Data Processing Addendum

1. Parties and scope

This Data Processing Addendum ("DPA") is between the customer that has accepted the Terms of Service ("Customer" or "you") and PILOTLAB LLC, a Wyoming limited liability company ("PILOTLAB LLC", "we" or "us"), which provides PilotLedger.

This DPA applies to personal data contained in Customer Data that we process on your behalf in providing the Service ("Customer Personal Data"). It does not apply to personal data we process as an independent controller for our own purposes, such as account administration, billing, security and marketing to you; that processing is described in our Privacy Policy.

Capitalized terms not defined in this DPA have the meaning given in the Terms of Service.

2. Definitions

• "Data Protection Laws" means all laws relating to the processing of personal data that apply to a party's processing of Customer Personal Data, which may include the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as retained in UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), each as amended or replaced.
• "controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the GDPR, and "business", "service provider", "sell" and "share" have the meanings given in the CCPA.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by us or our Subprocessors.
• "Subprocessor" means any third party we engage to process Customer Personal Data.
• "SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.

3. Roles of the parties

For Customer Personal Data, you are the controller (or a processor acting on behalf of your own controller), and PILOTLAB LLC is your processor. Under the CCPA, you are the business and PILOTLAB LLC is your service provider.

You are responsible for:

• having a lawful basis for the processing you instruct, and for providing any notices and obtaining any consents required by Data Protection Laws, including for emails you send to your customers and vendors through the Service;
• the accuracy and lawfulness of Customer Personal Data and the means by which you obtained it; and
• making sure your instructions to us comply with Data Protection Laws.

If you act as a processor for another controller, you confirm that your instructions and this DPA have been authorized by that controller.

4. Details of processing

5. Processing on documented instructions

We will process Customer Personal Data only on your documented instructions, unless required to do otherwise by law, in which case we will inform you of that legal requirement before processing unless the law prohibits it. Your instructions are set out in the Terms of Service, this DPA, and your configuration and use of the Service (for example, inviting Users, sending invoices or exporting data). Additional instructions require our written agreement.

We will tell you promptly if, in our opinion, an instruction infringes Data Protection Laws. We may then suspend that processing until the instruction is confirmed or changed.

6. Confidentiality of personnel

We will ensure that anyone we authorize to process Customer Personal Data is bound by an appropriate duty of confidentiality, whether contractual or statutory, and has access only to the extent necessary to provide, support or secure the Service.

7. Security

We implement appropriate technical and organizational measures designed to protect Customer Personal Data against Personal Data Breaches, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. Our current measures are described in Annex II and on our Security page.

We may update our security measures over time, provided the overall level of protection is not materially reduced. We do not currently hold third-party security certifications such as SOC 2 or ISO 27001, and nothing in this DPA should be read as claiming them.

You are responsible for the security measures within your control, including User credentials, assigning appropriate roles, removing Users who no longer need access, and the security of your own devices and networks.

8. Subprocessors

General authorization. You give us a general authorization to engage Subprocessors to process Customer Personal Data. Our current Subprocessors are listed in Annex III and on our Subprocessors page.

Our obligations. We will impose on each Subprocessor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, to the extent applicable to the services it provides. We remain responsible to you for the performance of each Subprocessor's obligations.

Notice of changes. If you ask to be notified by emailing support@pilotledger.net, we will notify you by email at least 14 days before we authorize a new Subprocessor to process Customer Personal Data. We will also update the Subprocessors page. In an emergency, such as an urgent replacement needed to keep the Service secure or available, we may give shorter notice and will explain why.

Objection. You may object to a new Subprocessor on reasonable data protection grounds by emailing support@pilotledger.net within the notice period. We will discuss your concerns in good faith and, where possible, offer a reasonable alternative. If we cannot resolve the objection, you may terminate the affected part of the Service by written notice, and we will refund any prepaid fees covering the period after termination on a pro-rata basis.

9. International transfers

Customer Personal Data is hosted in the United States. Our personnel and Subprocessors may access it from other countries where necessary to provide, support and secure the Service.

To the extent that providing the Service involves a transfer of Customer Personal Data from the European Economic Area, the United Kingdom or Switzerland to a country that has not been recognized as providing an adequate level of protection, and no other valid transfer mechanism applies, the following are incorporated into this DPA by reference:

1. EU transfers. The SCCs, Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor. For both: the optional docking clause in Clause 7 applies; Clause 9(a) Option 2 (general written authorization) applies with the notice period in section 8 of this DPA; the optional wording in Clause 11 does not apply; Clauses 17 and 18 are governed by and subject to the courts of Ireland; and Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.
2. UK transfers. The UK Addendum, which amends the SCCs as above. Table 1 is completed with the parties' details in Annex I; Table 2 refers to the SCC modules selected above; Table 3 is completed by Annexes I to III of this DPA; and in Table 4, either party may end the UK Addendum as set out in its Section 19.
3. Swiss transfers. The SCCs as set out above, with references to the GDPR read as references to the FADP, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and "Member State" read to include Switzerland so that data subjects in Switzerland can exercise their rights there.

If there is a conflict between this DPA and the SCCs or UK Addendum, the SCCs or UK Addendum prevail. If a transfer mechanism is invalidated or replaced, the parties will cooperate in good faith to adopt a valid alternative.

10. Assistance with data subject requests and compliance

Data subject requests. The Service lets you access, correct, export and delete most Customer Personal Data yourself. If we receive a request from a data subject relating to Customer Personal Data, we will not respond to it directly (other than to tell the person to contact you, where we can identify you) and will forward it to you without undue delay. Taking into account the nature of the processing, we will provide reasonable assistance to help you respond to requests you cannot fulfil using the Service.

Impact assessments and consultations. We will provide reasonable information and assistance, taking into account the nature of the processing and the information available to us, to help you carry out data protection impact assessments and any prior consultations with supervisory authorities that Data Protection Laws require of you in relation to the Service.

Other requests. If we receive a request from a public authority for Customer Personal Data, we will, unless legally prohibited, notify you and direct the authority to you, and will challenge requests we consider unlawful. We will disclose only the minimum data legally required.

11. Personal Data Breach notification

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach. Our notification will be sent to your account email address and will describe, to the extent then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Where we cannot provide all of this information at once, we will provide it in phases as it becomes available.

We will take reasonable steps to contain, investigate and mitigate the breach, and will provide reasonable cooperation to help you meet your own notification obligations. Our notification is not an acknowledgement of fault or liability.

12. Return and deletion

You can export your Customer Data from the Service at any time while your account is active. When your account is closed:

• we keep Customer Personal Data for 90 days so you can request an export or reactivate the account, and then permanently delete it from our active systems;
• deleted data may persist in encrypted backups for up to 30 further days, after which those backups roll off; and
• we may retain Customer Personal Data where Data Protection Laws or other law require us to, in which case this DPA continues to protect it and we process it only for the purpose of that legal requirement.

If you would like your data deleted sooner, email support@pilotledger.net from your account email address.

13. Audits and information

We will make available to you, on request, the information reasonably necessary to demonstrate our compliance with this DPA, such as a description of our security measures and completed security questionnaires. We will respond to reasonable written questions about our processing.

If that information is not sufficient to demonstrate compliance, or where a supervisory authority requires it, you may audit our compliance with this DPA, either yourself or through an independent auditor bound by confidentiality, subject to these conditions:

• no more than once in any 12-month period, unless required by a supervisory authority or following a Personal Data Breach;
• with at least 30 days' written notice and an agreed scope, timing and duration;
• during normal business hours, without unreasonably disrupting our operations or compromising the security or confidentiality of other customers' data; and
• at your cost, including reimbursement of our reasonable costs of supporting the audit.

Audits of our Subprocessors are carried out by relying on the reports, certifications and documentation they make available. Information obtained in an audit is our Confidential Information.

14. CCPA service provider terms

When we process Customer Personal Data that is "personal information" under the CCPA, we act as your service provider and will:

• not sell or share it;
• not retain, use or disclose it for any purpose other than the business purposes of providing the Service specified in the Terms and this DPA, or as otherwise permitted for service providers under the CCPA;
• not retain, use or disclose it outside our direct business relationship with you;
• not combine it with personal information we receive from or on behalf of anyone else, or that we collect from our own interactions with individuals, except as permitted for service providers under the CCPA;
• comply with the CCPA's applicable obligations and provide the same level of privacy protection the CCPA requires of businesses; and
• notify you if we determine we can no longer meet our obligations under the CCPA.

You may take reasonable and appropriate steps, on notice, to stop and remediate unauthorized use of personal information. We certify that we understand and will comply with these restrictions.

15. Liability

Each party's liability arising out of or relating to this DPA, whether in contract, tort or otherwise, is subject to the exclusions and limitations of liability in the Terms of Service, except to the extent those limitations are not permitted under Data Protection Laws or the SCCs.

16. Term, precedence and changes

This DPA remains in effect for as long as we process Customer Personal Data on your behalf. If there is a conflict, the following order of precedence applies: (1) the SCCs and UK Addendum, where they apply; (2) this DPA, for the processing of personal data; and (3) the Terms of Service.

We may update this DPA where required by changes in Data Protection Laws or to reflect changes to the Service, provided the update does not materially reduce the protection given to Customer Personal Data. We will notify you of material changes in the same way as changes to the Terms of Service.

This DPA is governed by the law that governs the Terms of Service, except where Data Protection Laws or the SCCs require otherwise.

Annex I: Parties and description of processing

Data exporter (controller, or processor where applicable)

Data importer (processor)

Description of processing. The categories of data subjects and personal data, special categories, frequency, nature, purpose and duration of processing are set out in section 4 of this DPA. Retention is described in section 12. Transfers to Subprocessors are for the purposes listed in Annex III.

Competent supervisory authority. Where the Customer is established in an EU Member State, the supervisory authority of that Member State. Where it is not established in the EU but is subject to the GDPR, the supervisory authority of the Member State in which its EU representative is established or, failing that, where the relevant data subjects are located.

Annex II: Technical and organizational measures

The measures below describe how PilotLedger currently protects Customer Personal Data. They are measures we actually use; we do not hold third-party certifications.

Annex III: Subprocessors

The current list is also published on our Subprocessors page, which we keep up to date.

Google Analytics processes website visitor data only after a visitor accepts analytics cookies; it does not receive Customer Data entered into the application.

Contact

Questions about this DPA, requests for a countersigned copy and requests to be notified of new Subprocessors can be sent to support@pilotledger.net, or by post to PILOTLAB LLC, 1309 Coffeen Ave, Ste 1200, Sheridan, WY 82801, United States.