Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the Terms of Service between Inuberry, Inc. ("Processor") and the customer ("Controller") and applies whenever Processor processes Personal Data on behalf of Controller in the course of providing the Service.

1. Definitions

"Personal Data", "Processing", "Controller", "Processor", and "Data Subject" have the meanings given in the GDPR.

2. Subject matter and duration

Processor processes Personal Data only to provide the Service for the duration of the Controller's subscription, plus the retention period set out in the Privacy Policy.

3. Nature and purpose

Processing covers hosting, storage, backup, transmission, retrieval, and support of Personal Data contained in records the Controller creates in Inuberry, including CRM contacts, employees, customers, and invoice recipients.

4. Subprocessors

Controller authorizes the subprocessors listed in the Privacy Policy. Processor will give 30 days' notice of any new subprocessor and provide a reasonable mechanism to object.

5. Security measures

• Encryption in transit (TLS 1.2+) and at rest.
• Row-level security on all multi-tenant data tables.
• Role-based access control and least-privilege for Processor personnel.
• Audit logging of sensitive operations.
• Leaked-password protection on customer accounts.

6. International transfers

For transfers out of the EEA/UK/Switzerland, the parties incorporate the EU Standard Contractual Clauses (Module Two: Controller-to-Processor) by reference, with Processor as data importer.

7. Data subject requests

Processor will assist Controller in responding to data-subject requests using in-product tooling where available. Direct requests received by Processor will be forwarded to the Controller without undue delay.

8. Breach notification

Processor will notify Controller without undue delay and in any case within 72 hours of becoming aware of a Personal Data Breach affecting Controller's Personal Data.

9. Audits

Processor will make available the most recent third-party reports and respond to reasonable written audit questionnaires once per year.

10. Deletion

Upon termination, Processor will delete or return all Personal Data within 30 days unless retention is required by law.

11. Acceptance

Customers can execute this DPA by countersigning and emailing it to dpo@inuberry.com. Use of the Service constitutes acceptance of this DPA where countersignature is not required.

Template — review with qualified legal counsel before relying on this DPA for regulated customers.