Data Processing Addendum

This Data Processing Addendum (the "DPA") forms part of the Statement of Work Terms of Business (the "Terms") and any Statement of Work between Z7 Solutions LLC and the Client, and applies whenever Z7 processes Personal Data on Client's behalf in providing the Services. As Section 2.2 of the Terms provides, this DPA controls over the body of the Terms and the SOW with respect to Personal Data, and a Business Associate Agreement controls over this DPA for Protected Health Information.

1.1 "Applicable Data Protection Laws" means the data protection and privacy laws that apply to the processing, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (CCPA), and the other US state consumer privacy laws that require contract terms between a controller and a processor, such as those of Virginia, Colorado, Connecticut, and Texas.

1.2 "Personal Data," "Processing," "Controller," "Processor," "Data Subject," and "Personal Data Breach" have the meanings given in Applicable Data Protection Laws. For US laws, "Business," "Service Provider," and "Sell" and "Share" have their statutory meanings.

1.3 "Client Personal Data" means Personal Data that Z7 processes on Client's behalf under the Services.

1.4 "Subprocessor" means a third party engaged by Z7 to process Client Personal Data.

1.5 "Standard Contractual Clauses" means the EU Standard Contractual Clauses approved under Commission Implementing Decision (EU) 2021/914, with the UK International Data Transfer Addendum and the Swiss adaptations as applicable.

1.6 "Client-Contracted Provider" means the provider of a Third-Party Product, such as Microsoft or Google, with which Client has its own agreement, including an agreement Client accepts when Z7 resells the product (such as the Microsoft Customer Agreement), and which processes Personal Data under that agreement. A Client-Contracted Provider is not a Subprocessor, and Z7 is not responsible for its processing.

2.1 As between the parties, Client is the Controller (or Business), and Z7 is the Processor (or Service Provider), of Client Personal Data. Where Client is itself a processor acting for a third-party controller, Z7 acts as a subprocessor and Client's instructions reflect that controller's instructions.

2.2 Each party will comply with its obligations under Applicable Data Protection Laws.

2.3 Client is responsible for the lawfulness of the Personal Data it provides and of its instructions, including giving required notices and obtaining required consents and authorizations, and represents that Z7's processing under Client's instructions will not violate Applicable Data Protection Laws.

2.4 Z7 acts as an independent controller (or business) for the personal data it collects to manage the relationship, such as the contact, billing, and support-account data of Client personnel, and for the operation and security of its own systems, as described in its Privacy Policy. This DPA does not apply to that data.

The subject matter, duration, nature, and purpose of the processing, the types of Personal Data, and the categories of Data Subjects are described in the applicable Statement of Work and in Annex 1. Processing continues for the term of the Services and as needed for return or deletion under Section 11.

4.1 Z7 will process Client Personal Data only on Client's documented instructions, including with regard to transfers of Personal Data to a third country or an international organization, unless required to do so by law, in which case Z7 will inform Client of that legal requirement before processing unless the law prohibits it. Client's documented instructions are the Statement of Work, this DPA, and Client's configuration and use of the Services; an instruction outside that scope is out-of-scope work under Section 4.2 of the Terms.

4.2 Z7 will ensure persons authorized to process Client Personal Data are bound by confidentiality.

4.3 With respect to Personal Data subject to the CCPA, Z7 acts as a Service Provider and processes Client Personal Data solely for the limited and specified business purposes listed in Annex 1 and the SOW, and Client discloses Client Personal Data to Z7 only for those purposes. Z7 will not: (a) sell or share Client Personal Data; (b) retain, use, or disclose it for any purpose other than those business purposes, including for a commercial purpose other than the Services; (c) retain, use, or disclose it outside the direct business relationship between the parties; or (d) combine it with personal data Z7 receives from another source or collects from its own interaction with the consumer, except as the CCPA permits to perform a business purpose. Z7 will comply with the obligations that apply to it under the CCPA and will provide the same level of privacy protection the CCPA requires of businesses. Z7 certifies that it understands and will comply with these restrictions. Client may take reasonable and appropriate steps to ensure Z7 uses Client Personal Data consistent with Client's CCPA obligations, and, on notice, to stop and remediate unauthorized use. Z7 will impose these restrictions on any Subprocessor by written contract.

4.4 Z7 will promptly notify Client if Z7 determines it can no longer meet its obligations under Applicable Data Protection Laws.

4.5 Z7 will inform Client without undue delay if, in Z7's opinion, an instruction from Client infringes Applicable Data Protection Laws, and may suspend performance of the affected instruction, without liability, until Client confirms or withdraws it.

4A.1 Z7 will not use Client Personal Data to train, fine-tune, or improve any artificial-intelligence or machine-learning model, except (a) a model used solely to provide the Services to Client and not exposed to other clients, or (b) where the SOW expressly permits it, data Z7 has de-identified or anonymized so it is no longer reasonably capable of being associated with a data subject, which Z7 will not attempt to re-identify. De-identification is to a standard consistent with the CCPA, and anonymization for EEA and UK data is to the GDPR Recital 26 standard. This Section is consistent with Section 4.8 of the Terms.

4A.2 Z7 will not submit Client Personal Data to a third-party AI or large-language-model provider unless that provider is engaged as a Subprocessor under Section 6 and is contractually prohibited from training on, retaining beyond the processing purpose, or further disclosing Client Personal Data. Prompts, inputs, and outputs containing Client Personal Data are Client Personal Data under this DPA.

4A.3 Z7 will not carry out solely automated decision-making producing legal or similarly significant effects on a data subject using Client Personal Data, and will assist Client with the human-review and information rights such processing requires.

Z7 will implement and maintain appropriate technical and organizational measures designed to protect Client Personal Data against a Personal Data Breach, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. Z7's measures are aligned to recognized frameworks including NIST SP 800-171 and ISO/IEC 27001 and are summarized in Annex 2.

6.1 Client provides general written authorization for Z7 to engage Subprocessors. Z7 maintains a current list of Subprocessors (Annex 3) and will give Client at least 30 days prior written notice, by email to Client's notice contact, before authorizing a new Subprocessor to process Client Personal Data. Client may object on reasonable, documented data-protection grounds within that period. If the parties cannot resolve the objection, Client may, as its sole remedy, suspend or terminate the affected portion of the Services without early-termination fee and without liability for the terminated portion. Z7 may replace a Subprocessor on shorter notice where needed to address a security risk or an unplanned loss of service, and will then notify Client as soon as practicable, with the same right to object.

6.2 Z7 will engage each Subprocessor under a written contract imposing data-protection obligations no less protective than those in this DPA, including the relevant Standard Contractual Clauses where the Subprocessor is outside an adequate country. Z7 remains fully liable to Client for the acts and omissions of its Subprocessors to the same extent as if performed by Z7.

7.1 Taking into account the nature of the processing, Z7 will assist Client by appropriate technical and organizational measures, insofar as possible, in responding to Data Subject requests to exercise rights under Applicable Data Protection Laws.

7.2 Z7 will assist Client in ensuring compliance with security, breach-notification, data-protection-impact-assessment, and prior-consultation obligations, and with the data protection assessments, risk assessments, and cybersecurity audits that Applicable Data Protection Laws require of Client, taking into account the nature of the processing and the information available to Z7.

Z7 will notify Client without undue delay after Z7 confirms a Personal Data Breach affecting Client Personal Data, and will use commercially reasonable efforts to provide initial notice within 72 hours of confirmation, providing the information reasonably available about the breach, its likely consequences, and the measures taken or proposed, and supplementing it in phases as more information becomes available. Z7 confirms a Personal Data Breach when it has a reasonable degree of certainty that a security incident has compromised Client Personal Data, which for data subject to the GDPR is when Z7 becomes aware of the breach. A reasonable delay required to investigate and confirm a breach is not a breach of this Section. Where a law that applies to Z7 as a processor or third-party agent sets a fixed deadline (for example, section 501.171(6), Florida Statutes), Z7 will meet it. Client decides whether and how to notify supervisory authorities, regulators, and data subjects, and Z7 will not notify them on Client's behalf unless Client instructs it to or the law requires Z7 to. Z7's notice of, or response to, a Personal Data Breach is not an acknowledgment of fault or liability. Section 9.5 of the Terms on breach-related costs applies.

9.1 Where Z7 processes Client Personal Data originating in the EEA, the UK, or Switzerland and transfers it to, or accesses it from, a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated into this DPA and apply as Module Two (Controller to Processor) where Client is a controller, and Module Three (Processor to Processor) where Client acts as a processor for a third-party controller.

9.2 For the purposes of the Clauses: Client is the data exporter and Z7 the data importer; the docking clause (Clause 7) applies; in Clause 9, Option 2 (general written authorization) applies with the notice period in Section 6.1; the Clause 11 optional independent-dispute-resolution body does not apply; the governing law (Clause 17) and forum (Clause 18) are those of the Member State of the data exporter, or the Republic of Ireland where the exporter is not EEA-established. Annex I and Annex II of the Clauses are populated by Annex 1 and Annex 2 of this DPA, and the competent supervisory authority is that of the exporter, or the Irish Data Protection Commission.

9.3 For UK transfers, the UK International Data Transfer Addendum (version B1.0) is incorporated with the EU Clauses as its underlying clauses, populated by this DPA's Annexes. For Swiss transfers, the Clauses apply with the adaptations of the Swiss Federal Data Protection and Information Commissioner, including that the FDPIC is the competent authority and that references to the GDPR are read as references to the Swiss FADP.

9.4 Where Z7 engages a Subprocessor outside an adequate country, Z7 will put the relevant Clauses, or the UK or Swiss equivalent, in place with that Subprocessor. To the extent legally permitted, Z7 will notify Client of any binding government request for Client Personal Data, will challenge requests it considers unlawful, and will provide the transparency information described in Clause 15 of the Clauses.

Z7 will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, first through written security questionnaires and Z7's then-current third-party audit or assessment reports, on reasonable advance notice and at Client's expense, consistent with Section 9.3 of the Terms and the legally mandated access of a regulator. Where Applicable Data Protection Laws or the Standard Contractual Clauses require it and that information is not sufficient to demonstrate compliance, Client or an independent auditor it mandates, bound by confidentiality, may conduct an inspection of the processing no more than once in any 12 months, on at least 30 days notice, during business hours, without access to other clients' data, and in a manner that does not compromise Z7's security. Where a US state law allows it, Z7 may instead arrange for a qualified, independent assessor to assess its processing under an appropriate framework and provide the report to Client on request.

On termination of the Services, Z7 will, at Client's choice, return or delete Client Personal Data within 30 days of Client's request, consistent with Section 8.2 of the Terms, and delete existing copies, except where retention is required by law or by routine backup, in which case the data remains protected under this DPA until purged within the normal backup rotation not to exceed 90 days. On request, Z7 will provide written certification of deletion.

Where the Services involve Protected Health Information under HIPAA, the parties will execute a Business Associate Agreement before Z7 is given access to it, as Section C.1 of Schedule C of the Terms provides, and that agreement governs that data and controls over this DPA to the extent of any conflict.

This DPA is subject to the limitation of liability in the Statement of Work Terms of Business, except to the extent the Standard Contractual Clauses or Applicable Data Protection Laws do not permit liability to a data subject to be limited. This DPA controls over the body of the Terms with respect to the processing of Personal Data. The Standard Contractual Clauses control over this DPA with respect to transfers they govern.

Subject matter, duration, nature and purpose of processing, types of Personal Data, and categories of Data Subjects are as set out in the applicable Statement of Work. Absent a more specific description: the nature and purpose is the delivery of the contracted information-technology, cloud, security, and advisory Services; the Personal Data is business-contact and account data of Client's personnel and any end-user data within systems Z7 supports; and the Data Subjects are Client's personnel and authorized users and individuals whose data is held in those systems.

Business purposes (CCPA). Z7 processes Client Personal Data only for the business purposes the SOW selects from the following: managed IT and help desk support; security monitoring, detection, and incident response; vulnerability, risk, and compliance-readiness assessment and advisory work; cloud, identity, device, and license administration; implementation and engineering projects; backup and recovery; and AI services that the SOW describes; together with the related purposes of securing the Services, debugging, and meeting legal obligations, in each case only for Client.

Sensitive data, frequency, and retention. No sensitive or special categories of Personal Data are intended unless the SOW identifies them, for example Protected Health Information under a Business Associate Agreement or education records under Schedule C of the Terms, in which case the safeguards in Annex 2 and the applicable Schedule apply. Processing is continuous for the term of the Services, and Client Personal Data is retained for that term and then returned or deleted under Section 11.

Access control and least privilege; multi-factor authentication for administrative access; encryption in transit and, where applicable, at rest; logging and monitoring; vulnerability and patch management; personnel confidentiality and screening; secure development and change management; incident response; and Subprocessor oversight, aligned to NIST SP 800-171 and ISO/IEC 27001.

The current list of Subprocessors is available to Client on request and is updated under Section 6.

Z7 Solutions LLC · 7380 W Sand Lake Rd, Suite 500-110, Orlando, FL 32819 · (844) 974-8669 · z7solutions.com