Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Teneo Labs Inc. ("Teneo") and the customer that accepted them ("Customer"). It applies when Teneo processes Customer Personal Data on Customer's behalf and the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection or a U.S. state privacy law (together, "Data Protection Law") applies to that processing. Terms not defined here have the meaning given in the Terms or in Data Protection Law.

1. Roles and scope

1.1 Customer Personal Data means personal data in Inputs and Output that Teneo processes on Customer's behalf to retrieve, convert and deliver web pages.

1.2 Roles. For Customer Personal Data, Customer is the controller, or a processor acting for its own controller, and Teneo is its processor or sub-processor.

1.3 Outside this DPA. This DPA does not cover data for which Teneo is a controller: account, verification, billing and payment data, and API usage data and request logs. The Privacy Notice describes that processing.

1.4 Request logs. Customer agrees that Teneo keeps the URLs Customer submits in its request logs. Teneo holds them as an independent controller, not on Customer's instructions, only for billing, security, abuse handling and legal compliance, for the periods in its Privacy Notice.

1.5 U.S. state privacy laws. Where the CCPA or a similar U.S. state law applies, Teneo is Customer's service provider or processor for Customer Personal Data. It does not sell or share that data, and does not retain, use or disclose it outside its direct business relationship with Customer or for any purpose other than providing the Services, except as Section 1.4 describes and as those laws allow. Teneo will not combine Customer Personal Data with personal data from other sources, except as those laws allow. Teneo will comply with those laws, provide the protection they require and tell Customer if it can no longer do so. Customer may take reasonable and appropriate steps, including under Section 3.6, to ensure compliant use and to stop and remediate unauthorized use.

2. Customer instructions

2.1 Instructions. Teneo processes Customer Personal Data only on Customer's documented instructions. The Terms, Customer's API requests and Customer's configuration of the Services are those instructions.

2.2 Unlawful instructions. Teneo will tell Customer if it believes an instruction violates Data Protection Law, unless the law prohibits this. Teneo may also process Customer Personal Data where Union or Member State law, or other law to which Teneo is subject, requires it, after informing Customer where permitted.

2.3 Customer responsibility. Customer is responsible for the lawfulness of its instructions and of the processing it requests, including having a legal basis and giving any notices required to data subjects.

3. Teneo's obligations

3.1 Confidentiality. Teneo ensures that persons authorized to process Customer Personal Data are bound by confidentiality.

3.2 Security. Teneo implements the technical and organizational measures in Annex 2.

3.3 Assistance. Taking into account the nature of the processing, Teneo assists Customer, as far as it can, with data-subject requests, security, breach notifications, impact assessments and consultations with authorities. Teneo forwards data-subject requests about Customer Personal Data to Customer where it can identify Customer.

3.4 Personal data breaches. Teneo notifies Customer without undue delay, and within 48 hours where feasible, after becoming aware of a personal data breach affecting Customer Personal Data, with the information Customer reasonably needs to meet its own obligations.

3.5 Deletion. Teneo deletes Customer Personal Data shortly after delivering Output, except URLs kept in request logs under Section 1.4. On termination, Teneo deletes any remaining Customer Personal Data unless the law requires retention.

3.6 Information and audits. Teneo makes available the information reasonably needed to demonstrate compliance with this DPA. Customer may audit once a year, on 30 days' notice, at its own cost, during business hours, under confidentiality and without access to other customers' data. Teneo may first answer audit requests with documentation or written responses.

4. Sub-processors

4.1 Authorization. Customer authorizes Teneo to use the sub-processors on its current list, which Teneo makes available in the dashboard and on request.

4.2 Changes. Teneo notifies Customer of a new sub-processor at least 10 days in advance by updating that list and by email or dashboard notice. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected Services and receive a refund of prepaid fees for the unused period.

4.3 Flow-down. Teneo binds each sub-processor to data protection obligations no less protective than this DPA and remains responsible for its performance.

4.4 Teneo Network. Teneo relays requests through Network Participants' devices inside encrypted HTTPS connections. The devices cannot read the content of requests or pages. Like any network connection, they handle the destination host name and IP address. Customer authorizes this relay, and Teneo is responsible for it under this DPA as for its own processing.

5. International transfers

5.1 EU transfers. Customer authorizes Teneo to process Customer Personal Data in the countries where Teneo, its staff and its sub-processors operate, subject to this Section 5. Where processing involves a transfer of Customer Personal Data from the EEA to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply and are incorporated by reference: Module 2 where Customer is a controller, and Module 3 where Customer is a processor. Customer is the data exporter and Teneo the data importer. Module 1 applies to personal data in Inputs that Teneo keeps as controller under Section 1.4.

5.2 Elections. For the Standard Contractual Clauses: Clause 7 applies; Clause 9 option 2 applies, with the notice period in Section 4.2; the optional wording in Clause 11 does not apply; Clauses 17 and 18 refer to the law and courts of Ireland; Annexes 1 and 2 of this DPA complete Annexes I and II; and the competent supervisory authority is determined under Clause 13. For Annex I.A, the data exporter is Customer, with the contact details in its account, and the data importer is Teneo Labs Inc., [email protected]. Accepting the Terms counts as signing the Clauses.

5.3 UK and Switzerland. For transfers from the UK, the UK International Data Transfer Addendum to the Standard Contractual Clauses applies, with its tables completed from this DPA; in Table 4, either party may end it as its Section 19 allows. For transfers from Switzerland, references to the GDPR include the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is a competent authority, and "Member State" in Clause 18(c) includes Switzerland.

6. General

6.1 Term. This DPA lasts as long as Teneo processes Customer Personal Data.

6.2 Liability. Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law or the Standard Contractual Clauses do not allow this.

6.3 Precedence. If this DPA conflicts with the Terms, this DPA prevails on data protection matters. If it conflicts with the Standard Contractual Clauses, the Clauses prevail.

6.4 Notices. Customer sends notices under this DPA to [email protected].

Annex 1: Details of processing

Annex 2: Technical and organizational measures

Teneo maintains at least these measures:

• Encryption in transit (TLS) between customers, Teneo's systems and target websites
• Passwords and API Keys stored only as hashes; access limited to staff who need it
• Logging and monitoring of access and requests, with alerts for abuse
• Separation of customer accounts; no customer identity sent to Network Participants or websites
• Retrieved pages deleted shortly after delivery; URLs in request logs kept for 12 months (Section 1.4)
• Retrieval only of public websites over HTTPS, never of private or local network addresses
• An incident response process that includes customer notification
• Confidentiality obligations for all staff and contractors

Annex 3: Sub-processors

Teneo's current list of sub-processors is available in the dashboard and on request at [email protected].

Stripe processes billing data for Teneo and receives no Customer Personal Data.