Data Processing Agreement

2.1 Controller and Processor

The Parties acknowledge that, with respect to Controller Personal Data, Customer is the Controller and GeoScript is the Processor. GeoScript processes Controller Personal Data only on behalf of and under the instructions of Controller, except where required to do so by applicable law.

2.2 Signal Data Carve-Out

Signal Data collected by the Script from monitored websites is assigned to and owned by GeoScript pursuant to the Terms of Service (§6.1). To the extent Signal Data contains personal data of website visitors, GeoScript processes it as a Processor under Controller's instructions solely for the purpose of providing the Services. GeoScript's use of aggregated, anonymized Signal Data for dataset and product improvement purposes is conducted by GeoScript as a Controller and is not governed by this DPA.

2.3 Controller Responsibilities

Controller warrants and represents that: (a) it has all necessary rights and legal bases to provide Controller Personal Data to GeoScript for processing under this DPA; (b) its instructions for processing comply with Applicable Data Protection Law; (c) it is responsible for the accuracy, quality, and lawfulness of Controller Personal Data; and (d) where required, it has obtained all necessary consents from Data Subjects for the processing described herein, including consents required for the Script's operation on Controller's or its clients' websites.

3.1 Documented Instructions

GeoScript processes Controller Personal Data only on documented instructions from Controller. The Agreement and this DPA constitute Controller's primary instructions. Controller may issue additional instructions via email to hello@geoscript.ai that are consistent with the scope of the Agreement. GeoScript has no obligation to follow instructions that would require processing beyond the scope of the Services or in violation of Applicable Data Protection Law.

3.2 Legal Obligation Override

GeoScript may process Controller Personal Data beyond Controller's instructions where required by applicable law. In such cases, GeoScript will notify Controller of the legal requirement before processing unless prohibited by law from doing so.

3.3 Notification of Unlawful Instructions

If GeoScript determines that a Controller instruction would infringe Applicable Data Protection Law, GeoScript will promptly notify Controller in writing. GeoScript may suspend processing under the challenged instruction until Controller provides a revised lawful instruction.

5.1 Technical and Organizational Measures

GeoScript implements and maintains appropriate technical and organizational measures (TOMs) designed to protect Controller Personal Data against unauthorized access, disclosure, alteration, loss, or destruction, taking into account the state of the art, costs of implementation, nature, scope, context, and purposes of processing, and the risks to Data Subjects. The current TOMs are set out in Annex II of this DPA.

5.2 Updates to Security Measures

GeoScript may update its security measures from time to time, provided that any update does not materially reduce the overall security level afforded to Controller Personal Data. GeoScript will notify Controller of any material reduction in security measures.

5.3 Audit Rights

GeoScript will make available to Controller, upon written request, all information reasonably necessary to demonstrate compliance with this DPA, including summaries of applicable third-party security assessments (which may be redacted to protect confidential information). Controller may, not more than once per calendar year and upon 30 days' prior written notice, request an on-site or remote audit of GeoScript's data processing practices. The scope, timing, and cost of any such audit will be agreed in writing by both Parties in advance. Controller shall bear the reasonable costs of any such audit. Audit results constitute GeoScript Confidential Information.

6.1 Notification Timeline

GeoScript will notify Controller without undue delay, and in any event within 72 hours of becoming aware of a Personal Data Breach affecting Controller Personal Data, to the extent such notification is possible and does not unreasonably delay or impede GeoScript's containment and remediation efforts.

6.2 Notification Content

The breach notification will include, to the extent then known:

• The nature of the Personal Data Breach;
• The categories and approximate number of Data Subjects affected;
• The categories and approximate volume of Controller Personal Data records affected;
• The likely consequences of the breach;
• Measures taken or proposed to address the breach and mitigate its effects;
• Contact information for GeoScript's point of contact for the breach.

Where all information cannot be provided within 72 hours, GeoScript will provide it in phases as it becomes available.

6.3 Regulatory Notification

Controller is responsible for determining whether and how to notify Supervisory Authorities and Data Subjects of a breach. GeoScript will provide reasonable assistance to Controller in meeting its breach notification obligations under Applicable Data Protection Law.

8.1 General Authorization

Controller provides general written authorization for GeoScript to engage Sub-Processors for the processing activities described in this DPA. The current list of approved Sub-Processors is set out in Annex III of this DPA and at geoscript.ai/data-policy#subprocessors.

8.2 Notification of Changes

GeoScript will provide Controller with at least 10 days' prior written notice before adding or replacing a Sub-Processor that will process Controller Personal Data. Notice will be sent to the email address on file for Controller's account.

8.3 Right to Object

Controller may object to the addition or replacement of a Sub-Processor by providing written notice to GeoScript within 10 days of receiving notification. Controller's objection must be based on reasonable grounds relating to data protection. If the Parties cannot resolve the objection within 30 days, either Party may terminate the Agreement on written notice without penalty, with a pro-rata refund of any prepaid fees for the unused portion of the subscription term.

8.4 Sub-Processor Obligations

GeoScript imposes data protection obligations on each Sub-Processor by written contract that are at least as protective as those in this DPA. GeoScript remains fully liable to Controller for the performance of Sub-Processors' data protection obligations.

9.1 Transfer Mechanisms

Where GeoScript processes Controller Personal Data that originates in the EEA, UK, or Switzerland and transfers it to the United States or other non-adequate countries, GeoScript relies on the following lawful transfer mechanisms:

• EU Standard Contractual Clauses (SCCs) — Module 2 (Controller to Processor): the SCCs approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, which are incorporated into this DPA by reference and supplement the applicable clauses in this Agreement. Where the SCCs require Annex information, such information is set out in Annex I and Annex II of this DPA.
• UK International Data Transfer Addendum (IDTA): for transfers subject to UK GDPR, GeoScript relies on the UK IDTA issued by the ICO under s.119A of the Data Protection Act 2018, incorporated by reference.
• EU-U.S. Data Privacy Framework (DPF) / UK Extension: where applicable Sub-Processors are certified under the DPF, GeoScript relies on their DPF certification as an additional or alternative transfer mechanism.

9.2 SCC Precedence

To the extent there is any conflict between the SCCs and this DPA on matters of data protection, the SCCs prevail. Nothing in this DPA contradicts or reduces any rights or obligations of either Party under the SCCs.

9.3 Copies of SCCs

Controller may request a copy of the applicable SCCs and any Transfer Impact Assessment (TIA) by emailing hello@geoscript.ai. GeoScript will provide these within 10 business days.