Seldon - Data Processing Addendum

This Data Processing Addendum (“DPA”) is incorporated into and forms part of the Agreement between Blok Intelligence Inc. t/a Seldon, a Delaware corporation (“Processor” / “Service Provider”) and the Customer entity identified in the applicable Order Form (“Controller” / “Business”).

Capitalized terms not defined here have the meanings given in the Agreement.

This DPA applies where Seldon processes Personal Data on behalf of Customer in connection with the provision of the Services under the Agreement, including behavioral simulation, software validation, software quality assurance, automated testing, browser automation, AI-assisted analysis, and related services.

“Personal Data” means any information relating to an identified or identifiable natural person that the Customer submits to the Services, and forms a subset of Customer Data as defined in the Agreement.

“Processing” has the meaning given under applicable Data Protection Law.

“Data Protection Law” means all applicable privacy and data protection laws, including GDPR, UK GDPR, CCPA/CPRA, and any successor legislation.

“GDPR” means Regulation (EU) 2016/679. “UK GDPR” means the GDPR as retained in UK law by the European Union (Withdrawal) Act 2018. “CCPA” means the California Consumer Privacy Act of 2018 (Cal. Civ. Code § 1798.100 et seq.), as amended by the CPRA.

“SCCs” means the Standard Contractual Clauses adopted by the European Commission under Decision 2021/914/EU. “UK IDTA” means the International Data Transfer Addendum issued by the UK Information Commissioner's Office.

“Subprocessor” means any third party engaged by Seldon to process Personal Data under this DPA.

Seldon processes Personal Data solely on behalf of Customer and for Customer's business purposes.

Subject Matter

Provision of the Services, including behavioral simulation, software validation, software quality assurance, automated testing, browser automation, AI-assisted software analysis, repository analysis, and related services.

Duration

For the duration of the Agreement and any applicable retention period described in this DPA.

Nature of Processing

Collection, storage, organization, transmission, analysis, temporary processing, transformation, browser automation, generation of reports, simulations, recommendations, and other Outputs necessary to provide the Services.

Categories of Personal Data

Depending on Customer's use of the Services, Personal Data may include:

• account information;
• user identifiers;
• pseudonymous identifiers;
• session metadata;
• authentication credentials provided by Customer;
• source code, repository contents, and related materials, solely to the extent they contain Personal Data;
• repository metadata;
• documentation;
• browser interaction metadata;
• screenshots;
• prompts;
• URLs;
• communications submitted by Customer; and
• other Customer Data processed in connection with the Services.

Data Subjects

Customer's employees, contractors, end users, representatives, and other individuals whose Personal Data is included within Customer Data.

Purpose

Solely to provide, secure, maintain, support, and improve the Services in accordance with Customer's documented instructions and the Agreement.

Seldon generates synthetic personas, simulations, quality assessments, reports, and other Outputs derived from Customer Data. Such Outputs are generated solely for the purpose of providing the Services and are not intended to identify or represent any specific individual unless Customer Data itself contains such information.

Seldon does not attempt to re-identify individuals from de-identified Personal Data and does not use Customer Personal Data to infer sensitive characteristics beyond Customer's documented instructions.

Seldon shall:

• process Personal Data solely on Customer's documented instructions, including as set out in this DPA and the Agreement, unless required to do so by applicable law (and, where legally permitted, inform Customer of such requirement);
• ensure that personnel authorized to process Personal Data are subject to confidentiality obligations;
• implement and maintain the security measures set out in Section 8;
• assist Customer, taking into account the nature of processing, with the fulfillment of Customer's obligations to respond to Data Subject requests;
• notify Customer of security incidents in accordance with Section 9;
• provide reasonable assistance for breach notification obligations;
• delete or return Personal Data in accordance with Section 11;
• make available information reasonably necessary to demonstrate compliance and cooperate with audits under Section 10;
• not sell or share Personal Data (as defined under the CCPA);
• not retain, use, or disclose Personal Data outside the direct business relationship with Customer or for any commercial purpose other than providing the Services in accordance with the Agreement;
• not combine Personal Data across customers except as permitted by law;
• not use Customer Personal Data to train generalized or foundation AI models made available to other customers or third parties unless expressly authorized in writing by Customer;
• process Customer Personal Data solely as necessary to provide the Services in accordance with Customer's documented instructions and the Agreement.

For clarity, Seldon may use de-identified, aggregated, or synthetic data derived from operation of the Services in accordance with the Agreement, provided such data does not identify Customer or any individual.

Customer instructs Seldon to process Personal Data as necessary to:

• provide, secure, maintain, and support the Services;
• perform Customer-authorized workflows;
• provide software validation, quality assurance, browser automation, repository analysis, and related features;
• comply with Customer's documented instructions; and
• comply with applicable law.

Customer warrants it has a lawful basis for processing and for providing Personal Data to Seldon.

Customer is responsible for determining whether any Personal Data includes special categories or sensitive data and for ensuring appropriate safeguards are implemented.

Authorization

Customer provides general authorization for Seldon to engage Subprocessors.

Subprocessor List

Seldon maintains a current list at: trust.seldon.com

Advance Notice

Seldon shall provide at least 30 days' prior written notice before adding or replacing a Subprocessor. Where the Standard Contractual Clauses apply, this notice period is intended to satisfy Clause 9 (Use of Subprocessors) of the Standard Contractual Clauses.

Objection Right

Customer may object within 14 days with reasonable grounds related to data protection. The parties will cooperate in good faith to resolve the objection.

If unresolved within 30 days, Customer's sole and exclusive remedy is to terminate the affected Services and receive a refund of prepaid, unused fees for those Services.

Flow-Down

Seldon shall:

• impose obligations no less protective than this DPA;
• ensure confidentiality obligations; and
• remain liable for Subprocessor actions.

Seldon maintains administrative, technical, and organizational safeguards designed to protect Personal Data appropriate to the nature of the Services and the risks presented by the Processing.

Such safeguards include, as appropriate:

• logical access controls;
• encryption in transit and at rest;
• authentication and authorization controls;
• secure credential management;
• monitoring and incident response procedures;
• secure software development practices;
• vulnerability management;
• personnel confidentiality obligations; and
• security awareness training.

Where the Services process Customer Data through repositories, third-party integrations, browser automation, or other Customer-authorized workflows, Seldon will use such access solely for the purpose of providing the Services.

Seldon may temporarily process Customer Data within isolated execution environments where reasonably necessary to provide the Services.

Seldon may update these safeguards from time to time provided such updates do not materially reduce the overall security of the Services.

Notification

Seldon will notify Customer without undue delay, and no later than seventy-two (72) hours after becoming aware of a confirmed Security Incident affecting Customer Personal Data, unless a shorter period is required by applicable law.

Contents of Notification

To the extent reasonably available at the time of notification, Seldon will provide:

• the nature of the Security Incident;
• the categories of Personal Data affected;
• the approximate scope of the incident;
• the likely consequences of the incident; and
• the measures taken or proposed to investigate, mitigate, and remediate the incident.

Cooperation

Seldon will provide reasonable cooperation and assistance to Customer in connection with Customer's obligations under applicable Data Protection Law relating to the Security Incident.

No Admission

Notification of a Security Incident under this Section does not constitute an admission of fault or liability by Seldon.

Compliance Information

Upon reasonable written request, Seldon will make available information reasonably necessary to demonstrate compliance with this DPA.

Audits

Where Customer reasonably determines that documentation alone is insufficient to demonstrate compliance, Customer may conduct an audit of Seldon's relevant Processing activities, provided that:

• Customer provides at least thirty (30) days' prior written notice;
• the audit is limited to matters directly relevant to this DPA;
• audits occur no more than once per calendar year unless required by applicable law or following a confirmed Security Incident;
• the auditor is not a competitor of Seldon and is bound by appropriate confidentiality obligations; and
• the audit is conducted in a manner that does not unreasonably interfere with Seldon's operations or compromise the security of other customers.

Confidentiality

All audit materials, findings, and information obtained during an audit constitute Seldon's Confidential Information.

Costs

Customer will bear the costs of any audit unless the audit identifies a material breach of this DPA by Seldon.

Upon termination or expiration of the Agreement, Seldon will delete or return Customer Personal Data in accordance with Customer's written instructions, except where retention is required by applicable law or expressly permitted under the Agreement.

Where Customer Personal Data is stored within third-party systems or infrastructure supporting the Services, deletion may occur through separate operational deletion processes consistent with Seldon's documented retention practices and the Agreement.

Seldon may retain de-identified, aggregated, or anonymized information derived from Personal Data, provided such information does not identify Customer or any individual.

Where Customer Personal Data is transferred outside the jurisdiction in which it was collected, the parties will implement appropriate safeguards as required by applicable Data Protection Law.

For transfers subject to the GDPR, the parties agree that the European Commission's Standard Contractual Clauses (Module Two – Controller to Processor) are incorporated into this DPA.

For the purposes of the Standard Contractual Clauses:

For transfers subject to the UK GDPR, the UK International Data Transfer Addendum applies to the Standard Contractual Clauses.

The parties will implement any additional transfer mechanisms required by applicable Data Protection Law.

Where the CCPA applies, Seldon acts as a Service Provider and agrees that it will:

• process Personal Data solely for the business purposes specified by Customer and the Agreement;
• not sell or share Personal Data;
• not retain, use, or disclose Personal Data except as permitted by the Agreement or applicable law;
• not combine Personal Data across customers except as permitted by applicable law;
• provide reasonable assistance to Customer in responding to consumer rights requests; and
• notify Customer if Seldon determines that it can no longer meet its obligations under the CCPA.

Taking into account the nature of the Processing, Seldon will provide reasonable assistance to Customer in responding to requests from Data Subjects exercising their rights under applicable Data Protection Law.

If Seldon receives a request directly from a Data Subject relating to Customer Personal Data, Seldon will promptly notify Customer unless prohibited by applicable law.

Where required by applicable Data Protection Law, Seldon will provide reasonable information and assistance to Customer in connection with:

• data protection impact assessments;
• prior consultations with supervisory authorities; and
• other regulatory obligations relating to Customer's use of the Services.

In the event of any conflict:

• this DPA prevails with respect to the Processing of Personal Data;
• the Standard Contractual Clauses or UK International Data Transfer Addendum prevail where required by applicable law; and
• the Agreement governs all other matters.

The liability of each party arising out of or relating to this DPA is governed by the limitation of liability provisions contained in the Agreement, except to the extent prohibited by applicable Data Protection Law.

This DPA becomes effective on the Effective Date of the Agreement and remains in effect for so long as Seldon Processes Personal Data on behalf of Customer.

The obligations of this DPA survive termination of the Agreement for so long as Seldon retains Customer Personal Data.

For the purposes of the Standard Contractual Clauses (Module Two – Controller to Processor):