Data Processing Addendum

Kaarvi Data Processing Addendum DATA PROCESSING ADDENDUM Version: 1.0 Effective Date: July 5, 2026 This Data Processing Addendum ("DPA") forms part of, and is incorporated into, the agreement between Kaarvi, Inc. ("Kaarvi," or "we") and the applicable customer entity identified in the Agreement ("Customer” or "you"). This DPA supplements the applicable Terms of Service, master services agreement, subscription agreement, Order Form, statement of work, or other written agreement governing Customer’s use of the Services ("Agreement"). This DPA does not apply to Kaarvi’s Processing of personal data for its own independent business purposes, which is addressed separately in Kaarvi’s Privacy Policy. 1. DEFINITIONS For purposes of this DPA, the following terms have the meanings set forth below. 1.1 "Applicable Privacy Law" means any law, regulation, or binding legal requirement applicable to the Processing of Personal Data under the Agreement or this DPA, including, as applicable, U.S. state privacy laws, European privacy laws, and any implementing, successor, or supplementary privacy or data protection laws. 1.2 "Controller" or “Business” means the entity that, alone or jointly with others, determines the purposes and means of the Processing of Personal Data, or the equivalent concept under Applicable Privacy Law, including “Business” where applicable. 1.3 "Customer Data" means any data, files, records, content, or other information that Customer or its Authorized Users submit, upload, connect, import, transmit, store, query, process, generate, or otherwise make available through the Services. Customer Data includes uploaded files and datasets; data from connected databases, cloud storage, APIs, enterprise applications, and other source systems; working copies; intermediate datasets; cached items; snapshots; backups; saved results; transformation inputs and outputs; query inputs and query results; and metadata, schema information, lineage information, tags, labels, scores, classifications, and similar artifacts to the extent they contain or reflect Personal Data. Customer Data does not include Kaarvi’s own Confidential Information or Usage Data, except to the extent any such artifact contains Personal Data from Customer Data, in which case that Personal Data will be treated as Customer Data for purposes of this DPA. 1.4 "De-identified Data" means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular Consumer, Data Subject, household, device, or individual, provided that such information has been subject to appropriate technical and organizational measures and is maintained and used in accordance with Applicable Privacy Law. 1.5 "Personal Data" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable natural person, household, or device, or that otherwise constitutes “personal data,” “personal information,” or a similar term under Applicable Privacy Law. 1.6 "Process" or "Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including access, collection, receipt, recording, organization, structuring, storage, hosting, adaptation, alteration, retrieval, consultation, use, disclosure, transmission, dissemination, making available, alignment, combination, restriction, deletion, destruction, or any other handling of Personal Data. 1.7 "Processor" or “Service Provider” means an entity that Processes Personal Data on behalf of a Controller, or the equivalent concept under Applicable Privacy Law, including “Service Provider” or “Contractor” where applicable. 1.8 "Security Incident" means any confirmed unauthorized access to, acquisition of, disclosure of, alteration of, loss of, destruction of, or inability to account for Personal Data Processed by Kaarvi on behalf of Customer in connection with the Services, to the extent such event is required to be notified under Applicable Privacy Law or the Agreement. Security Incident does not include unsuccessful attempts or activities that do not compromise the security of Personal Data, such as unsuccessful login attempts, port scans, denial-of-service attempts, or other network attacks that do not result in unauthorized access to Personal Data. 1.9 "Sensitive Data" means Personal Data subject to heightened legal, regulatory, or contractual protections under Applicable Privacy Law, including government identifiers, financial account information, payment card information, precise geolocation, health or medical information, biometric information, children’s data, contents of communications, login credentials, racial or ethnic origin, religious beliefs, union membership, genetic data, sex life, sexual orientation, citizenship or immigration status, and any other category of data treated as sensitive, special category, or similarly protected data under Applicable Privacy Law. 1.10 "Subprocessor" means any third party engaged by or on behalf of Kaarvi to Process Personal Data on behalf of Customer in connection with the provision, operation, maintenance, support, or security of the Services. 1.11 "Sale" means any disclosure, release, transfer, making available, or other communication of Personal Data to a third party for monetary or other valuable consideration, or the equivalent concept under Applicable Privacy Law. 1.12 "Share" means any disclosure, release, transfer, making available, or other communication of Personal Data to a third party for cross-context behavioral advertising or a similar purpose, or the equivalent concept under Applicable Privacy Law. 1.13 "Targeted Advertising" means displaying advertisements to a Consumer where the advertisement is selected based on Personal Data obtained from that Consumer’s activities over time and across nonaffiliated websites, applications, or online services, or the equivalent concept under Applicable Privacy Law. 1.14 "Data Subject" or “Consumer” means an identified or identifiable natural person to whom Personal Data relates, including a “Consumer” where Applicable Privacy Law uses that term. 2. SCOPE AND NATURE OF PROCESSING 2.1 Purpose of Processing. Kaarvi may Process Personal Data contained in Customer Data for the purpose of providing, operating, maintaining, supporting, securing, and troubleshooting the Services on Customer’s behalf and in accordance with Customer’s instructions and configuration. Kaarvi Processes Personal Data solely for the following purposes: to provide and deliver the Services to Customer; to perform Customer-requested and Customer-configured data operations and workflows; to maintain, secure, monitor, troubleshoot, and support the Services; to comply with Applicable Privacy Law and other legal obligations applicable to Kaarvi; and as otherwise permitted by the Agreement and this DPA. 2.2 Processing Details. The nature of Processing activities, the categories of Personal Data, and the categories of Data Subjects are described in Annex 1 to this DPA and are determined by Customer’s own datasets, source systems, configurations, use cases, and instructions. 2.3 Duration of Processing. Kaarvi will Process Personal Data under this DPA for the duration of the applicable Services term and for such additional period as necessary to complete post-termination retrieval, deletion, retention, backup rotation, legal compliance, dispute resolution, and other obligations permitted or required under the Agreement, this DPA, or Applicable Privacy Law. 2.4 Roles of the Parties. As between the parties, Customer acts as the “Controller” or “Business”, as applicable, with respect to Personal Data included in Customer Data that Kaarvi Processes on Customer’s behalf through the Services. Customer determines the purposes for which Customer uses the Services in its business, including what data Customer or its Authorized Users upload, connect, submit, query, transform, analyze, export, or otherwise Process through the Services, and whether such data includes Personal Data, Sensitive Data, or other regulated information. As between the parties, Kaarvi acts as a Processor, Service Provider, or Contractor, as applicable, with respect to Personal Data Processed by Kaarvi on Customer’s behalf in connection with the Services. Kaarvi will Process such Personal Data only on behalf of Customer and in accordance with Customer’s documented instructions, the Agreement, this DPA, and Applicable Privacy Law. 2.5. Regulated Data. Customer may use the Services to Process datasets containing Sensitive Data or other regulated information to the extent permitted by the Agreement, the applicable Order Form, and this DPA. Customer will not use the Services or instruct Kaarvi to Process Personal Data in a manner that would require Kaarvi to assume the role or obligations of a business associate, consumer reporting agency, financial institution, covered entity, or other regulated entity under Applicable Privacy Law, unless Kaarvi has expressly agreed in writing to undertake those obligations through an applicable Regulated Addendum.. If Customer’s use of the Services involves the Processing of protected health information as defined under the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations, Customer will not submit, connect, or Process such information through the Services unless and until the parties have executed a Business Associate Agreement that governs Kaarvi’s handling of such information. In the event of a conflict between the BAA and this DPA with respect to protected health information, the BAA will control. 2.6. Confidentiality. Kaarvi will ensure that any personnel, contractors, agents, or other persons authorized to Process Personal Data on Kaarvi’s behalf are bound by written confidentiality obligations, and will limit access to Personal Data to those persons and Subprocessors who have a legitimate need to know for the purposes permitted under the Agreement and this DPA. 3. CUSTOMER INSTRUCTIONS 3.1 Documented Instructions. Kaarvi will Process Personal Data only on Customer’s documented instructions. Customer’s documented instructions for purposes of this DPA include: the Agreement, including the applicable Terms of Service, master services agreement, subscription agreement, Order Form, statement of work, and this DPA; Customer’s and its Authorized Users’ use of the Services in accordance with the Agreement, including instructions communicated through account settings, administrative controls, permissions, configuration choices, and feature enablement decisions; product configurations, workflow settings, monitoring settings, retention settings, access settings, integration settings, automation settings, and other controls configured by or on behalf of Customer through the Services; API calls, queries, prompts, uploads, imports, exports, transformations, execution requests, approvals, scheduling actions, and other commands submitted by or on behalf of Customer or its Authorized Users through the Services; user-configured workflows, pipeline schedules, job schedules, recurring tasks, monitoring rules, alerting configurations, orchestration settings, and other automated or scheduled Processing configured by or on behalf of Customer through the Services; and written requests, tickets, implementation instructions, support requests, remediation requests, migration requests, or other documented communications submitted by Customer to Kaarvi in connection with the Services. 3.2 Customer Responsibilities. Customer is solely responsible for: determining the lawfulness, purpose, and appropriateness of its use of the Services, including whether and how to use the Services with Personal Data or Sensitive Data; providing all notices and obtaining all rights, permissions, consents, and other lawful bases required for Kaarvi to Process Personal Data on Customer’s behalf, and ensuring that Customer’s instructions to Kaarvi comply with Applicable Privacy Law; the legality, accuracy, quality, integrity, and appropriateness of all Customer Data submitted to, connected to, or Processed through the Services; determining whether Customer Data includes Sensitive Data or other regulated, restricted, or high-risk information, and ensuring that Customer’s use of the Services with such data complies with Applicable Privacy Law; independently reviewing, testing, validating, and approving all Output generated by the Services, including AI-assisted classifications, remediation suggestions, generated SQL, code execution results, transformations, forecasts, summaries, synthetic data, and reports, before relying on or using such Output for any consequential purpose; implementing and maintaining appropriate internal governance, review, approval, and human oversight procedures for Customer’s use of the Services, including with respect to automated workflows, scheduled Processing, permissions assigned to Authorized Users, use of AI Features, and reliance on Output in sensitive or regulated contexts; and reviewing and managing the product settings and controls through which automated Processing is enabled, modified, or disabled. 3.3 Instruction Changes. If Customer requires changes to its documented instructions, Customer may make such changes through the Services where self-service controls are available or by providing updated written instructions to Kaarvi through agreed support or account channels. Kaarvi may charge reasonable fees or require changes to the applicable Order Form where compliance with revised instructions requires material additional work, functionality, or cost beyond the Services as contracted. 3.4 Unlawful Instructions. If Kaarvi reasonably determines that an instruction violates Applicable Privacy Law, Kaarvi may, to the extent permitted by Applicable Privacy Law, notify Customer and suspend the affected Processing until the issue is resolved. 4. SECURITY 4.1 Security Measures. Kaarvi will implement and maintain reasonable and appropriate administrative, technical, and organizational measures as described in Annex 2 to this DPA. Kaarvi may update or modify its security measures from time to time, provided that such updates or modifications do not materially reduce the overall security of the Services. 4.2 Security Incident Notification. If Kaarvi becomes aware of a confirmed Security Incident involving Personal Data Processed by Kaarvi on behalf of Customer, Kaarvi will notify Customer without undue delay after becoming aware of the Security Incident. To the extent known at the time of notification, Kaarvi will provide Customer with reasonably available information concerning: the nature of the Security Incident; the categories of affected Personal Data, if known; the categories and approximate number of affected Data Subjects, if known; the measures taken or proposed to be taken by Kaarvi to investigate, contain, mitigate, remediate, and recover from the Security Incident; and any material updates or additional information that becomes available and that Kaarvi reasonably determines Customer may need in order to assess the Security Incident and comply with Applicable Privacy Law. 4.3 No Admission. Kaarvi’s notification of, or response to, a Security Incident under this Section does not constitute an admission of fault, liability, or breach of the Agreement or this DPA. Customer is solely responsible for determining whether notice to any regulator, governmental authority, affected individual, or other third party is required under Applicable Privacy Law, unless Applicable Privacy Law expressly requires Kaarvi to provide such notice directly. 5. ASSISTANCE WITH REQUESTS 5.1 Assistance Obligation. Kaarvi will provide Customer with reasonable assistance to enable Customer to respond to requests from Data Subjects or Consumers exercising rights under Applicable Privacy Law, including rights of access, rectification, correction, deletion, erasure, portability, restriction, objection, opt-out of Sale, opt-out of Sharing, and similar rights. 5.2 Notification of Requests. If Kaarvi receives a request from a Data Subject or Consumer relating to Personal Data Processed on Customer’s behalf, Kaarvi will promptly notify Customer, unless Applicable Privacy Law prohibits such notification, and will not respond to the request directly except to redirect the requestor to Customer, unless otherwise instructed by Customer or required by Applicable Privacy Law. 5.3 Scope of Assistance. Customer acknowledges that Kaarvi’s ability to assist with Data Subject requests may be limited by the nature of the Services, the types of Personal Data Processed, and the information reasonably available to Kaarvi. Kaarvi will not be required to take any action that is technically infeasible, disproportionately burdensome, inconsistent with Customer’s instructions, or that would compromise the security or availability of the Services or the Personal Data of other customers. To the extent the Services include functionality that enables Customer to access, correct, delete, export, or otherwise manage Personal Data, Customer will use such functionality as the primary means of fulfilling Data Subject requests before requesting additional manual assistance from Kaarvi. 6. ASSISTANCE WITH COMPLIANCE 6.1 Privacy Impact Assessments. Kaarvi will provide Customer with reasonable assistance in connection with data protection impact assessments, privacy impact assessments, or similar assessments required under Applicable Privacy Law to the extent such assessments relate to Kaarvi’s Processing of Personal Data on Customer’s behalf. Such assistance may include providing information about Kaarvi’s Processing activities, security measures, subprocessor arrangements, and technical and organizational controls, to the extent reasonably available and relevant to the assessment. 6.2 Regulatory Investigations. Kaarvi will use commercially reasonable efforts to provide Customer with reasonable cooperation in connection with any investigation, inquiry, or consultation by a data protection authority or other governmental authority to the extent such investigation relates to Kaarvi’s Processing of Personal Data on Customer’s behalf. Kaarvi will notify Customer promptly if Kaarvi receives any communication from a governmental authority directly relating to Personal Data Processed on Customer’s behalf, unless Applicable Privacy Law prohibits such notification. 6.3 Breach Investigations. Kaarvi will provide Customer with reasonable assistance in investigating any confirmed or suspected Security Incident, including providing reasonably available information and cooperation necessary for Customer to assess the incident, determine applicable notification obligations, and comply with breach-notification requirements under Applicable Privacy Law. 7. SUBPROCESSORS 7.1 Authorization. Customer provides Kaarvi with general written authorization to engage Subprocessors to Process Personal Data on Customer’s behalf in connection with the provision, operation, maintenance, support, and security of the Services, subject to the requirements of this Section 7. Kaarvi will maintain a current list of Subprocessors, which will be made available [a]in Annex 3. The Subprocessor list will identify the name of each Subprocessor, the country or region in which Processing occurs, and a description of the Processing activities performed. 7.2 Notice of Changes. Kaarvi will provide Customer with not less than thirty (30) days’ prior written notice before engaging a new Subprocessor or materially changing the Processing activities of an existing Subprocessor. Such notice may be provided through email, the Services, the Documentation, or another reasonable notification mechanism. If Customer reasonably objects to a new or changed Subprocessor on legitimate data-protection grounds, Customer will notify Kaarvi in writing within fifteen (15) days after receiving the notice. Upon receipt of a timely objection, Kaarvi may use commercially reasonable efforts to make available a commercially reasonable alternative to avoid the objected-to Processing or to address Customer’s concerns. If Kaarvi cannot make available such an alternative within thirty (30) days after Customer’s notice, Customer may, as its sole and exclusive remedy, terminate the affected Order Form or the portion of the Services that requires the use of the objected-to Subprocessor upon written notice to Kaarvi, in which case Kaarvi will refund any prepaid fees covering the terminated portion of the then-current subscription term for the affected Services. 7.3 Subprocessor Obligations. Kaarvi will enter into a written agreement with each Subprocessor that imposes data-protection obligations materially protective and appropriate to the nature of the Processing performed by such Subprocessor. Each such agreement will require the Subprocessor to Process Personal Data only for the purposes permitted under this DPA and the Agreement, to implement appropriate security measures, and to comply with applicable confidentiality obligations. 7.4 Liability for Subprocessors. Kaarvi will remain responsible for the acts and omissions of its Subprocessors to the same extent Kaarvi would be responsible if performing the Processing directly, subject to the limitations of liability set forth in the Agreement. 8. EXTERNAL LLM PROCESSING 8.1 Third-Party Model Providers. Certain AI-assisted features of the Services may require the transmission of limited portions of Customer Data to third-party AI or large language model providers in order to deliver the functionality requested or enabled by Customer. Such transmissions may include schema information, metadata, query text, natural-language prompts, contextual information, and, where required by the feature invoked by Customer, limited portions of data values or query results. Kaarvi will transmit such information only to the extent reasonably necessary to perform the Customer-requested functionality, whereby such third-party AI or large language model providers shall be treated as sub-processors . 8.2 No Model Training. With respect to third-party AI or model providers engaged as Subprocessors, Kaarvi will use commercially reasonable efforts to ensure that such providers do not use Customer Data to train their own generalized models, through contractual restrictions, configuration settings, or other available mechanisms. Customer acknowledges that the specific controls and commitments available may vary by provider and may depend on the provider’s terms of service, API configurations, and data-handling practices in effect at the time of Processing. 8.3 Customer Control. Customer is responsible for determining whether to enable or use AI-assisted features that involve the transmission of Customer Data to third-party model providers. Customer may disable or restrict such features through the Services to the extent such controls are made available. Customer’s enablement or use of AI-assisted features constitutes Customer’s instruction to Kaarvi to transmit the necessary data to the applicable providers as described in this Section 8. 9. NO SALE, NO SECONDARY USE 9.1 No Sale. Kaarvi will not Sell Personal Data Processed on behalf of Customer. Kaarvi will not disclose, release, transfer, make available, or otherwise communicate Personal Data to any third party for monetary or other valuable consideration in a manner that constitutes a Sale under Applicable Privacy Law. 9.2 No Sharing. Kaarvi will not Share Personal Data Processed on behalf of Customer for cross-context behavioral advertising or Targeted Advertising. Kaarvi will not disclose Personal Data to any third party for the purpose of displaying advertisements to Data Subjects based on their activities across nonaffiliated websites, applications, or online services. 9.3 No Secondary Use. Kaarvi will not retain, use, or disclose Personal Data Processed on behalf of Customer for any purpose other than the purposes specified in the Agreement and this DPA, or as otherwise permitted by Applicable Privacy Law. Kaarvi will not retain, use, or disclose Personal Data outside of the direct business relationship between Kaarvi and Customer except as expressly permitted by Applicable Privacy Law. 10. DE-IDENTIFIED AND AGGREGATED DATA 10.1 Generation of De-identified Data. Kaarvi may generate and use De-identified Data or aggregated information derived from Usage Data and, solely to the extent expressly permitted by Applicable Privacy Law, from Customer Data, provided that such information does not identify Customer, any Authorized User, or any individual, does not reveal Customer Data, and is subject to measures designed to prevent re-identification. 10.2 Permitted Uses. Kaarvi may use De-identified Data and aggregated information for operating, securing, maintaining, and improving the functionality, reliability, and security of the Services, and for generating internal analytics and service insights, in each case in a manner that does not identify Customer or any individual, does not reveal Customer Data, and is not used to train, fine-tune, or improve generalized or shared artificial intelligence models. All such use is subject to Applicable Privacy Law. 10.3 Safeguards. Kaarvi will implement and maintain appropriate technical and organizational measures to prevent the re-identification of De-identified Data, will not attempt to re-identify such data, and will contractually require any recipient of De-identified Data to refrain from re-identification, in each case as required by Applicable Privacy Law. 11. AUDIT RIGHTS Upon Customer’s written request, no more than once per calendar year unless required by Applicable Privacy Law or triggered by a confirmed material Security Incident affecting Customer Personal Data, Kaarvi will make available to Customer information reasonably necessary to demonstrate Kaarvi’s compliance with its obligations under this DPA, to the extent such information is within Kaarvi’s possession or control and can be provided without compromising the security of the Services, the confidentiality of other customers’ data, or Kaarvi’s proprietary information. Such information may include security documentation, summaries of audit reports, certifications, attestations, or comparable materials, subject to reasonable confidentiality protections. Kaarvi will contribute to audits and inspections conducted by Customer or Customer’s authorized representative by providing reasonable access to relevant information, systems, records, and personnel, subject to the conditions set forth in this Section 11. 12. INTERNATIONAL TRANSFERS 12.1 Processing Locations. Kaarvi operates as a cloud-based platform and may Process Personal Data in the United States and in other jurisdictions where Kaarvi, its Affiliates, Subprocessors, or infrastructure providers operate or maintain facilities. Personal Data may be transferred to, stored in, or accessed from jurisdictions outside of the Data Subject’s country of residence where necessary to provide, operate, maintain, secure, and support the Services. 12.2 Transfer Safeguards. Where the transfer of Personal Data to a jurisdiction outside of the Data Subject’s country of residence is subject to transfer restrictions under Applicable Privacy Law, the parties will implement appropriate safeguards as required by such law. Such safeguards may include the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, the Swiss Federal Data Protection Act transfer mechanisms, or other legally recognized transfer mechanisms, as applicable. Where Standard Contractual Clauses or equivalent instruments are required, they will be deemed incorporated into this DPA by reference and will apply to the relevant transfers. 12.3 Supplementary Measures. Where required by Applicable Privacy Law or by a data protection authority, Kaarvi will cooperate with Customer to implement supplementary measures designed to ensure that Personal Data transferred internationally receives an essentially equivalent level of protection. Kaarvi will provide Customer with information reasonably necessary to conduct a transfer impact assessment upon Customer’s written request. 12.4 Geographic Scope. The locations in which Personal Data is Processed may depend on factors such as Customer’s configuration of the Services, the geographic location of Customer’s infrastructure, and the use of third-party providers. Kaarvi does not limit Processing to a single geographic region unless expressly agreed in writing in the applicable Order Form or a separate written addendum. 13. RETURN AND DELETION 13.1 Post-Termination Retrieval. Upon expiration or termination of the Agreement or the applicable Order Form, Customer will have the period specified in the Agreement (or, if no period is specified, thirty (30) days following the effective date of expiration or termination) to retrieve Personal Data and Output through the Services’ export functionality or, where self-service export is not available, by submitting a written request to Kaarvi’s support team, subject to Customer’s payment of all amounts due and compliance with the Agreement. 13.2 Deletion. Following expiration of the retrieval period set forth in Section 13.1, Kaarvi will initiate removal processes for Personal Data in accordance with Kaarvi’s standard operational procedures, the Agreement, and this DPA. Kaarvi will use commercially reasonable efforts to complete initial removal of Personal Data from active production systems within sixty (60) days following expiration of the retrieval period. Removal may include logical deletion, anonymization, archival, or physical deletion, and the method and timing of removal will be determined by Kaarvi’s standard operational procedures. 13.3 Customer Deletion Requests. During the term or during the retrieval period, Customer may submit a written request to Kaarvi to delete specific Personal Data or to delete all Personal Data associated with Customer’s account. Kaarvi will acknowledge receipt of such request within five (5) business days and will use commercially reasonable efforts to complete the requested deletion in accordance with Kaarvi’s standard operational procedures, this DPA, and Applicable Privacy Law. Kaarvi will confirm completion of the deletion to Customer in writing. 13.4 Permitted Retention. Notwithstanding Sections 13.2 and 13.3, Kaarvi may retain Personal Data for a limited period following expiration, termination, or a deletion request to the extent reasonably necessary for: backup and disaster recovery processes, provided that backup copies will be deleted or overwritten in the ordinary course of backup rotation and in no event later than sixty (60) days following deletion from active production systems, unless otherwise required by Applicable Privacy Law; security, logging, monitoring, audit, and fraud-prevention purposes, provided that such retained data will be deleted or anonymized within one hundred and eighty (180) days following expiration or termination, unless a longer period is required by Applicable Privacy Law; compliance with Applicable Privacy Law, legal process, regulatory inquiry, or internal recordkeeping requirements; enforcement of the Agreement or this DPA; and completion of standard archival, purge, and deletion workflows. 13.5 Protection of Retained Data. Kaarvi will continue to protect any retained Personal Data in accordance with this DPA and, where applicable, the Agreement, and will not Process retained Personal Data for any purpose other than those permitted under Section 13.4. 13.6 Multiple Forms. Customer acknowledges that Personal Data may exist in multiple forms within the Services, including active datasets, working copies, snapshots, cached items, soft-deleted records, indexes, metadata, lineage records, logs, and backups, and that removal may not occur immediately or simultaneously across all systems and media. Annex 1 - Processing Details Subject Matter of Processing. Kaarvi’s Processing of Personal Data on behalf of Customer in connection with the provision of data governance, data quality, remediation, transformation, monitoring, lineage, analytics, and AI-assisted data operations services as described in the Agreement and this DPA. Duration of Processing. The duration of the applicable Services term, plus any post-termination retrieval, deletion, retention, backup rotation, legal compliance, and dispute resolution periods as described in the Agreement and this DPA. Nature and Purpose of Processing. Providing, operating, maintaining, supporting, securing, and troubleshooting the Services, and improving the Services only to the extent such improvement does not involve use of Customer Personal Data for independent purposes. Processing activities may include data ingestion, connectivity, and synchronization; hosting, storage, caching, and indexing; data profiling, quality analysis, scoring, and anomaly detection; data classification, tagging, and categorization; data cleaning, transformation, remediation, enrichment, and masking; query generation, SQL execution, Python execution, and workflow logic; lineage discovery, dependency analysis, and observability; analytics, reporting, forecasting, and documentation generation; synthetic data generation; AI-assisted analysis and natural-language querying; pipeline scheduling, monitoring, and orchestration; and data export, deletion, archival, and lifecycle management, as further described in Sections 3 and 4 of this DPA. Categories of Personal Data. The categories of Personal Data Processed by Kaarvi under this DPA depend on the nature of the Customer Data that Customer or its Authorized Users make available through the Services. Categories may include, without limitation: identification data, such as names, aliases, usernames, employee identifiers, customer identifiers, account identifiers, government-issued identifiers, and online identifiers; contact data, such as email addresses, telephone numbers, mailing addresses, and business contact information; employee, applicant, and human resources data, such as job title, department, compensation-related records, recruiting records, benefits-related data, and performance records; customer, client, patient, member, student, or end-user records, including account information, service history, communications, support history, and relationship data; billing, payment, or transaction data, including invoice information, transaction history, purchase records, and account balances; healthcare, medical, clinical, or health-related records, to the extent Customer elects to Process such data through the Services and any required contractual arrangements are in place; marketing, sales, and business relationship data, including lead records, CRM records, segmentation information, and engagement history; professional and business-related data, including employer, organization, role, title, and business affiliation; authentication, access, device, and security-related records, including usernames, login identifiers, access logs, IP addresses, device identifiers, and session records; technical, operational, and usage-related data to the extent such data constitutes Personal Data; and any other Personal Data that Customer or its Authorized Users make available through the Services. Categories of Data Subjects. The categories of Data Subjects whose Personal Data may be included in Customer Data depend on the nature of Customer’s business and the datasets made available through the Services. Categories may include, without limitation: employees, personnel, workforce members, and internal users of Customer; job applicants, candidates, and former employees; contractors, consultants, and contingent workers; customers, clients, account holders, members, patients, students, or other individuals with whom Customer has a business or service relationship; vendors, suppliers, service providers, and business partners; end users, subscribers, and application users whose data is maintained by Customer; leads, prospects, and individuals in Customer’s marketing or relationship-management records; and any other individuals whose Personal Data Customer makes available through the Services. Annex 2 - Technical and Organizational Security Measures Kaarvi implements and maintains the following categories of technical and organizational measures designed to protect Personal Data Processed on behalf of Customer. These measures supplement Section 4 of this DPA and are subject to update and modification in accordance with Section 4. Access Control. Role-based access controls, least-privilege principles, and need-to-know restrictions designed to limit access to Personal Data to authorized personnel, systems, and Subprocessors. Administrative access to Customer environments is logged and restricted to authorized personnel. Authentication and Identity Management. Multi-factor authentication, credential encryption, secure password storage, session management, token-based authentication, and support for enterprise identity federation and single sign-on. Encryption. Encryption or comparable protections for Personal Data in transit and at rest, as applicable to the relevant systems, storage environments, and Processing activities. Tenant Isolation. Logical and architectural measures designed to separate Customer environments and reduce the risk of unauthorized cross-customer access to Personal Data or Customer Data. Logging, Monitoring, and Auditing. Security event logging, access logging, anomaly detection, alerting, and audit-trail capabilities designed to detect, investigate, and respond to unauthorized access, misuse, and security events. Vulnerability Management. Vulnerability scanning, patching, maintenance, and system hardening practices appropriate to the Services and Kaarvi’s operating environment. Incident Response. Incident detection, investigation, containment, remediation, recovery, and notification procedures designed to address Security Incidents in accordance with this DPA and Applicable Privacy Law. Backup and Recovery. Backup, business continuity, and disaster recovery measures designed to support operational resilience and the restoration of availability or data state. Secure Execution Environments. Controls governing code execution, query execution, workflow execution, and similar Processing activities, including sandboxing, containment, and execution-boundary measures where appropriate. Vendor and Subprocessor Management. Due diligence, contractual requirements, and ongoing oversight for Subprocessors that Process Personal Data on behalf of Customer. Change Management. Change-management processes, including versioning, rollback, testing, and approval controls designed to reduce the risk of unauthorized or unintended changes to the Services or Customer Data. Secure Development. Secure software development practices, including code review, security testing, and secure deployment procedures appropriate to the Services. Annex 3 - Subprocessor List The following third-party service providers are engaged by Kaarvi to process Customer Data in connection with the provision of the Services. Each subprocessor is contractually obligated to process Customer Data solely for the business purposes described below and in accordance with applicable data protection requirements. Subprocessor Location Business Purpose Amazon Web Services, Inc. United States Cloud infrastructure, hosting, compute, storage, database services, caching, backup, and disaster recovery for the Services and Customer Data Anthropic, PBC United States AI/LLM inference services for AI-assisted platform features, including natural-language querying, classification, and documentation generation OpenAI, L.L.C. United States AI/LLM inference and embedding services for AI-assisted platform features, including natural-language querying, documentation generation, and semantic search Mistral AI, SAS France AI/LLM inference services for AI-assisted platform features when configured by Customer as the active model provider Google LLC United States AI/LLM inference services for AI-assisted platform features, including cross-model pipeline critique and model-diversity review Stripe, Inc. United States Payment processing, subscription management, billing operations, and related financial services Twilio Inc. (d/b/a SendGrid) United States Transactional email delivery for account communications, verification, security alerts, and platform notifications [a]We need to define how the list to be provided