Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between Climate Data Inc., doing business as Terralyn ("Terralyn"), and the customer identified in that agreement ("Customer") governing Customer's use of the Service and any professional services Terralyn performs for Customer under a services agreement or statement of work (the "Services", and that agreement the "Agreement"). It sets out the terms on which Terralyn Processes Customer Personal Data on behalf of Customer, whether Customer's users place that data in the Service themselves or Terralyn receives it from Customer and places it in the Service in performing the Services.

1. Definitions

Capitalized terms used but not defined here have the meaning set out in the Agreement.

The following definitions apply in this DPA:

1. Account Data: Personal Data collected by Terralyn to provide and control access to the Service, including name, email address, hashed password, organization, job title, IP address, and billing identifiers. Account Data is not Customer Personal Data.
2. Appropriate Safeguards: legally enforceable mechanisms for transfers of Personal Data recognized under Data Protection Laws from time to time, including the EU SCCs and the UK Addendum.
3. Customer Data: content that Customer or its users upload to or generate within the Service, and content that Customer provides to Terralyn and that Terralyn uploads to or generates within the Service on Customer's behalf in performing the Services, including Vault documents, prompts and chat inputs, attachments, Memory, Outputs, and Deliverables.
4. Customer Personal Data: Personal Data contained in Customer Data.
5. Controller, Processor, Data Subject, Consumer, Personal Data, Personal Data Breach, Processing, Sale, Share, Service Provider, and Supervisory Authority: have the meanings given to them or similar terms in the Data Protection Laws.
6. Deliverables: reports, disclosures, and other work product Terralyn prepares for Customer under the Services, together with the provenance package that records how they were produced.
7. Data Protection Laws: the EU General Data Protection Regulation 2016/679 ("GDPR"); the UK GDPR and the UK Data Protection Act 2018; the Swiss Federal Act on Data Protection; PIPEDA and Quebec Law 25; the U.S. Privacy Laws; and all other applicable laws relating to the Processing of Personal Data in any relevant jurisdiction, as amended or replaced from time to time.
8. EU SCCs: the standard contractual clauses approved by the European Commission in Decision 2021/914 of 4 June 2021, as amended or updated from time to time.
9. Personnel: Terralyn's employees and the individual contractors who work under Terralyn's direction and control, including sustainability consultants, designers, and copywriters, each bound by written confidentiality and data protection obligations no less protective than those in this DPA. Personnel are not Sub-processors.
10. Sub-processor: a Processor engaged by Terralyn to process Customer Personal Data.
11. UK Addendum: the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner, Version B1.0, in force as of 21 March 2022.
12. U.S. Privacy Laws: all U.S. state privacy laws and their implementing regulations that apply generally to the Processing of Personal Data, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and the comprehensive privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, Indiana, Iowa, Kentucky, Nebraska, Tennessee, Montana, Rhode Island, and other states, as amended or superseded from time to time.

2. Roles and Scope

1. This DPA applies to Terralyn's Processing of Customer Personal Data to provide the Service and perform the Services, where that Processing is subject to Data Protection Laws.
2. For Customer Personal Data, Customer is the Controller (or a Processor acting on behalf of a third-party Controller) and Terralyn is a Processor. Where the CCPA applies, Terralyn acts as a Service Provider to Customer for the limited and specific purposes set out in Annex A.
3. Terralyn is a Controller when it Processes (i) Account Data and (ii) de-identified or aggregated data relating to the operation, support, or use of the Service for its own legitimate business purposes, such as billing, account management, technical support, product development, security, and compliance with laws. Terralyn's Privacy Policy governs that Processing.
4. Customer remains responsible for its own compliance under Data Protection Laws, including providing required notices, obtaining required consents, and the lawfulness of the Processing instructions it gives Terralyn. Customer warrants that it has the right to disclose Customer Personal Data to Terralyn for the purpose of receiving the Service.

3. Terralyn's Obligations as Processor

To the extent Terralyn Processes Customer Personal Data, Terralyn will:

3.1. Process Customer Personal Data only to provide the Service, perform the Services, and otherwise on Customer's documented instructions, which include the Agreement, the applicable statement of work, and Customer's configuration and use of the Service, unless required to do otherwise by applicable law, in which case Terralyn will inform Customer of that legal requirement before Processing unless the law prohibits it;

3.2. not Sell or Share Customer Personal Data; not retain, use, or disclose Customer Personal Data for any purpose other than the specific purposes in Annex A or outside the direct business relationship between the parties; and not combine Customer Personal Data with Personal Data obtained from other sources, except in each case as expressly permitted by applicable Data Protection Laws;

3.3. not use Customer Data, including Customer Personal Data, to train artificial intelligence models, and ensure that its AI model Sub-processors do not use Customer Data for model training and retain it only as needed to provide their services and for security and abuse monitoring, as described in Annex A;

3.4. implement and maintain appropriate technical and organizational measures, as set out in Annex B, to protect Customer Personal Data against unauthorized or unlawful Processing and accidental loss, destruction, damage, theft, or disclosure;

3.5. ensure that Personnel authorized to Process Customer Personal Data are subject to binding confidentiality obligations and are trained on their responsibilities, and remain responsible for the acts and omissions of its Personnel as for its own;

3.6. notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and provide information reasonably available to Terralyn about its nature, the categories and approximate number of Data Subjects and records concerned, likely consequences, and measures taken or proposed;

3.7. taking into account the nature of the Processing, provide reasonable assistance to Customer in responding to Data Subject and Consumer requests, and in meeting Customer's obligations regarding security, breach notification, data protection impact assessments, and prior consultations with Supervisory Authorities (the regulators that enforce Data Protection Laws);

3.8. notify Customer if, in Terralyn's reasonable opinion, a Customer instruction infringes Data Protection Laws;

3.9. maintain records of its Processing activities as required by Data Protection Laws, and on Customer's written request make available information reasonably necessary to demonstrate compliance with this DPA;

3.10. allow for and contribute to audits and inspections, provided that (i) they are conducted by Customer or an independent auditor agreed by the parties and bound by confidentiality; (ii) Customer gives at least thirty (30) days' written notice; (iii) they are limited to documents and facilities relevant to the Processing of Customer Personal Data; and (iv) they are conducted at Customer's cost, during Terralyn's usual business hours, no more than once in any twelve (12) month period, in a manner that causes minimal disruption. Terralyn may first satisfy an audit request by providing a recent third-party security assessment or audit report; and

3.11. promptly notify Customer if it determines it can no longer meet its obligations under Data Protection Laws, and take reasonable steps to stop and remediate any unauthorized use of Customer Personal Data if instructed by Customer.

Assistance under Section 3.7 that exceeds the self-service functionality of the Service may be subject to reasonable costs agreed in good faith between the parties.

4. Data Subject and Consumer Requests

4.1. If Terralyn receives a request from a Data Subject or Consumer relating to Customer Personal Data, Terralyn will notify Customer promptly and will not act on the request without Customer's instruction, except where required by applicable law.

4.2. Terralyn is not required to delete Customer Personal Data in response to a Customer-directed Consumer request where retention is expressly permitted by applicable U.S. Privacy Laws, in which case Terralyn will inform Customer of the exception relied upon and will not use the retained data for any other purpose.

5. No Sale

The parties acknowledge that the exchange of Personal Data between them does not form part of any monetary or other valuable consideration between them.

6. Sub-processors

6.1. Customer provides general written authorization for Terralyn to engage Sub-processors to Process Customer Personal Data. The Sub-processors approved as of the date of the Agreement are listed in Annex A. A third-party company named as a subcontractor in a statement of work or change order signed by Customer is also an approved Sub-processor for that engagement, without further notice under Section 6.2.

6.2. Terralyn will notify Customer by email to the email address associated with Customer's account, or to another contact Customer designates in writing, at least thirty (30) days before appointing a new Sub-processor. Customer may object in writing within fourteen (14) days of notice on reasonable grounds relating to Data Protection Laws. If the parties cannot resolve the objection within a reasonable period, Customer may terminate the affected portion of the Service and receive a pro-rata refund of prepaid fees for the terminated portion.

6.3. Terralyn will enter into a written contract with each Sub-processor imposing data protection obligations no less protective than those in this DPA, and remains liable to Customer for each Sub-processor's performance.

7. International Transfers

7.1. Terralyn Processes Customer Personal Data primarily in the United States. Customer authorizes transfers of Customer Personal Data to the United States and to the locations of the Sub-processors in Annex A, provided Appropriate Safeguards are in place where required.

7.2. Where the transfer of Customer Personal Data from Customer to Terralyn is a restricted transfer under the GDPR, UK GDPR, or Swiss law, the parties are deemed to have entered into (i) the EU SCCs, Module Two (Controller to Processor) or Module Three (Processor to Processor) as applicable, and (ii) the UK Addendum, each incorporated into the Agreement by reference and completed as set out in Annex C.

8. Return and Deletion

8.1. Subject to Section 8.2, during the term of the Agreement and for thirty (30) days after its termination, Terralyn will allow Customer to export Customer Data in a manner consistent with the functionality of the Service. Following that period, Terralyn will delete Customer Personal Data within one hundred eighty (180) days, subject to backup rotation and any retention required by applicable law.

8.2. Where Terralyn performs the Services, this Section 8.2 governs the files Customer provides for the engagement and the resulting Deliverables, in place of Section 8.1. Terralyn delivers Deliverables to Customer through the Service or as agreed in the statement of work. Unless Customer instructs otherwise in writing, Terralyn will delete the raw files Customer provided for the engagement within one hundred eighty (180) days after delivery of the final Deliverable, and will retain the Deliverables and their provenance package for three (3) years after delivery so that Customer has an audit trail, after which they are deleted, in each case subject to backup rotation and any retention required by applicable law. Customer may instruct earlier deletion at any time.

9. Term, Liability, General

9.1. This DPA remains in force for as long as Terralyn Processes Customer Personal Data under the Agreement.

9.2. Liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.

9.3. If a change in Data Protection Laws prevents a party from fulfilling its obligations, the parties will cooperate in good faith to amend this DPA; if compliance cannot be restored within sixty (60) days, either party may terminate the Agreement on thirty (30) days' written notice.

Annex A. Processing Details and Sub-processors

• Subject matter of Processing: Customer Personal Data contained in Customer Data uploaded to, provided for, or generated within the Service.
• Duration: the term of the Agreement plus the export and deletion periods in Section 8.
• Nature and purpose: hosting, storage, retrieval, analysis, and AI-assisted processing of Customer Data to provide the Service and to perform the Services, including collecting and structuring Customer's files, drafting, reviewing, and delivering Deliverables, as configured and instructed by Customer.
• Categories of Data Subjects: Customer's employees, contractors, and authorized users; personnel of Customer's suppliers, customers, and other business contacts whose Personal Data appears in Customer Data.
• Categories of Personal Data: names, business contact details, job titles, identifiers, and any other Personal Data Customer chooses to include in Customer Data (for example, in utility bills, supplier responses, or workforce sustainability metrics).
• Sensitive data: only such sensitive data as Customer chooses to include in Customer Data where its sustainability reporting requires it; Terralyn Processes it solely as Processor under this DPA.

Approved Sub-processors:

Annex B. Security Measures

Terralyn implements and maintains the following technical and organizational measures:

1. Encryption: TLS 1.2+ for data in transit; AES-256 for data at rest.
2. Access controls: role-based access on the principle of least privilege; multi-factor authentication for administrative access; SSO support for customers.
3. Tenant isolation: logical separation of Customer Data between customers.
4. Monitoring and response: security monitoring, logging, and a documented incident response process.
5. Vulnerability management: patching and periodic third-party security assessments.
6. Personnel: written confidentiality obligations and security training for personnel with access to Customer Personal Data.
7. Backups and availability: automated backups and redundancy appropriate to the Service.

Annex C. Cross-Border Transfer Mechanisms

Where Section 7.2 applies, the EU SCCs and UK Addendum are completed as follows:

1. EU SCCs: Module Two (Controller to Processor) applies where Customer is a Controller; Module Three (Processor to Processor) applies where Customer is a Processor. The optional docking clause (Clause 7) does not apply. For Clause 9, Option 2 (general written authorization) applies with the notice period in Section 6.2 of this DPA. The optional language in Clause 11 does not apply. For Clause 17, Option 1 applies and the clauses are governed by Irish law; under Clause 18(b), disputes are resolved before the courts of Ireland.
2. Annex I of the EU SCCs: the data exporter is Customer and the data importer is Terralyn (contact: privacy@terralyn.ai); the description of the transfer is set out in Annex A of this DPA; the frequency is continuous for the duration of the Agreement; the competent supervisory authority is determined under Clause 13.
3. Annex II of the EU SCCs: Annex B of this DPA.
4. UK Addendum: appended to the EU SCCs with the parties' details as above, the transfer description in Annex A, the security measures in Annex B, and the Sub-processor list in Annex A; either party may end the UK Addendum as set out in its Table 4.
5. By entering into the Agreement, each party is deemed to have signed the EU SCCs and UK Addendum, including their annexes, as of the effective date of the Agreement.
6. If there is any conflict between the EU SCCs or UK Addendum and this DPA or the Agreement, the EU SCCs or UK Addendum prevail.