Data Processing Addendum

1. Parties and scope

This Data Processing Addendum ("DPA") supplements the Terms of Service between Worql, Inc., a Delaware corporation ("Worql," "Processor"), and the customer identified in the applicable order or account record ("Customer," "Controller"). It governs Worql's processing of Personal Data on Customer's behalf in connection with its agreement-assembly and governed commercial-record services. This DPA applies where Worql acts as a processor for a Customer; parties may independently act as controllers for information they submit and the legal role of an external connected source depends on its own agreement.

This DPA reflects the requirements of:

• Regulation (EU) 2016/679 ("GDPR") and the UK General Data Protection Regulation as it forms part of UK law ("UK GDPR"),
• the California Consumer Privacy Act as amended ("CCPA / CPRA"), and
• the Digital Personal Data Protection Act, 2023 of India ("DPDPA").

Where any of those frameworks does not apply to a given processing activity, the corresponding obligation in this DPA does not apply to that activity.

2. Definitions

Terms have the meanings given in the applicable law (Controller, Processor, Data Subject, Personal Data, Processing, Sub-processor, Standard Contractual Clauses, Data Principal, Business, Service Provider). Customer is the Controller (or, under CCPA, the Business); Worql is the Processor (or Service Provider). For DPDPA-regulated processing, Customer is the Data Fiduciary and Worql is the Data Processor.

3. Processing details

Subject matter and duration. Processing of Personal Data necessary to provide the Service for the duration of Customer's subscription, plus the retention periods in the Privacy Policy.

Nature and purpose. Hosting, transmitting, storing, importing, assembling and exporting documents; connecting customer-authorized sources; recording proposed scope changes, evidence, human approvals and acceptance; operating controlled work queues and finance-review handoffs; and producing advisory AI and embeddings-based matching for authorized workflows. Processing may involve displaying selected data to an authorized counterparty or sending a result back to a connected source, subject to the permissions and instructions that govern that engagement.

Categories of Data Subjects. Customer's authorized users; customer and vendor personnel; counterparties named in agreements and commercial records; people whose accounts, comments or messages appear in authorized GitHub, Jira, Confluence, Slack, Linear or email source data.

Categories of Personal Data. Names and business contact details, account or provider user IDs, roles, project descriptions, contract and commercial terms, decision and event attribution, GitHub contributor or pull-request metadata, Jira and tracker fields, Slack channel content, email headers, message bodies and attachments, and other information a customer chooses to enter or import. Customers should not intentionally submit special-category data (including health or biometric data) without a lawful basis and adequate safeguards; uncontrolled text from connected sources may nonetheless contain it.

4. Customer's instructions

Customer instructs Worql to process Personal Data only as needed to:

• provide the Service to Customer and its authorized users,
• comply with Customer's documented instructions (including via the workspace UI),
• comply with applicable law,
• maintain security, prevent abuse, and respond to incidents,
• as otherwise expressly permitted by the Terms or this DPA.

Worql will inform Customer if it believes an instruction violates applicable data-protection law, unless prohibited from doing so.

5. Confidentiality

Worql will ensure that personnel authorized to process Customer Personal Data are bound by appropriate obligations of confidentiality and have received training on data protection commensurate with their role.

6. Security

Worql will implement and maintain technical and organizational measures appropriate to the risk, including the controls described in Section 9 of the Privacy Policy (TLS in transit, encryption at rest, least-privilege secrets management, SSO-gated production access, etc.). Worql will review and update these measures from time to time and will not materially degrade them during the term.

7. Sub-processors

Customer authorizes Worql to engage service providers acting as Sub-processors as identified on the Sub-processors page, subject to the written terms and safeguards required by applicable law and this DPA. The same page separately identifies systems selected and connected by Customer that may not be Worql's Sub-processors. Worql will give Customer at least 30 days' advance notice of new or replacement Sub-processors. Customer may object in writing on reasonable data-protection grounds; if Worql and Customer cannot resolve the objection, Customer may terminate the affected portion of the Service and receive a pro-rata refund of prepaid fees. The October 20, 2026 correction to the public provider list identifies sources previously omitted from the disclosure; it does not waive advance-notice duties, existing contractual rights or remedies available to affected Customers.

8. International transfers

Where Customer Personal Data is transferred from the EEA, UK, Switzerland, or India to a country that has not received an adequacy decision, the transfer is governed by:

• the EU Standard Contractual Clauses (Commission Decision 2021/914), Module 2 (Controller-to-Processor) where Customer is the Controller, or Module 3 (Processor-to-Processor) where Customer is itself a Processor;
• the UK International Data Transfer Addendum (the IDTA Addendum) for transfers from the UK;
• the equivalent Swiss FDPIC requirements for transfers from Switzerland;
• the DPDPA's cross-border transfer framework for transfers from India, as that framework is implemented from time to time.

The SCCs are incorporated into this DPA by reference. Where the SCCs require optional elections, the parties make the following: the optional docking clause does not apply; supervisory authority is the Irish DPC for EEA transfers and the ICO for UK transfers; the law of Ireland governs disputes for EEA Module 2/3 transfers; the law of England and Wales governs for UK transfers; arbitration under SIAC Rules applies to disputes escalated under this DPA consistent with the Terms.

9. Data subject requests

Worql will reasonably assist Customer in responding to Data Subject requests (access, correction, deletion, restriction, portability, objection, DPDPA grievances) through the workspace UI where possible and via support@worql.app where not. Worql will not respond directly to a Data Subject about Customer Personal Data unless required by law or authorized by Customer.

10. Incident notification

If Worql becomes aware of a Personal Data Breach affecting Customer Personal Data, Worql will notify Customer without undue delay and in any event within 72 hours of becoming aware, with the information reasonably available at the time and updates as additional facts emerge. Worql will take reasonable steps to mitigate the breach's effects and assist Customer in meeting Customer's own notification obligations.

11. Audit

Once per twelve-month period, on at least 30 days' notice, Customer (or a third-party auditor reasonably acceptable to Worql, bound to confidentiality) may audit Worql's compliance with this DPA by reviewing Worql's written responses to a reasonable questionnaire. On-site audits are not required and are at Customer's expense; remote inspection through documents, certifications, and follow-up calls will be the default form.

12. Return or deletion

On termination or expiration of the Service, Customer may export its data through the workspace UI or request assistance through privacy@worql.app. Within 30 days after termination, Worql will delete Customer Personal Data from active systems as committed in the applicable agreement, subject to backup retention and obligations imposed by applicable law. Unlinking a source or deleting an individual account is not the same as terminating the Customer's engagement or exercising the termination return/deletion process. If data must be retained for executed legal instruments, security duties or legal claims, access must be restricted to those purposes and retention must be explained to the Customer on request. This clarification does not shorten or waive an existing Customer's deletion, export or remedy rights.

13. Term and order of precedence

This DPA takes effect when Customer accepts the Terms (or signs an order form referencing this DPA) and continues for the term of the Service. In the event of a conflict between the Terms and this DPA with respect to data protection, this DPA prevails. With respect to the SCCs and any matter falling within them, the SCCs prevail over both.

14. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of the Terms (including Section 11 of the Terms). The SCCs and the UK IDTA's liability provisions apply with respect to claims by Data Subjects against either party arising directly from the transfer mechanisms themselves.

15. Execution

By accepting the Terms or creating a paid Worql account, Customer is deemed to have entered into this DPA without need for separate signature. A counter-signed copy is available on request to legal@worql.app.

Worql signatory: Aayush Chopra, on behalf of Worql, Inc.

16. Contact

Data protection: privacy@worql.app. Legal notices: legal@worql.app. DPDPA grievances: grievance@worql.app.