Data Protection Addendum

This Data Protection Addendum (“DPA”) is between Savo, Inc. (“Provider”) and Subscriber. This DPA governs Personal Information (as defined below) processed in connection with the Agreement (as defined below). Capitalized terms not defined herein have the meanings set forth in the Agreement.

1. Definition

1. For the purpose of this DPA:

a) “Affiliate” has the same meaning ascribed to it in the Agreement and, if not defined in the Agreement, the means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity.

b) “Agreement” means the contractual agreement(s), including Terms of Service and all subscriptions and addenda, between Provider and Subscriber.

c) “Audio File” means the raw audio recording of Participant User(s) in an event session or interview session.

d) “Controller” means the entity which, alone or jointly with others, determines the purposes and means of processing of Personal Information.

e) “Data Protection Law” means any laws and regulations of the United States or any of its states or territories applicable to the processing of Personal Information under the Agreement, including (where applicable), the California Consumer Privacy Act (“CCPA”), as each is amended, supplemented, or replaced from time to time.

f) “Data Subject” means the individual to whom Personal Information relates.

g) “Data Subject Request” means a written request of a Data Subject or Subscriber by or on behalf of a Data Subject to exercise any rights conferred by Data Protection Law in relation to Personal Information.

h) “Personal Information” means the collection, receipt, recording, organization, structuring, alteration, use, transmission, access, sharing, provision, disclosure, distribution, copying, transfer, storage, management, retention, deletion, combination, restriction, summarizing, aggregation, correlation, inferring, derivation, analysis, adaptation, retrieval, consultation, destruction, disposal or other handling of Personal Information or as such terms are otherwise defined under applicable Data Protection Law.

i) “Personal Information Security Incident” means a confirmed or reasonably suspected accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to or use of Subscriber Personal Information.

j) “Platform” means the Provider’s platform as defined in the Agreement.

k) “Process”, “processed”, or “processing” means the collection, receipt, recording, organization, structuring, alteration, use, transmission, access, sharing, provision, disclosure, distribution, copying, transfer, storage, management, retention, deletion, combination, restriction, summarizing, aggregation, correlation, inferring, derivation, analysis, adaptation, retrieval, consultation, destruction, disposal, or other handling of Personal Information, or as such terms are otherwise defined under applicable Data Protection Law.

l) “Processor” means an entity which processes Personal Information on behalf of a Controller.

m) “Provider Personal Information Purposes” has the meaning given to it in Annex 1B.

n) “Savo Account Data” means any Personal Information that Provider collects from Subscriber or Subscriber’s users for Provider’s account management purposes, such as the contact information of Subscriber’s business representatives and Subscriber’s payment information for the Services.

o) “Savo Account Data Purposes” has the meaning given to it in Annex 1B.

p) “Services” means the services provided by Provider to Subscriber under the Agreement.

q) “Subscriber Data” means all information and data inputted or otherwise submitted by Subscriber, Subscriber’s users (including Account Users and Participant Users), and/or Subscriber’s authorized Affiliates through the use of the Services and Platform.

r) “Subscriber Personal Information” means any Personal Information included in Subscriber Data, excluding Savo Account Data.

s) “Subscriber Personal Information Purposes” has the meaning given to it in Section 3.4.

t) “Sub-processor” means another Processor appointed by a Processor.

u) References to “Business”, “Cross-Context Behavioral Advertising”, “Sell”, “Service Provider”, “Share”, “Supervisory Authority”, and “Targeted Advertising” have the meanings given to them in Data Protection Laws.

2. Role of Parties

2.1. Provider as Processor or Sub-processor for Subscriber Personal Information. For all Subscriber Personal Information processed by Provider in connection with the Services and Platform, Subscriber is the Controller and Provider is a Processor and a Service Provider, except if Subscriber is a Processor, in which case Provider is a Sub- processor of the Subscriber Personal Information. If Subscriber is a Processor of Subscriber Personal Information, then Subscriber represents and warrants that Subscriber’s instructions and processing of Subscriber Personal Information, including its appointment of Provider as a Sub-processor, have been authorized by the respective Controller.

2.2. Provider and Subscriber as Independent Controllers of Savo Account Data. Provider and Subscriber are each independent Controllers (and not joint Controllers) of Savo Account Data.

Data Processing for Subscriber Personal Information

2.3. Subscriber Instructions. The par.es agree that this DPA and the Agreement constitute Subscriber’s documented instructions to Providcompliance with this clause to the Subscriber promptly on request er for the processing of Subscriber Personal Information (“Documented Instructions"). Any processing required outside the scope of these Documented Instructions will require prior written agreement of the par.es, except where otherwise required by applicable law.

2.4. Purpose Limitations. Provider shall process Subscriber Personal Information solely for the Provider Personal Information Purposes described in Annex 1B, except where otherwise required by applicable law. Subscriber discloses Subscriber Personal Information to Provider only for the Provider Personal Information Purposes. Annex 1B provides further details regarding the processing of Subscriber Personal Information, including the categories of data subjects, types of personal data, purpose of transfer and further processing, retention period, and subject maKer, nature, and duration of processing.

2.5. Provider Obligations. In connection with Provider’s processing of Subscriber Personal Information.

a) Provider is prohibited from Selling Subscriber Personal Information or Sharing it with third parties for Cross-Context Behavioral Advertising or Targeted Advertising purposes.

b) Provider is prohibited from retaining, using, or disclosing Subscriber Personal Information for any purposes other than for the Provider Personal Information Purposes or as otherwise permitted by Data Protection Law.

c) Provider is prohibited from retaining, using, or disclosing Subscriber Personal Information for any commercial purposes other than for the Provider Personal Information Purposes, unless expressly permitted by Data Protection Law.

d) Provider is prohibited from retaining, using, or disclosing Subscriber Personal Information outside the direct business relationship between Provider and Subscriber, including combining or updating Subscriber Personal Information with personal information received by Provider from another source or Provider’s own independent interaction with the consumer (not on behalf of Subscriber), unless expressly permitted by Data Protection Law.

e) Provider will comply with all Data Protection Law applicable to its role as a Processor or a Service Provider for Subscriber Personal Information, including providing the same level of privacy protection as required of a Business (as defined in the CCPA) by the CCPA.

f) Provider will notify Subscriber no later than five (5) business days after it makes a determination that it can no longer meet its obligations under Data Protection Law with respect to Subscriber Personal Information.

g) Provider shall notify Subscriber immediately if, in its opinion, any Document Instruction infringes any Data Protection Laws.

h) Subscriber may take the reasonable and appropriate steps set forth in Section 9 to ensure that Provider uses Subscriber Personal Information in a manner consistent with Subscriber’s obligations under Data Protection Law, including the CCPA.

i) In the event of Provider’s unauthorized use of Subscriber Personal Information or a Personal Information Security Incident resulting from an act or omission of Provider, Subscriber may, upon reasonable notice to Provider, take, or require Provider to take, reasonable and appropriate steps, as provided in Section 5.4, to stop and remediate such unauthorized use of Subscriber Personal Information or Personal Information Security Incident.

j) For privacy and security purposes, Subscriber authorizes Provider to delete Audio Files after 30 days and delete Personal Information from transcript logs after three years. Subscriber authorizes Provider to prevent and/or otherwise restrict Subscriber’s access to Audio Files prior to deletion. Subscriber further authorizes Provider to prevent and/or otherwise restrict Subscriber’s access to Personal Information consistent with disclosures to Users that elect confidential or anonymous features of the Services or Platform.

2.6. Subscriber Obligations. Subscriber will use all Subscriber Personal Information solely for the internal business purposes of Subscriber that are not competitive with or a replacement for the Services (“Subscriber Personal Information Purposes”).

a) Subscriber is prohibited from Selling Subscriber Personal Information or Sharing it with third parties for Cross-Context Behavioral Advertising or Targeted Advertising purposes.

b) Subscriber is prohibited from retaining, using, or disclosing Subscriber Personal Information for any purposes other than for the Subscriber Personal Information Purposes or as otherwise permitted by Data Protection Law.

2.7. Subscriber Compliance. Subscriber will comply with Data Protection Law applicable to Subscriber’s role as a Controller and/or a Processor for Subscriber Personal Information. Subscriber, as Controller and/or Processor, shall be responsible for ensuring that, in connection with Subscriber Personal Information:

a) It has complied, and will continue to comply, with all applicable laws relating to privacy and data protection, including the Data Protection Laws.

b) It has, and will continue to have, the right to transfer, or provide access to, the Subscriber Personal Information to Provider for processing in accordance with the terms of the Agreement and this DPA.

3. Sub-processing for Subscriber Personal Information

3.1. Sub-processors. The Subscriber authorizes Provider to engage as a Sub-processor (a) any Sub-processors listed in Annex 3 attached and (b) any Affiliate of Provider to process the Subscriber Personal Information in accordance with the Documented Instructions. Provider shall keep a written record of all Sub-processors and shall, on request, make a copy of this record available to the Subscriber. Provider shall remain fully liable to the Subscriber for the Sub-processor’s performance, as well as for any acts or omissions of the Sub-processor as regards its processing of Subscriber Personal Information.

3.2. Contracts with Sub-processors. Provider shall ensure, before any Sub-processor processes Subscriber Personal Information, that the Sub-processor is contractually bound to terms that are no less restrictive and at least equally protective of Subscriber Personal Information as those imposed on Provider under this DPA and that comply with applicable Data Protection Law. Provider shall provide copies of documentation to evidence its compliance with this clause to the Subscriber promptly on request.

3.3. Changes to Sub-processors. Provider may, by giving no less than thirty (30) calendar days’ notice to Subscriber, add or make changes to the Sub-processors. Subscriber may object to the appointment of an additional or replacement Sub-processor within ten (10) calendar days of a notice provided in accordance with this subsection on reasonable grounds relating to the protection of Subscriber Personal Information, in which case Provider shall have the right to cure the objection through one of the following options:

a) Provider will cancel its plans to use the Sub-processor with regard to Subscriber Personal Information or will offer an alternative to provide the Services and Platform without such Sub-processor.

b) Provider will take corrective steps requested by the Subscriber in its objection (which remove Subscriber’s objection) and proceed to use the Sub-processor with regard to Subscriber Personal Information.

c) Provider may cease to provide, or Subscriber may agree not to use (temporarily or permanently), the Services and Platform which would involve the use of such Sub-processor with regard to Subscriber Personal Information, subject to a mutual agreement of the parties to reduce the remuneration for the Services and Platform considering the reduced scope of the Services and Platform.

If none of the above options are reasonably available and the objection has not been resolved to the mutual satisfaction of the parties within thirty (30) calendar days after Provider’s receipt of Subscriber’s objection, either party may terminate the Agreement and Subscriber will be entitled to a pro-rata refund for prepaid fees for Services and Platform not performed as of the date of termination.

3.4. Emergency replacement. Provider may replace a Sub-processor if the reason for the change is beyond Provider’s reasonable control. In such instance, Provider will notify Subscriber of the replacement as soon as reasonably practicable, and Subscriber shall retain the right to object to the replacement Sub-processor pursuant to Section 4.3 above.

4. Security of Subscriber Personal Information

4.1. Security. Provider shall implement, at its own cost and expense, appropriate technical and organizational measures designed to protect the Subscriber Personal Information from a Personal Information Security Incident and in accordance with Provider’s security standards, including as set forth in Annex 2 attached. These measures shall be of a standard no less than the standards compliant with good industry practice for the protection of Personal Information and of at least the minimum standard required by the Data Protection Laws.

4.2. Provider Personnel. Provider shall take reasonable steps to ensure that only authorized personnel have access to Subscriber Personal Information and to limit access to Subscriber Personal Information to only those employees, agents and contractors that require access to perform their roles and responsibilities in connection with the Provider Personal Information Purposes. Provider shall take reasonable steps to ensure that any persons whom it authorizes to have access to the Subscriber Personal Information, including employees, agents, and contractors:

a) Receive appropriate training regarding their responsibilities and obligations with respect to the processing, protection, and confidentiality of Subscriber Personal Information.

b) Are subject to a duty of confidentiality (whether a contractual or statutory duty) that shall survive termination of their employment and/or contract.

4.3. Deletion or Return of Subscriber Personal Information. Upon termination or expiration of the Agreement, Provider shall, in accordance with the terms of the Agreement, delete or make available to Subscriber for retrieval (in Provider’s discretion) all relevant Subscriber Personal Information in Provider’s possession, save to the extent that Provider is required by any applicable law to retain some or all of the Subscriber Personal Information. In such event, Provider shall extend the protections of the Agreement and this DPA to such Subscriber Personal Information and limit any further processing of such Subscriber Personal Information to only those limited purposes that require the retention, for so long as Provider maintains the Subscriber Personal Information. At Subscriber’s request, Provider shall provide Subscriber with a certificate of destruction and a written log evidencing any retention of Subscriber Personal Information.

4.4. Personal Information Security Incidents. Upon becoming aware of a Personal Informa.on Security Incident, Provider shall notify Subscriber without undue delay and pursuant to the terms of the Agreement, but within no more than ninety-six (96) hours, and shall provide such .mely information as the Subscriber may reasonably require to enable Subscriber to fulfil any data breach reporting obligations under Data Protection Laws. Provider will take steps to immediately identify and remediate the cause of such Personal Information Security Incident. If a Personal Informa.on Security Incident requires notice to any regulator, data subject, or other third party, Subscriber shall have sole control over the content, timing, and method of distribution of any needed notice, unless otherwise required by applicable law; provided that Subscriber must obtain Provider’s written consent to name or otherwise iden.fy Provider in any such no.fica.on. Subscriber shall reimburse Provider all reasonable expenses incurred by Provider in connection with any notice or response with respect to any Personal Information.on Security Incident or other breach of security or confidentiality for which Subscriber is wholly or par.ally responsible.

5. Controller Processing for Savo Account Data

5.1. Controller Compliance. Each party will comply with Data Protection Law applicable to its role as a Controller for Savo Account Data. If a party transfers or provides access to Savo Account Data to the other party, the party initially transferring or providing such data shall be responsible for ensuring that it has, and will continue to have, the right to transfer, or provide access to, such Savo Account Data to the other party for processing in accordance with the terms of the Agreement and this DPA.

5.2. Purpose Limitation. Provider shall process Savo Account Data solely for the Savo Account Data Purposes described in Annex 1B, except where otherwise required by applicable law. Subscriber discloses Savo Account Data to Provider only for the Savo Account Data Purposes. Annex 1B provides further details regarding the processing of Savo Account Data, including the categories of data subjects, types of personal data, purpose of transfer and further processing, retention period and subject matter, nature and duration of processing.

6. [Intentionally Omitted]

7. Cooperation

7.1. Data Subjects’ rights. With respect to Subscriber Personal Informa.on, Subscriber is responsible for responding to Data Subject Requests and any inquiry or communication from a Data Subject. Provider shall provide commercially reasonable assistance, including by appropriate technical and organizational measures as reasonably practicable, to enable Subscriber to respond to any inquiry or communication from a Data Subject or any Data Subject Request related to Subscriber Personal Information. In the event such inquiry, communication, or Data Subject Request is made directly to Provider, Provider shall promptly inform Subscriber by providing the full details of the inquiry, communication, or request. With respect to Savo Account Data, the party that receives an inquiry or communication from a Data Subject or a Data Subject Request shall be responsible for responding it and shall have no obligation to notify the other party; provided however, a party receiving a complaint from a Data Subject rela.ng to the other party (or any act or omission of the other party), must promptly notify the other party by providing the full details of the complaint.

7.2. Data Protection Impact Assessments and Prior Consultation. With respect to Subscriber Personal Information, Provider shall, to the extent required by Data Protection Laws, provide the Subscriber with reasonable assistance with data protection impact assessments or prior consultations with data protection authorities that the Subscriber is required to carry out. With respect to Savo Account Data, each party shall, to the extent required by Data Protection Laws, provide the other party with reasonable assistance with data protection impact assessments or prior consultations with data protection authorities that the other party is required to carry out.

8. Security Reports and Audits

8.1. Security Reports. When available (anticipated 4th Quarter 2026), Provider may provide Subscriber with an annual SOC2 Type II report as evidence of its compliance with the Data Protection Laws and this DPA. If necessary to demonstrate compliance with requirements of the Data Protection Laws, Provider will make available to Subscriber additional information demonstrating such compliance as reasonably requested by Subscriber.

8.2. Audits. When available (anticipated 4th Quarter 2026), Provider may provide Subscriber with an annual SOC2 Type II report to satisfy Subscriber’s obligation to audit Provider under Data Protection Laws and this DPA. If necessary to demonstrate compliance with requirements of the Data Protection Laws, no more than once per year, Subscriber shall have the right to audit Provider’s data privacy compliance upon written request. Subscriber shall bear all costs in connection with such audit and Provider may charge reasonable fees for assistance provided in connection with such audit. If such audit reveals material non-compliance with Provider’s obligations under this DPA, however, then Subscriber shall not be responsible to the Provider for any such fees.

9. Miscellaneous

9.1. This DPA supplements and amends and forms part of the Agreement. Except as amended by this DPA, the Agreement will remain in full force and effect.

9.2. If there is a conflict between the Agreement and this DPA, the terms of this DPA will take precedence.

9.3. Any claims brought under this DPA shall be subject to the terms and conditions, including the exclusions and limitations on liability set forth in the Agreement.

9.4. The applicable law and jurisdiction as set forth in the Agreement apply to this DPA.

9.5. Provider may amend this DPA at any time, which shall be deemed accepted by Subscriber upon 30 days of notice of such amendment to Subscriber and Subscriber’s failure to object in such 30-day period.

9.6. The parties have entered into this DPA by their signatures on the Agreement. This DPA is legally binding on the parties and allows Data Subjects to enforce their rights as set forth in this DPA.

ANNEX 1A: LIST OF PARTIES

Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer]

Name: Subscriber Name on Agreement

Address: Subscriber Address on Agreement

Contact person’s name, position and contact details: As provided in Agreement

Activities relevant to the data transferred: As described in Annex 1B

Signature and Date: on the Agreement

Role (controller/processor): Controller and Processor

Data importer(s):

Name: Savo, Inc.

Address: Savo Address on Agreement

Contact person’s name, position and contact details: As provided in Agreement

Activities relevant to the data transferred: As described in Annex 1B

Signature and Date: on the Agreement

Role (controller/processor): Controller and Processor

ANNEX 1B: DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred

Subscriber Personal Information: Subscriber’s employees, contractors, and other personnel using the Services and Platform as Participant Users in Events.

Savo Account Data: Subscriber’s employees, contractors and other personnel using the Services and Platform as Account Users acting as administrative or business representatives with respect to the Services and Platform.

Categories of personal data transferred

Subscriber Personal Information:

Contact information, such as full name, home or work address, email address, and phone number.
Professional or employment-related information, such as job title, employer information, and work history.
Audio, electronic, visual, or similar information, for example, audio recordings of conversations, screen captures, videos, photos, and images.
Internet and device identifiers, activity and analytics, such as information Provider automatically collects through cookies and similar technologies used on the Platform and in the Services, including user activity on the Platform, browser, operating system, device information, and IP address.
Approximate geolocation when a User is using the Services or Platform.
Preference information, including preferences related to privacy and communications.
Characteristics of protected classifications, such as age, race, color, ancestry, ethnic origin, national origin, citizenship, immigration status, physical or mental disability, gender identity, veteran or military status, or union membership.
Other information Subscriber or Users choose to provide when using the Services or Platform.

Savo Account Data: Contact information, professional or employment-related information, payment information (credit card or account), commercial information (billing history), Savo account login credentials, internet and device identifiers, activity and analytics, approximate geolocation, and preference information.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.	Sensitive data transferred includes the following categories from the above list: account access information and characteristics of protected classifications. Where possible the following safeguards are applied to sensitive data: Encrypted storage, access controls.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).	As transferred by the Subscriber’s Users on an as-needed basis.
Nature of the processing	Provider processes Personal Information, including recording, organizing, storing, retrieving and disclosing Personal Information, as necessary: (a) to fulfill the Provider Personal Information Purposes and the Savo Account Data Purposes, as applicable; and (b) as otherwise instructed by the Subscriber with respect to Subscriber Personal Information.
Purpose(s) of Processing and Purpose(s) of the data transfer and further processing	Provider Personal Information Purposes means to provide, maintain, develop, and improve the Services, comply with Applicable Law and legal process, enforce Savo’s terms and policies, and keep the Services safe; and as otherwise agreed in writing between Subscriber and Provider. Savo Account Data Purposes means the Provider Personal Information Purposes plus to communicate with employees and agents of Subscriber to market the Services and Platform and other of Provider’s other products and services, negotiate additional agreements for products and services, and facilitate the provision of products and services under such additional agreements.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

Subscriber Personal Information: Provider will delete Audio Files after 30 days and delete Personal Information from transcript logs after three years or as otherwise provided in the Agreement. Provider may retain back-ups in line with Provider’s data retention policies, for only as long as is required to meet Provider’s legal, regulatory, and operational requirements, or as necessary for the Provider Personal Information Purposes.

Savo Account Data: For the duration of the business relationship between Provider and Subscriber (including the business relationship with respect to Provider marketing other products and services to Subscriber), as long as is required to meet Provider’s legal, regulatory, and operational requirements, or as necessary for the Savo Account Data Purposes.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

Subscriber Personal Information: The subject matter of the processing is the Services and Platform provided by Provider under the Agreement for the duration of the Agreement. The nature of the processing is described on Annex 3.

Savo Account Data: The subject matter of the processing is the Savo Account Data Purposes. The nature of the processing is described on Annex 3.

ANNEX 2: TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Data encryption at rest

Data encryption in transit

AWS Secrets Manager

Firebase Authentication and Identity Management

Sentry Logging

Two Factor Authentication

Mobile Device Managemen

Enterprise Password Manager (One Password)

Vanta Trust Center

ANNEX 3: LIST OF SUB-PROCESSORS

The Subscriber has authorized the use of the following Sub-processors:

https://trustcenter.savo.ai/subprocessors