Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the effizient Terms of Service (the "Agreement") between the customer that subscribes to the Services ("Customer," "you") and Effizient LLC ("effizient," "we," "us," or "our"). This DPA applies where and to the extent effizient processes Personal Data on Customer's behalf in connection with the effizient platform, including our operations workspace and our wholesale ordering portal (together, the "Services"). Capitalized terms not defined here have the meanings given in the Agreement.

1. Definitions

• "Applicable Data Protection Laws" means all data protection and privacy laws applicable to the processing of Personal Data under the Agreement, including, as applicable, the EU General Data Protection Regulation (Regulation 2016/679) ("GDPR"), the GDPR as incorporated into the law of the United Kingdom ("UK GDPR"), and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA").
• "Controller" means the entity that determines the purposes and means of the Processing of Personal Data; under the CCPA/CPRA, "Business" has a corresponding meaning.
• "Processor" means the entity that Processes Personal Data on behalf of the Controller; under the CCPA/CPRA, "Service Provider" has a corresponding meaning.
• "Personal Data" means any information relating to an identified or identifiable natural person that is contained in Customer Data and Processed by effizient on Customer's behalf under the Agreement.
• "Processing" (and "Process") means any operation performed on Personal Data, whether or not by automated means, such as collection, recording, storage, use, disclosure, or erasure.
• "Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
• "Subprocessor" means a third party engaged by effizient to Process Personal Data in connection with providing the Services.
• "Customer Data" means the data that Customer and its authorized users upload to or generate in the Services, as described in the Privacy Policy.

2. Roles and Scope of Processing

For Personal Data contained in Customer Data, Customer is the Controller (or Business) and effizient is the Processor (or Service Provider). Customer is responsible for the lawfulness of the Personal Data and for having the appropriate legal basis, notices, and consents required for effizient to Process Personal Data as contemplated by the Agreement.

effizient will Process Personal Data only to provide, maintain, secure, and support the Services, and on Customer's documented instructions, including as set out in the Agreement, this DPA, and Customer's configuration and use of the Services. effizient will not Process Personal Data for any other purpose. If effizient is required by law to Process Personal Data other than on Customer's instructions, it will inform Customer of that requirement before Processing, unless the law prohibits such notice.

3. Details of Processing (Annex I)

The Services are not intended for the Processing of special categories of Personal Data, and Customer agrees not to submit such data except with adequate safeguards and its own legal basis.

4. Processor Obligations

effizient will:

• Process on instructions. Process Personal Data only on Customer's documented instructions, as described in Section 2, and inform Customer if effizient believes an instruction infringes Applicable Data Protection Laws.
• Confidentiality. Ensure that personnel authorized to Process Personal Data are bound by appropriate confidentiality obligations and are trained on their responsibilities.
• Security. Implement and maintain appropriate technical and organizational measures to protect Personal Data, taking into account the state of the art and the risks of Processing, consistent with Article 32 of the GDPR. These measures include encryption of data in transit and at rest, access controls, and monitoring.
• Data subject requests. Taking into account the nature of the Processing, provide reasonable assistance to enable Customer to respond to requests from Data Subjects to exercise their rights. If effizient receives such a request directly, it will, unless prohibited by law, promptly inform Customer and not respond except on Customer's instructions.
• Assistance. Provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities, taking into account the information available to effizient.
• Breach notification. Notify Customer without undue delay after becoming aware of a Personal Data breach affecting Personal Data, and provide information reasonably available to effizient to help Customer meet its own notification obligations.

5. Subprocessors

Customer provides a general authorization for effizient to engage Subprocessors to Process Personal Data in connection with the Services. effizient will impose data protection obligations on each Subprocessor that are no less protective than those in this DPA, and effizient remains responsible for the acts and omissions of its Subprocessors as if they were its own. The current Subprocessors are:

effizient will give Customer notice of the addition or replacement of a Subprocessor before that Subprocessor begins Processing Personal Data. Customer may object on reasonable data-protection grounds within the notice period. If the parties cannot resolve the objection, Customer may, as its sole and exclusive remedy, terminate the affected Services in accordance with the Agreement.

6. International Transfers

Where the Processing of Personal Data involves a transfer from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, the parties agree that the transfer is subject to appropriate safeguards, including the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or IDTA, and, where applicable, the EU-US Data Privacy Framework. Those mechanisms are incorporated into this DPA by reference and apply to the extent required by Applicable Data Protection Laws.

7. CCPA/CPRA Service Provider Terms

To the extent effizient Processes Personal Data of California residents on Customer's behalf, effizient acts as a Service Provider under the CCPA/CPRA. effizient will not:

• Sell or share the Personal Data, as those terms are defined under the CCPA/CPRA
• Retain, use, or disclose the Personal Data for any purpose other than the business purposes specified in the Agreement and this DPA, or as otherwise permitted by the CCPA/CPRA
• Retain, use, or disclose the Personal Data outside the direct business relationship between the parties
• Combine the Personal Data with information received from other sources, except as permitted by the CCPA/CPRA

effizient certifies that it understands and will comply with these restrictions. effizient will notify Customer if it determines that it can no longer meet its obligations as a Service Provider.

8. Return and Deletion

On termination or expiry of the Agreement, effizient will, at Customer's choice, delete or return the Personal Data, and delete existing copies unless retention is required by law. Residual copies in routine backups are deleted on a rolling basis in the ordinary course.

9. Audits

effizient will make available to Customer information reasonably necessary to demonstrate compliance with this DPA. Customer's audit rights are satisfied in the first instance by effizient providing written responses, summaries, and any relevant third-party reports or certifications on reasonable request. Any further audit will be conducted at reasonable intervals, on reasonable prior notice, during business hours, without disrupting effizient's operations, and subject to confidentiality obligations.

10. Liability

Each party's liability arising out of or related to this DPA is subject to the exclusions and limitations of liability set out in the Agreement, including the limitation of liability cap. This DPA does not increase or expand those limitations.

11. Order of Precedence

This DPA supplements the Agreement. In the event of a conflict between this DPA and the Agreement regarding the Processing of Personal Data, this DPA controls to the extent of the conflict. In the event of a conflict between this DPA and any transfer mechanism incorporated under Section 6, that transfer mechanism controls with respect to the transfer it governs. All other terms of the Agreement remain in full force and effect.

12. Contact Us

For questions about this DPA or effizient's Processing of Personal Data, contact privacy@effizient.io. See also our Terms of Service, Privacy Policy, Acceptable Use Policy, and Service & Support Policy.

Effizient LLC
5900 Balcones Drive, Suite 100
Austin, Texas 78731
United States

Email: privacy@effizient.io