Data processing addendum

This Data Processing Addendum (including its Annexes, the "DPA") is incorporated into, and forms part of, the agreement between Human Union Data, Inc. ("HUD") and the customer that has appointed HUD to process personal data on its behalf (the "Data Vendor") governing the Data Vendor's use of the Services, being the Vendor Platform Access Agreement and each Vendor Data Sharing Agreement between HUD and the Data Vendor (together, the "Agreement"). This DPA applies automatically, without signature, from the date the Data Vendor accepts the Agreement, accepts this DPA by clicking or otherwise, or first provides Data Vendor Personal Data to HUD, whichever is earliest (the "Effective Date"). A person accepting this DPA on behalf of an entity represents that they have authority to bind that entity.

1. Scope and application

1.1 This DPA applies only where, and to the extent that, HUD Processes Data Vendor Personal Data on behalf of the Data Vendor as a Processor, Service Provider or Contractor in providing the Services.

1.2 This DPA does not apply to (a) personal data HUD Processes as a Controller or Business in its own right, including account, billing and relationship data about the Data Vendor's personnel, or Processed Datasets HUD holds from the Hand-over as licensee under a Vendor Data Sharing Agreement; or (b) data that is not personal data, including Deidentified Data.

1.3 This DPA replaces any data protection terms previously applicable to HUD's Processing of Data Vendor Personal Data under the Agreement.

2. Definitions and interpretation

2.1 In this DPA:

• "Applicable Data Protection Law" means, to the extent applicable to the Processing of Data Vendor Personal Data: (a) the EU GDPR; and (b) the CCPA; in each case as amended or replaced.
• "Buyer" means a person to whom HUD licenses Processed Datasets under a Buyer Data Sharing Agreement.
• "Buyer Data Sharing Agreement" means a data sharing agreement between HUD and a Buyer under which HUD licenses data to that Buyer.
• "CCPA" means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020, and its implementing regulations at Cal. Code Regs. tit. 11, § 7000 et seq. (the "CCPA Regulations").
• "Data Recipient" means a third party to whom Processed Datasets are made available, whether at the Data Vendor's Instruction or by HUD under a Buyer Data Sharing Agreement, including a Buyer and any developer or deployer of AI models.
• "Data Vendor Personal Data" means personal data or personal information that the Data Vendor (or an End User, at the Data Vendor's direction) provides to HUD, or that HUD collects on the Data Vendor's behalf, and that HUD Processes as a Processor, Service Provider or Contractor under the Agreement.
• "Deidentified Data" has the meaning given to "deidentified" in Cal. Civ. Code § 1798.140(m) and, for GDPR purposes, means data rendered anonymous so that the data subject is no longer identifiable.
• "End User" means an individual with whom the Data Vendor has a direct relationship and from whom (or about whom) the Data Vendor collects personal data.
• "EU GDPR" or "GDPR" means Regulation (EU) 2016/679 (the General Data Protection Regulation).
• "Hand-over" has the meaning given in Clause 3.5(a).
• "Instructions" has the meaning given in Clause 3.2.
• "Notification Email Address" means the email address(es) the Data Vendor designates in its account or Order Form to receive notices under this DPA.
• "Order Form" means any order form, statement of work, project specification, platform listing configuration, or Vendor Offer (as defined in the Vendor Data Sharing Agreement) under the Agreement that describes the Services for a particular engagement.
• "Personal Data Breach" means a breach of HUD's security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Data Vendor Personal Data on systems managed or controlled by HUD or its Sub-processors.
• "Processed Datasets" means datasets, annotations, evaluations, environments or other outputs that HUD generates from Data Vendor Personal Data under the Instructions.
• "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, in the Module(s) specified in Clause 12.
• "Sensitive Data" means any Data Vendor Personal Data that is subject to heightened protection under any data protection or privacy law applicable to the Data Vendor's collection or Processing of it, however that category is described in that law, including: special categories of personal data under Article 9, and personal data relating to criminal convictions and offences under Article 10, of the EU GDPR; "sensitive personal information" under Cal. Civ. Code § 1798.140(ae) and the CCPA Regulations; and any equivalent category under any other applicable law.
• "Services" means the data processing, cleaning, pseudonymisation, deidentification, curation, annotation, evaluation, packaging and delivery services HUD provides to the Data Vendor under the Agreement.
• "Sub-processor" means any third party (including any HUD affiliate) engaged by HUD to Process Data Vendor Personal Data, excluding HUD employees and Data Recipients.
• "Sub-processor Page" means HUD's sub-processor list at https://trust.hud.ai/subprocessors (or any successor page HUD designates).
• "Trust Center" means HUD's trust center at https://trust.hud.ai (or any successor page HUD designates).
• "Vendor Data Sharing Agreement" means a data sharing agreement between HUD and the Data Vendor under which the Data Vendor licenses data to HUD.

2.2 "Controller", "Processor", "data subject", "personal data", "Processing" and "supervisory authority" have the meanings given in the GDPR. "Business", "business purpose", "commercial purpose", "consumer", "Contractor", "personal information", "sell", "sensitive personal information", "Service Provider" and "share" have the meanings given in the CCPA. Where the CCPA applies, "Controller", "Processor" and "data subject" include "Business", "Service Provider or Contractor" and "consumer" respectively.

2.3 Capitalised terms not defined in this DPA have the meanings given in the Agreement. "Including" means "including without limitation".

3. Roles and Instructions

3.1 Roles. HUD is a Processor (and, under the CCPA, a Service Provider or Contractor), and the Data Vendor is a Controller (and, under the CCPA, a Business) or a Processor, as applicable, of Data Vendor Personal Data. Where the Data Vendor acts as a Processor on behalf of a third-party Controller, HUD is a Sub-processor and the Data Vendor:

(a) warrants, on an ongoing basis, that the relevant Controller has authorised the Instructions, the Data Vendor's appointment of HUD as another Processor, and HUD's engagement of Sub-processors under Clause 6;

(b) will forward to that Controller, promptly and without undue delay, any notice HUD gives under Clauses 3.4, 6, 8 or 9; and

(c) remains HUD's sole point of contact, and HUD has no obligation to deal directly with that Controller unless required by Applicable Data Protection Law.

3.2 Documented Instructions. HUD will Process Data Vendor Personal Data only on the Data Vendor's documented instructions, including with regard to transfers to a third country, unless required to do otherwise by law to which HUD is subject; in that case HUD will inform the Data Vendor of that legal requirement before Processing unless the law prohibits it on important grounds of public interest. The Data Vendor instructs HUD to Process Data Vendor Personal Data only:

(a) to provide, secure and support the Services in accordance with the Agreement, this DPA and the applicable Order Form;

(b) as configured by the Data Vendor through the HUD platform, API or data-transfer interface; and

(c) as set out in any other written instruction given by the Data Vendor and acknowledged in writing by HUD as an instruction under this DPA,

(together, the "Instructions").

3.3 Additional Instructions. Instructions outside, or changed from, the scope in Clause 3.2 require prior written agreement, including on any additional fees. If HUD declines such an Instruction, the Data Vendor may terminate the affected Services on written notice as its sole remedy.

3.4 Infringing Instructions. HUD will immediately inform the Data Vendor if, in its opinion, an Instruction infringes Applicable Data Protection Law, and may suspend the affected Processing until the Data Vendor withdraws or modifies the Instruction. HUD is not obliged to perform legal review of Instructions, and HUD's silence is not confirmation that an Instruction is lawful.

3.5 Release of Processed Datasets.

(a) Hand-over to HUD as licensee. Where the Data Vendor licenses Processed Datasets to HUD under a Vendor Data Sharing Agreement, HUD Processes Data Vendor Personal Data as a Processor under this DPA only until the relevant Processed Dataset is delivered to HUD as licensee following the Data Vendor's approval under Clause 3.5(b) (the "Hand-over"). From the Hand-over, HUD holds that Processed Dataset as an independent Controller (and, under the CCPA, a Business) for its own purposes under the Vendor Data Sharing Agreement, this DPA does not apply to it, and HUD's licensing of it to Buyers is governed by the Vendor Data Sharing Agreement and the applicable Buyer Data Sharing Agreement. Clauses 3.5(b) and 3.5(e) apply to the Hand-over, and HUD will not provide any Buyer with any additional information that would enable reattribution (including any key or mapping table). Where the Instructions direct HUD to make Processed Datasets available to a Data Recipient other than under a Vendor Data Sharing Agreement, HUD does so solely on behalf of, and as directed by, the Data Vendor, the data transaction is between the Data Vendor and the Data Recipient under their own agreement, to which HUD is not a party, and Clauses 3.5(b) to 3.5(e) apply.

(b) Release standard and approval. The Order Form or Instructions will specify whether Processed Datasets are to be released as (i) Deidentified Data or (ii) pseudonymised data (meaning personal data processed so that it is no longer attributable to an individual without additional information kept separately, as described in GDPR Article 4(5) and Cal. Civ. Code § 1798.140(aa)). If neither is specified, the release standard is Deidentified Data. HUD will apply the methodology described in the Order Form or HUD's documentation. HUD will release Processed Datasets only on the Data Vendor's approval, which may be given through the HUD platform.

(c) Deidentified releases. Where the release standard is Deidentified Data:

(i) the Data Vendor will ensure its agreement with the Data Recipient obliges the Data Recipient, and any onward recipient, to keep the data in deidentified form, not to attempt to reidentify it, and otherwise to comply with Cal. Civ. Code § 1798.140(m), and HUD may withhold release until the Data Vendor confirms this; and

(ii) once released in compliance with this Clause 3.5(c), the Processed Dataset is not Data Vendor Personal Data and is outside this DPA.

(d) Pseudonymised releases. Where the release standard is pseudonymised data, the Processed Dataset remains personal data and personal information, and:

(i) the Data Vendor is solely responsible for the lawful basis for, and transparency regarding, the disclosure and the Data Recipient's intended use (including AI model training); for any obligations Applicable Data Protection Law attaches to the disclosure (including, where the CCPA applies, obligations arising from a "sale", such as honouring opt-outs and entering into the third-party contract required by CCPA Regulations § 7053); and for any transfer mechanism the disclosure requires;

(ii) the Data Recipient receives the data as an independent Controller (or as the Data Vendor's third party under the CCPA) and is not a Sub-processor of HUD;

(iii) HUD will not provide any additional information that would enable reattribution (including any key or mapping table) to the Data Recipient; and

(iv) HUD will suspend release of data relating to any consumer or data subject the Data Vendor identifies under Clause 9.

(e) No warranty of anonymity. HUD will apply the agreed methodology with reasonable skill and care. HUD does not warrant that any Processed Dataset is incapable of reidentification by any person, particularly unstructured content (free text, images, audio) in which identifiers may be embedded. The decision to release, and the choice of release standard, are the Data Vendor's.

3.6 Compliance with law. Each party will comply with the obligations that Applicable Data Protection Law imposes on it in its respective role.

4. Data Vendor obligations and warranties

4.1 Responsibility for collection. The Data Vendor is solely responsible for the accuracy, quality and legality of Data Vendor Personal Data and the means by which it was collected, and for its own compliance with Applicable Data Protection Law as Controller (or Business, or the equivalent role).

4.2 Warranties. The Data Vendor represents, warrants and undertakes, on the Effective Date and for as long as HUD Processes Data Vendor Personal Data, that:

(a) Lawful basis. It has, and will maintain, a valid lawful basis under Applicable Data Protection Law (including, where the EU GDPR applies, under Article 6 and, for special category data, a condition under Article 9) for each Processing activity in the Instructions, including any disclosure to Data Recipients and their use for AI model training, evaluation or development;

(b) Transparency. It has given End Users all notices required by Applicable Data Protection Law, including, where applicable, the information required by Articles 13 and 14 of the EU GDPR and the notice at collection, privacy policy and notice of right to opt-out of sale or sharing required by the CCPA, and those notices accurately describe the Processing by HUD as its service provider and any onward disclosure to Data Recipients;

(c) Consent. Where its lawful basis is consent, that consent was freely given, specific, informed and unambiguous, is recorded, can be withdrawn, and was not obtained through dark patterns; the Data Vendor will notify HUD under Clause 9 of any withdrawal affecting Data Vendor Personal Data held by HUD;

(d) Purpose compatibility. HUD's Processing under the Instructions is consistent with End Users' reasonable expectations and the purposes disclosed at collection, as required by Applicable Data Protection Law (including CCPA Regulations § 7002, where the CCPA applies);

(e) Restricted data. Unless the Order Form expressly permits it, it will not provide HUD with (i) Sensitive Data; (ii) personal data of individuals it knows, or should reasonably know, are under 16; or (iii) government identifiers, financial account credentials or precise geolocation;

(f) Minimisation. It will provide only the Data Vendor Personal Data necessary for the Services, and will pseudonymise or deidentify it before transfer wherever the Services allow;

(g) Authority. It is entitled to provide the Data Vendor Personal Data to HUD for Processing under the Instructions, free of any contractual or other restriction that would prevent it; and

(h) Sensitive Data. To the extent any Data Vendor Personal Data is Sensitive Data, it has complied, and will continue to comply, with every requirement that the law of each relevant jurisdiction imposes on it as Controller (or Business, or the equivalent role) in respect of that Sensitive Data, including by:

(i) having a valid legal basis or condition for collecting and Processing it (including, where the EU GDPR applies, a condition under Article 9(2) and, for criminal-offence data, compliance with Article 10) and, where that law requires it, the data subject's explicit or opt-in consent;

(ii) giving every notice that law requires specifically for Sensitive Data, including, where the CCPA applies and the Data Vendor uses or discloses sensitive personal information for purposes beyond those specified in CCPA Regulations § 7027(m), the Notice of Right to Limit, and honouring requests to limit;

(iii) obtaining any parental or guardian consent that law requires for data relating to children;

(iv) completing any data protection impact assessment, risk assessment or equivalent that law requires before the Processing and any release contemplated by the Instructions; and

(v) identifying in the Order Form each category of Sensitive Data provided to HUD and the legal basis or condition relied on for it,

so that the Data Vendor's disclosure of Sensitive Data to HUD, HUD's Processing of it under the Instructions, and any release under Clause 3.5 do not breach any such requirement. This warranty applies whether or not the Sensitive Data was provided in accordance with Clause 4.2(e).

4.3 Notice of non-compliance. The Data Vendor will notify HUD without undue delay if it becomes aware that any warranty in Clause 4.2 is or may become untrue, and HUD may suspend the affected Processing until the matter is resolved.

4.4 Unidentified Sensitive Data. If HUD becomes aware that the Data Vendor has provided Sensitive Data not identified in an Order Form, HUD may suspend Processing of that data immediately and, after notifying the Data Vendor, delete or return it, without liability to the Data Vendor.

5. HUD obligations

5.1 Confidentiality of personnel. HUD will ensure that persons it authorises to Process Data Vendor Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and access it only as necessary to perform the Instructions.

5.2 Security. HUD will implement the measures in Annex 2 and take all measures required by Applicable Data Protection Law (including Article 32 of the EU GDPR), as further described in Clause 7.

5.3 Purpose limitation. With respect to Data Vendor Personal Data, HUD will not, except as expressly permitted by Applicable Data Protection Law (including the CCPA and the CCPA Regulations):

(a) sell or share it;

(b) retain, use or disclose it for any purpose, including any commercial purpose, other than the business purposes specified in Annex 1;

(c) retain, use or disclose it outside the direct business relationship between HUD and the Data Vendor; or

(d) combine or update it with personal information HUD receives from or on behalf of another person, or collects from its own interaction with the consumer.

The Data Vendor discloses Data Vendor Personal Data to HUD only for the limited and specified business purposes set out in Annex 1.

5.4 Purpose-bound processing. HUD will Process Data Vendor Personal Data only for the purposes for which the Data Vendor has appointed it, as described in Annex 1 and the applicable Order Form, and as otherwise permitted to processors or service providers by Applicable Data Protection Law (including the CCPA), including internal use to build or improve the quality of the Services HUD provides to the Data Vendor, provided HUD does not use the data to perform services on behalf of another person.

5.5 Deidentified Data. HUD will create Deidentified Data from Data Vendor Personal Data only on the Data Vendor's Instructions. Where it does, HUD will (a) take reasonable measures to ensure the data cannot be associated with an individual; (b) publicly commit to maintain and use it only in deidentified form and not attempt to reidentify it; and (c) contractually require any recipient to do the same.

5.6 Compliance and notification. HUD will comply with the obligations Applicable Data Protection Law imposes on it in its role under this DPA and, where the CCPA applies, will provide the same level of privacy protection to Data Vendor Personal Data as the CCPA requires of businesses. HUD will notify the Data Vendor if it determines that it can no longer meet its obligations under Applicable Data Protection Law.

5.7 Certification. HUD certifies that it understands and will comply with the restrictions in Clauses 5.3 and 5.4.

5.8 Records. HUD will maintain records of its Processing activities on behalf of the Data Vendor as required by Applicable Data Protection Law (including Article 30(2) of the EU GDPR).

5.9 Government access. If a public authority requests access to Data Vendor Personal Data, HUD will, unless legally prohibited, (a) attempt to redirect the authority to the Data Vendor; (b) promptly notify the Data Vendor; and (c) disclose only the minimum required by law.

6. Sub-processors

6.1 General written authorisation. The Data Vendor gives HUD general written authorisation (including for the purposes of Article 28(2) of the EU GDPR) to engage Sub-processors, and specifically authorises the Sub-processors listed on the Sub-processor Page (as referenced in Annex 3) as at the Effective Date.

6.2 Notice of new Sub-processors. HUD will update the Sub-processor Page, and provide a mechanism for the Data Vendor to subscribe to notice of updates, at least 30 days before any new Sub-processor starts Processing Data Vendor Personal Data. The update will state the Sub-processor's name, location and Processing activities.

6.3 Urgent replacement. Where HUD must replace a Sub-processor urgently for security, continuity or legal reasons, HUD may do so on shorter notice and will update the Sub-processor Page as soon as reasonably practicable; the objection right in Clause 6.4 then runs from that update.

6.4 Objection. The Data Vendor may object in writing within 15 days of notice, on reasonable grounds relating to data protection, stating those grounds. HUD may, at its option, (a) offer a commercially reasonable alternative, or (b) avoid Processing of Data Vendor Personal Data by that Sub-processor. If neither is reasonably practicable within 30 days of the objection, the Data Vendor may, as its sole and exclusive remedy, terminate the affected Services on written notice, and HUD will refund any prepaid fees for the terminated period. If the Data Vendor does not object within the period, it is deemed to have authorised the Sub-processor.

6.5 Flow-down. HUD will impose on each Sub-processor, by written contract, the same data protection obligations as set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures, and terms that comply with Applicable Data Protection Law (including, where the CCPA applies, CCPA Regulations § 7051). HUD will restrict each Sub-processor's access to what is necessary to perform the subcontracted services, and, for Sub-processors providing AI or machine-learning services, will ensure they are contractually prohibited from using Data Vendor Personal Data to train or improve their own models.

6.6 Liability for Sub-processors. HUD remains fully liable to the Data Vendor for the performance of each Sub-processor's data protection obligations, subject to Clause 14.

7. Security

7.1 HUD measures. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, and the risks to individuals, HUD will implement and maintain the technical and organisational measures in Annex 2 to ensure a level of security appropriate to the risk, including as appropriate: (a) pseudonymisation and encryption; (b) ongoing confidentiality, integrity, availability and resilience of processing systems; (c) timely restoration of access after an incident; and (d) regular testing of the effectiveness of those measures. For CCPA purposes, these are HUD's reasonable security procedures and practices under Cal. Civ. Code § 1798.81.5.

7.2 Updates. HUD may update Annex 2 and the controls published on the Trust Center from time to time, provided that updates do not materially reduce the overall security of the Services.

7.3 Data Vendor responsibilities. The Data Vendor is responsible for (a) securing its own systems, credentials and transfer endpoints used to send data to, or receive data from, HUD; (b) using the security features HUD makes available; and (c) any copies of Data Vendor Personal Data it holds outside HUD's systems. The Data Vendor agrees that Annex 2 provides a level of security appropriate to the risk.

8. Personal Data Breach

8.1 Notification. HUD will notify the Data Vendor without undue delay after becoming aware of a Personal Data Breach, and will promptly take reasonable steps to contain it, mitigate its effects and secure the data.

8.2 Content. HUD's notification will describe, to the extent then known: (a) the nature of the Personal Data Breach, including the categories and approximate number of data subjects and records concerned; (b) the likely consequences; (c) the measures taken or proposed to address it and mitigate adverse effects; and (d) a contact point for further information. Where information is not available at once, HUD will provide it in phases without undue delay.

8.3 Assistance. Taking into account the nature of Processing and the information available to it, HUD will provide reasonable assistance to enable the Data Vendor to notify supervisory authorities and data subjects under Applicable Data Protection Law (including Articles 33 and 34 of the EU GDPR) and comply with any other applicable breach-notification obligations. The Data Vendor is responsible for deciding whether notification to authorities, data subjects or consumers is required and for making it. HUD will not notify third parties of a Personal Data Breach affecting Data Vendor Personal Data without the Data Vendor's prior consent, unless required by law.

8.4 Unsuccessful attempts. Unsuccessful attempts that do not compromise Data Vendor Personal Data, such as pings, port scans, unsuccessful log-in attempts and denial-of-service attacks, are not Personal Data Breaches.

8.5 No admission. HUD's notification of, or response to, a Personal Data Breach is not an acknowledgement of fault or liability.

9. Data subject and consumer requests

9.1 Data Vendor responsibility. The Data Vendor is responsible for receiving, verifying and responding to requests from data subjects and consumers to exercise their rights under Applicable Data Protection Law. HUD acts on those requests only as notified and instructed by the Data Vendor under Clause 9.2.

9.2 Requests notified by the Data Vendor. Where the Data Vendor notifies HUD that a verified request requires action on Data Vendor Personal Data that HUD holds (including a deletion or opt-out request the Data Vendor receives through California's Delete Request and Opt-out Platform), HUD will, within 10 business days of notification:

(a) Delete: permanently and completely erase the personal information from its existing systems (except archived or backup systems), deidentify or aggregate it, or enable the Data Vendor to do so, and notify its own Sub-processors to do the same;

(b) Correct: make the correction, or enable the Data Vendor to do so, and ensure it remains corrected;

(c) Access / know: provide the Data Vendor with the relevant personal information HUD holds, or enable the Data Vendor to retrieve it;

(d) Opt-out / objection / restriction: suspend any further release of that individual's data under Clause 3.5(d)(iv); and

(e) Other rights: take the further steps the Data Vendor reasonably instructs to fulfil its obligations under Applicable Data Protection Law (including Chapter III of the EU GDPR), insofar as possible given the nature of the Processing.

This Clause 9.2 is the mechanism by which HUD enables the Data Vendor to comply with consumer requests for the purposes of CCPA Regulations § 7051(a)(10).

9.3 Backups. Where data is held on archived or backup systems, HUD may delay deletion or correction until that system is restored to an active system or is next accessed or used.

9.4 Data no longer held. If HUD has already returned or deleted the relevant data, HUD will confirm that to the Data Vendor and has no further obligation. Processed Datasets already released as Deidentified Data under Clause 3.5(c) are outside this DPA. For pseudonymised releases under Clause 3.5(d), the Data Vendor is responsible for notifying the Data Recipient; on request, HUD will identify which Data Recipients received a release containing the individual's data, where HUD's records allow.

9.5 Misdirected requests. If HUD receives a request that it can reasonably identify as relating to Data Vendor Personal Data, HUD will (a) promptly forward it to the Data Vendor; (b) tell the requester it has done so and that the request should be directed to the Data Vendor; and (c) not otherwise respond without the Data Vendor's authorisation.

9.6 Costs. Assistance requiring work beyond the ordinary operation of the Services may be charged at HUD's then-current rates.

10. Assessments and consultations

10.1 Assessments. Taking into account the nature of Processing and the information available to HUD, HUD will provide reasonable assistance to the Data Vendor in complying with its obligations under Applicable Data Protection Law (including Articles 32 to 36 of the EU GDPR), including data protection impact assessments and prior consultation with supervisory authorities, primarily by making Annexes 2 and 3, the Trust Center and the security documentation in Clause 11 available.

10.2 Reasonable verification and remediation. The Data Vendor may take reasonable and appropriate steps to ensure HUD uses Data Vendor Personal Data consistently with the Data Vendor's obligations under Applicable Data Protection Law (including the CCPA), through the mechanisms in Clauses 9 and 11. If HUD notifies the Data Vendor of any unauthorised use of Data Vendor Personal Data (including under Clause 5.6 or 8), the Data Vendor may, on notice, take reasonable and appropriate steps to stop and remediate that use by (a) requiring HUD to implement the remediation measures HUD has recommended; (b) exercising its rights under Clause 11; or (c) instructing HUD to suspend the affected Processing. On request, HUD will provide documentation verifying that it no longer retains or uses the personal information of consumers who made a valid deletion request.

10.3 CCPA risk assessments, cybersecurity audits and ADMT. Where the Data Vendor must conduct a risk assessment, cybersecurity audit or assessment relating to automated decision-making technology under the CCPA Regulations, HUD will cooperate by making available, on reasonable request, the facts and information in its possession that are reasonably necessary for the Data Vendor to complete it, and will not misrepresent any such fact.

11. Audits and information

11.1 Information. HUD will make available to the Data Vendor all information necessary to demonstrate compliance with Applicable Data Protection Law (including Article 28 of the EU GDPR) and this DPA, and will allow for and contribute to audits, including inspections, conducted by the Data Vendor or another auditor it mandates, in the manner set out in this Clause 11.

11.2 Security documentation. HUD will satisfy Clause 11.1 primarily by making available through the Trust Center, on request and subject to confidentiality, HUD's then-current SOC 2 report (currently a SOC 2 Type I report, with a SOC 2 Type II report to be made available once issued) and the security policies and documents listed there.

11.3 Further audit. The Data Vendor (or an independent auditor it appoints) may conduct an audit only where (a) the documentation in Clause 11.2 is insufficient to demonstrate HUD's compliance with this DPA; (b) required by a supervisory authority or by Applicable Data Protection Law (including the SCCs); or (c) following a Personal Data Breach affecting Data Vendor Personal Data. Any such audit:

(i) is limited to once in any 12-month period, except under (b) or (c) above;

(ii) requires at least 30 days' written notice and a mutually agreed scope, start date, duration and confidentiality controls;

(iii) takes place during business hours, without unreasonable disruption to HUD's operations, and without access to other customers' data or HUD's privileged information;

(iv) is at the Data Vendor's cost, including HUD's reasonable costs, notified with their basis in advance; and

(v) may be conducted only by an auditor bound by confidentiality who is suitably qualified and independent and not a competitor of HUD; HUD may object to an auditor on those grounds, in which case the Data Vendor will appoint another auditor or conduct the audit itself.

11.4 Results. Audit reports are HUD's Confidential Information. HUD will, within a reasonable period, address any material non-compliance an audit identifies.

11.5 SCC audits. Where the SCCs apply, this Clause 11 is the agreed manner of carrying out audits under Clause 8.9 of the SCCs, and nothing in it limits the rights of the Data Vendor or a supervisory authority under the SCCs.

12. International transfers

12.1 Processing locations. Subject to this Clause 12, HUD and its Sub-processors may Process Data Vendor Personal Data in the United States and in any other country in which HUD or its Sub-processors maintain facilities, as identified on the Sub-processor Page. This DPA and the Sub-processor Page constitute the Data Vendor's Instructions for such transfers.

12.2 Restricted Transfers. Where Applicable Data Protection Law requires a transfer mechanism to enable the lawful transfer of Data Vendor Personal Data to a country outside the jurisdiction in which it is subject to that law (a "Restricted Transfer"), the Restricted Transfer will be made under (a) an alternative transfer mechanism adopted by HUD under Clause 12.4 that covers it; or (b) failing that, the SCCs in accordance with Clause 12.3. No transfer mechanism is required for a transfer to a country or recipient that Applicable Data Protection Law recognises as providing an adequate level of protection.

12.3 Standard Contractual Clauses. For each Restricted Transfer from the Data Vendor to HUD that is subject to the EU GDPR, the SCCs are incorporated into this DPA by reference and deemed executed by the parties on the Effective Date. Module 2 (controller-to-processor) applies where the Data Vendor is a Controller, and Module 3 (processor-to-processor) applies where the Data Vendor is a Processor. Clause 7 (docking) applies; Clause 9(a) Option 2 (general written authorisation) applies, with the notice period in Clause 6.2 of this DPA; the optional wording in Clause 11(a) does not apply; the competent supervisory authority under Clause 13 is determined in accordance with that Clause; and the law and courts under Clauses 17 and 18 are those of Ireland. Annexes I, II and III of the SCCs are completed by Annexes 1, 2 and 3 of this DPA respectively.

12.4 Alternative transfer mechanisms. If HUD adopts an alternative mechanism recognised under Applicable Data Protection Law for Restricted Transfers (including certification under the EU-U.S. Data Privacy Framework), HUD will inform the Data Vendor, and that mechanism will apply in place of the SCCs to the Restricted Transfers it covers. If that mechanism ceases to be valid, the SCCs will apply to those Restricted Transfers automatically.

12.5 Onward transfers. HUD will ensure that any Restricted Transfer of Data Vendor Personal Data from HUD to a Sub-processor is made under a transfer mechanism recognised by Applicable Data Protection Law, which may include Module 3 of the SCCs or the Sub-processor's certification under the EU-U.S. Data Privacy Framework.

12.6 Third-party Controllers. Where the Data Vendor is a Processor, the Data Vendor acknowledges that HUD may be unable to identify the third-party Controller. The Data Vendor will forward to that Controller, promptly and without undue delay, any notice that refers to the SCCs, and will fulfil on HUD's behalf any obligation HUD owes to that Controller under Module 3.

12.7 Supplementary information. HUD will provide information reasonably requested by the Data Vendor to assess a Restricted Transfer, including to complete any transfer impact assessment required by Clause 14 of the SCCs.

12.8 No modification; precedence. Nothing in this DPA or the Agreement is intended to modify or contradict the SCCs or to prejudice the fundamental rights or freedoms of data subjects. In case of conflict between the SCCs and the remainder of this DPA or the Agreement, the SCCs prevail.

13. Return and deletion

13.1 End of Services. At the Data Vendor's choice, HUD will delete or return all Data Vendor Personal Data after the end of the provision of the Services, and delete existing copies, unless applicable law requires storage.

13.2 Mechanics. The Data Vendor may request return, in a commonly used machine-readable format, by notice within 30 days after termination or expiry of the Services. After that period (or earlier on the Data Vendor's instruction), HUD will delete or anonymise Data Vendor Personal Data on its active systems within 90 days. Copies in backups will be deleted in the ordinary backup rotation within 180 days and kept isolated and protected from further Processing in the meantime. On request, HUD will confirm deletion in writing.

13.3 Exclusions. This Clause 13 does not apply to (a) Processed Datasets released to Data Recipients at the Data Vendor's Instruction; (b) Deidentified Data created in accordance with Clause 5.5; or (c) data HUD must retain to comply with law, which HUD will continue to protect under this DPA and use only for that purpose.

14. Liability and indemnity

14.1 Cap. Each party's liability arising out of or relating to this DPA (and, to the extent permitted by law, the SCCs) is subject to the limitations and exclusions of liability in the Agreement, and this DPA does not create a separate or additional cap. The Data Vendor's obligations under Clause 14.2 are not subject to any limitation or exclusion of liability in the Agreement or this DPA. Nothing in this Clause 14 limits either party's liability to data subjects under the SCCs or under Applicable Data Protection Law where such limitation is not permitted.

14.2 Data Vendor indemnity. The Data Vendor will defend and indemnify HUD and its affiliates against all losses, fines, penalties, claims and reasonable costs (including legal fees) arising from (a) any breach of Clause 4; (b) Processing performed by HUD in accordance with the Instructions, including releases under Clause 3.5; or (c) any claim by an End User, Controller, Data Recipient or regulator relating to the Data Vendor's collection of, or lawful basis for, Data Vendor Personal Data.

14.3 Allocation. Where both parties are responsible for the same damage under Applicable Data Protection Law (including Article 82 of the EU GDPR), each party bears liability in proportion to its responsibility.

15. General

15.1 Term. This DPA remains in force until HUD has deleted or returned all Data Vendor Personal Data under Clause 13, whether or not the Agreement has ended.

15.2 Order of precedence. In case of conflict: (a) the SCCs (where applicable) prevail over this DPA; (b) this DPA prevails over the Agreement and any Order Form on matters of data protection; and (c) otherwise the Agreement prevails.

15.3 Changes to this DPA. HUD may update this DPA from time to time by posting a revised version and updating the "Last updated" date. HUD will not make any change that (a) materially reduces the protection of Data Vendor Personal Data; (b) expands the scope of, or removes restrictions on, HUD's Processing of Data Vendor Personal Data; or (c) has a material adverse impact on the Data Vendor's rights under this DPA, unless the change is required to comply with Applicable Data Protection Law or a binding order of a regulator or court, in which case HUD will give at least 30 days' notice to the Notification Email Address where practicable. Changes take effect on the date stated in the revised DPA.

15.4 Notices. HUD may give notices under this DPA (including breach notifications) by email to the Notification Email Address, or through the HUD platform. The Data Vendor is responsible for keeping its Notification Email Address current. The Data Vendor may contact HUD about this DPA at privacy@hud.ai and about security matters at security@hud.ai.

15.5 Governing law and jurisdiction. This DPA is governed by the law and subject to the jurisdiction specified in the Agreement, save that the SCCs are governed by the law and courts specified in Clause 12.3.

15.6 Severability. If any provision of this DPA is invalid or unenforceable, the remainder will continue in effect, and the invalid provision will be amended to the minimum extent necessary to make it valid while preserving the parties' intent.

Annex 1: Details of processing

This Annex also completes Annex I of the SCCs. Engagement-specific details (including any permitted Sensitive Data, release standard and Data Recipients) are set out in the applicable Order Form.

A. List of parties

B. Description of processing

Annex 2: Technical and organisational measures

This Annex also completes Annex II of the SCCs. HUD maintains an information security programme of security controls published on the Trust Center, and has attained SOC 2 Type I compliance, with a SOC 2 Type II audit in progress. The measures below summarise that programme; HUD may update them under Clause 7.2.

Annex 3: Authorised sub-processors

This Annex also completes Annex III of the SCCs. The Sub-processors authorised under Clause 6 are those listed at https://trust.hud.ai/subprocessors, as updated from time to time in accordance with Clause 6.