in Customer’s documented instructions, or as required by applicable law.

Upon expiration or termination of the applicable Services, Trust ID will, at Customer’s election, return or delete Customer Personal Data in accordance with Customer’s documented instructions, the Agreement, and Applicable Data Protection Law, unless otherwise agreed or instructed in writing, and except to the extent retention is required by applicable law.

Customer Personal Data retained in ordinary backups, disaster-recovery systems, caches, archives, distributed stores, or similar technical systems may remain until overwritten, expired, revoked, or deleted through Trust ID’s standard retention cycles, provided the retained data remains subject to the confidentiality, security, and other applicable terms of this DPA, is protected from unauthorized access and active processing, and is not used for unrelated purposes.

For Consumer-Controlled Features, deletion or revocation requests may operate differently depending on whether the relevant information is held by Customer, Trust ID, an individual, or another participating system. Trust ID will execute valid deletion or revocation instructions across the data under Trust ID’s control in accordance with Applicable Data Protection Law and will apply available rights and technical controls without compromising data integrity or other customers’ systems.

15. International Data Transfers

If Customer Personal Data is subject to the GDPR, UK GDPR, Swiss data-protection law, or another Applicable Data Protection Law requiring a lawful cross-border transfer mechanism, and is transferred to a country or recipient that does not benefit from an applicable adequacy decision or equivalent recognition, the parties will use an applicable lawful transfer mechanism in accordance with Applicable Data Protection Law.

Where required, the then-current European Commission Standard Contractual clauses, including the appropriate module based on the parties’ roles, the applicable UK Addendum or International Data Transfer Agreement, Swiss amendments or adaptations, or another legally recognized transfer mechanism will be incorporated by reference or implemented through a separate transfer addendum, as applicable.

Trust ID may implement a replacement or updated lawful transfer mechanism without amending the commercial provisions of the Agreement where necessary or appropriate to comply with Applicable Data Protection Law, provided that such replacement or updated mechanism is legally recognized, does not materially reduce the level of protection for Customer Personal Data, and is notified to Customer where required by Applicable Data Protection Law.

16. United States State Privacy and California Service-Provider Terms

To the extent Applicable Data Protection Law imposes specific obligations on processors, service providers, contractors, or other analogous regulated roles applicable to a party’s processing of Customer Personal Data under this DPA, those obligations are incorporated into this DPA and will apply according to the parties’ respective roles under Applicable Data Protection Law.

To the extent Trust ID processes Customer Personal Data in its capacity as a “service provider” or “contractor” under the California Consumer Privacy Act, as amended, Trust ID will:

• not “sell” or “share” Customer Personal Data, as those terms are defined under the CCPA, collected pursuant to the Agreement, except to the extent expressly permitted for a service provider or contractor under the CCPA and its implementing regulations;
• retain, use, disclose, or otherwise process Customer Personal Data only for the limited and specified business purposes identified in this DPA, the Agreement, and Customer’s documented instructions, and not for any purpose prohibited by the CCPA;
• not retain, use, or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the limited and specified business purposes set forth in the Agreement, this DPA, or Customer’s documented instructions, or as otherwise expressly permitted for service providers or contractors under the CCPA and applicable regulations;
• not retain, use, or disclose Customer Personal Data outside the direct business relationship between Trust ID and Customer except as expressly permitted for service providers or contractors under the CCPA and applicable regulations;
• not combine Customer Personal Data with Personal Data received from or on behalf of another person or business, or collected from Trust ID’s own independent interaction with the consumer, except to the extent expressly permitted for service providers or contractors under the CCPA and applicable regulations;
• comply with the CCPA and applicable regulations in connection with its processing of Customer Personal Data and provide the same level of privacy protection required of service providers and contractors under the CCPA and applicable regulations;
• permit Customer to take reasonable and appropriate steps to help ensure Trust ID uses Customer Personal Data consistently with Customer’s obligations under the CCPA and applicable regulations, including by providing information reasonably necessary to verify such compliance and, where appropriate, supporting reasonable assessments, audits, attestations, or other technical and operational testing subject to reasonable confidentiality, security, and operational safeguards;
• promptly notify Customer if Trust ID determines that it can no longer meet its applicable obligations under the CCPA or applicable regulations with respect to Customer Personal Data;
• permit Customer, upon notice, to take reasonable and appropriate steps to stop and remediate any unauthorized retention, use, disclosure, or combination of Customer Personal Data, and reasonably cooperate with Customer in connection with such remediation;
• cooperate as required by the CCPA and applicable regulations with Customer in responding to valid consumer requests and in completing applicable risk assessments, cybersecurity audits, and automated-decisionmaking obligations; and
• require any Subprocessor processing Customer Personal Data on Customer’s behalf to be bound by a written contract that imposes obligations no less restrictive than those required of a service provider or contractor under the CCPA and applicable regulations, including the restrictions on retention, use, disclosure, sale, sharing, and combination of Customer Personal Data.

The parties acknowledge that legal classification under the CCPA and other Applicable Data Protection Law depends on the parties’ actual processing activities and the applicable statutory and regulatory requirements. Nothing in this DPA is intended to override Applicable Data Protection Law or to characterize a processing activity as a processor, service-provider, or contractor activity where Applicable Data Protection Law assigns a different role or imposes different obligations.

17. GDPR and UK GDPR Processor Terms

To the extent the GDPR or UK GDPR applies and Trust ID acts as Processor, Trust ID will: process Personal Data only on documented instructions from Customer, including with respect to international transfers, unless required to do so by applicable law, in which case Trust ID will inform Customer of that legal requirement before processing unless such law prohibits notice on important grounds of public interest; promptly notify Customer if, in Trust ID’s opinion, an instruction infringes the GDPR, UK GDPR, or other applicable data protection law; ensure persons authorized to process Personal Data are subject to appropriate confidentiality obligations; implement appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk as required by applicable law; comply with the Subprocessor requirements in this DPA; assist Customer, taking into account the nature of the processing and the information available to Trust ID, with Data Subject rights requests and Customer’s applicable security, personal data breach notification, impact-assessment, prior-consultation, and related compliance obligations; notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of Customer; at Customer’s choice, delete or return Personal Data at the end of the Services, subject to lawful retention requirements; and make available information reasonably necessary to demonstrate compliance with applicable processor obligations, including by allowing for and contributing to audits or inspections subject to reasonable confidentiality, security, and operational safeguards.

18. Liability

Except to the extent prohibited by Applicable Data Protection Law or otherwise required by applicable law, each party’s aggregate liability arising out of or relating to this DPA will be subject to and governed by the exclusions, limitations, caps, procedures, and other liability provisions in the Agreement. Nothing in this DPA will limit either party’s liability to the extent such limitation is not permitted by applicable law, and this DPA will not create any separate or additional liability cap, indemnity, remedy, or cause of action unless expressly stated in the Agreement, an applicable Order Form, or required by applicable law.

19. Term; Changes

This DPA becomes effective when incorporated into or executed with the Agreement and remains in effect for so long as Trust ID processes Customer Personal Data on Customer’s behalf. Provisions that by their nature should survive termination or expiration, including confidentiality, deletion or return, security, audit, liability, and obligations relating to Customer Personal Data lawfully retained after termination, will survive for as long as necessary to give effect to those provisions and to comply with applicable law.

Trust ID may update this DPA to reflect changes in Applicable Data Protection Law, the Services, security practices, processing activities, transfer mechanisms, architecture, or other legal or regulatory requirements. Trust ID will provide reasonable prior notice of material changes where practicable. Any update will not materially reduce Trust ID’s data-protection obligations for an existing paid Customer during an active committed term, or materially impair Customer’s rights under this DPA, unless required by applicable law or reasonably necessary to address security, infrastructure, compliance, or regulatory requirements. No update will override the Standard Contractual Clauses, the UK Addendum, or any other mandatory data-transfer or data-protection terms to the extent they apply.

Changes to underlying providers, infrastructure, hosting, storage architecture, database topology, system design, data-routing methods, or other technical implementation choices do not by themselves require an amendment to this DPA, provided Trust ID continues to satisfy its obligations under this DPA and Applicable Data Protection Law, and provided such changes do not materially reduce the overall level of security, confidentiality, or data-protection commitments applicable to Customer Personal Data.

20. Order of Precedence; Governing Agreement

If this DPA conflicts with the Agreement regarding the processing of Customer Personal Data, this DPA will control solely with respect to that processing. An Order Form, security exhibit, transfer addendum, Collaboration Instruction, or amendment signed by authorized representatives of the parties may supplement this DPA only for the Customer, participants, Services, processing activities, or data expressly identified in that document. An operational Collaboration Instruction will not reduce, waive, or limit the data-protection obligations, security commitments, or data-subject protections in this DPA unless a signed amendment expressly states otherwise and such reduction, waiver, or limitation is permitted by Applicable Data Protection Law.

Except as expressly stated in this DPA, the Agreement’s governing-law, dispute-resolution, confidentiality, intellectual-property, indemnification, limitation-of-liability, assignment, notice, and general provisions apply to this DPA. Those provisions apply only to the extent they do not conflict with this DPA, Applicable Data Protection Law, the Standard Contractual Clauses, the UK Addendum, or any other mandatory data-transfer or data-protection terms that apply to the processing of Customer Personal Data.

Schedule 1 — Details of Processing

Schedule 2 — Security Measures

Trust ID implements and maintains appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of processing, and the risks to Data Subjects. Individual controls may evolve as technology, architecture, risk, infrastructure, and legal requirements change, provided that such evolution does not materially degrade or reduce the overall security of the Services or Customer Personal Data.

• identity, access-control, authentication, authorization, and privilege-management controls;
• logical access separation and environment controls appropriate to the selected architecture;
• encryption of Customer Personal Data in transit using industry-standard, cryptographic protocols and encryption at rest or equivalent protections for stored Customer Personal Data where appropriate;
• secure infrastructure, configuration, secrets, key, credential, and change-management practices;
• logging, monitoring, anomaly detection, and security review where appropriate;
• vulnerability, patch, dependency, and remediation practices;
• binding confidentiality and security obligations for personnel authorized to process Customer Personal Data and applicable service providers;
• backup, resilience, availability, recovery, and continuity measures appropriate to the Service;
• incident identification, response, containment, investigation, mitigation, and remediation procedures;
• provider diligence and contractual safeguards for applicable Subprocessors; and
• periodic testing, assessment, review, and improvement of safeguards based on changes to the Services, relevant risks, and applicable law.