Data Processing Addendum

Terms governing 4Camp’s processing and protection of Customer Personal Data

Version 1.2 | Effective date: The Effective Date of the Agreement | Last updated: September 28, 2026

This Data Processing Addendum (“DPA”) is between 4Camp, Inc., a Delaware corporation (“4Camp”), and Customer. This DPA is attached to and forms a part of the Master License and Services Agreement (the “Agreement”). This DPA applies where 4Camp Processes Customer Personal Data as a Processor on behalf of Customer in connection with providing the Services, whether Customer acts as a Controller or as a Processor on behalf of another Controller. This DPA will be effective as of the Effective Date set forth in the Agreement. This DPA will terminate automatically upon termination of the Agreement or as earlier terminated pursuant to the terms of this DPA or the Agreement, except that its provisions will continue to apply to Customer Personal Data retained or Processed by 4Camp or its Subprocessors after termination. Capitalized terms not defined in this DPA (including Attachment 1 hereto) will have the meaning given those terms in the Agreement.

1. DATA PROCESSING AND PROTECTION

1.1. Limitations on Use. 4Camp will Process Customer Personal Data for the Purpose and otherwise only: (a) pursuant to Customer’s documented instructions as specified under Section 1.2 (Instructions), including with regard to transfers of Customer Personal Data to a third country; and (b) as otherwise required by applicable laws, provided that 4Camp will inform Customer (unless prohibited by law) of the applicable legal requirement before such Processing. 4Camp will not otherwise: (x) retain, use, or disclose the Customer Personal Data (i) outside of the direct business relationship between the parties or (ii) for any purpose other than for the Purpose; (y) sell or share (as defined by Data Protection Law) the Customer Personal Data; or (z) combine Customer Personal Data with Personal Data 4Camp receives from individuals or other sources, except as permitted by Data Protection Law.

1.2. Instructions. Customer instructs 4Camp to Process Customer Personal Data as necessary to provide the Services and as otherwise authorized or permitted under this DPA and the Agreement, including as specified in Attachment 2 (Scope of Processing). This DPA, the Agreement, and any instructions provided by Customer through configuration tools made available by 4Camp are Customer’s documented instructions regarding 4Camp’s Processing of Customer Personal Data. Additional instructions provided by Customer (if any) require prior written agreement by Customer and 4Camp. Customer will not instruct 4Camp to Process Customer Personal Data in violation of any Data Protection Law. 4Camp may suspend Processing based upon any Customer instructions that 4Camp reasonably suspects violate Data Protection Law, provided 4Camp will promptly inform Customer if 4Camp believes an instruction infringes Data Protection Law. Customer's affirmative selection or activation of a 4Camp-Supplied Model constitutes an instruction to 4Camp to Process Customer Personal Data through the applicable AI Model provider, multi-model supplier, inference provider, and related Subprocessors as necessary to provide the selected functionality. Customer's configuration of a Customer-Supplied Model constitutes an instruction to transmit Customer Personal Data to the provider designated by Customer under Customer's direct relationship with that provider.

1.3. Compliance. Each party will comply with its obligations under Data Protection Law. 4Camp shall promptly notify Customer if it determines that it cannot meet its obligations under Data Protection Law. Upon receiving written notice from Customer that 4Camp has Processed Customer Personal Data without authorization, 4Camp will take reasonable and appropriate steps to stop and remediate such Processing.

1.4. Confidentiality. 4Camp will ensure that persons authorized by 4Camp to Process any Customer Personal Data are subject to appropriate confidentiality obligations.

1.5. Security. 4Camp will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against Security Incidents and provide the level of protection required by Data Protection Law in accordance with Attachment 3 (Data Security Exhibit). 4Camp may amend the technical and organizational measures, provided the new measures do not reduce the level of security provided by Attachment 3 (Data Security Exhibit).

1.6. Disposal. At the choice of Customer, 4Camp will (or will enable Customer through the Services to) return or delete Customer Personal Data following expiration or termination of the Services involving the Processing of such Customer Personal Data. Customer must provide any written instruction to return Customer Personal Data before termination of the applicable license, unless the applicable Service Plan or Order Form expressly permits a later request. Notwithstanding the Agreement's general notice provisions, Customer may deliver a return instruction by postal mail to 4Camp's notice address stated in the Agreement or applicable Order Form, or by email to legal@4camp.ai. The instruction is effective only when received by 4Camp. A permitted later request must be received within the period stated there and applies only to Customer Personal Data still retained by 4Camp at that time. In the absence of a timely return instruction, Customer instructs 4Camp to delete the data in accordance with this DPA. Customer Personal Data retained in backup or disaster-recovery systems will remain protected under this DPA and will be deleted in accordance with 4Camp’s ordinary backup-retention cycle, provided that 4Camp will not restore or otherwise Process such Customer Personal Data except as required for disaster recovery, security, or compliance with applicable law. 4Camp may retain Customer Personal Data to the extent and for the period required by applicable law, during which time 4Camp will Process it only for the purpose requiring retention. The certification of deletion contemplated by Section 8.5 of the SCCs will be provided upon Customer’s written request.

1.7. Deidentified Data. 4Camp may Process Deidentified Data to improve, maintain, secure, support, and administer the Services. 4Camp will not use Customer Personal Data or Deidentified Data to train or fine-tune any artificial-intelligence or machine-learning model, or permit a Subprocessor to do so, except as expressly authorized by Customer in writing. 4Camp will (a) take reasonable measures to ensure the Deidentified Data cannot be associated with an individual and (b) publicly commit to maintain and use Deidentified Data in deidentified form and not attempt to reidentify Deidentified Data except as permitted by Data Protection Law.

2. DATA PROCESSING ASSISTANCE

2.1. Data Subject Rights Assistance. Customer shall be responsible for responding to requests from individuals to exercise rights under Data Protection Law relating to Customer Personal Data (each a “Data Subject Request”). Customer will inform 4Camp of any Data Subject Request to which 4Camp must comply and provide the information necessary for 4Camp to comply with the request. 4Camp will, to the extent permitted by Data Protection Law, notify Customer if 4Camp receives a Data Subject Request. To the extent Customer, in its use of the Services, does not have the ability to address the Data Subject Request, 4Camp will, on Customer’s request, provide commercially reasonable assistance to Customer in responding to such Data Subject Request, to the extent the response to such Data Subject Request is required under Data Protection Law.

2.2. Security Assistance. Taking into account the nature of Processing and the information available to 4Camp, 4Camp will use commercially reasonable efforts to assist Customer in Customer’s efforts to comply with Customer’s obligations to secure Customer Personal Data by providing the information and assistance described in Section 3 (Audits).

2.3. Security Incident Notice and Assistance. 4Camp will notify Customer without undue delay and in no event later than seventy-two (72) hours after becoming aware of a Security Incident affecting Customer Personal Data. An initial notice may be based on information then reasonably available, and 4Camp may provide additional information in phases as its investigation progresses.

To the extent known and reasonably available, 4Camp’s notice will include: (a) the nature and known timeline of the Security Incident; (b) the categories and approximate number of affected individuals and Customer Personal Data records; (c) the known or reasonably suspected cause; (d) the likely consequences of the Security Incident; (e) the containment, mitigation, and remediation measures taken or planned; and (f) contact information for the person or team coordinating 4Camp’s response. 4Camp will provide Customer with material updates as additional information becomes reasonably available.

4Camp will take commercially reasonable steps to contain, investigate, mitigate, and remediate the Security Incident; preserve relevant evidence in accordance with its incident-response and evidence-retention procedures; and provide Customer with reasonable cooperation and information necessary for Customer to comply with applicable notification obligations under Data Protection Law. Nothing in this Section requires 4Camp to disclose information protected by privilege, information relating to another customer, or information that would materially compromise the security of 4Camp’s or another party’s systems.

Customer is responsible for determining whether notice to affected individuals, regulators, or other third parties is required. 4Camp will not provide such notice on Customer’s behalf unless required by applicable law or agreed by the parties in writing. Each party will bear its own costs arising from its performance under this Section, subject to the allocation and limitations of liability in the Agreement and any obligations that cannot lawfully be limited. Notice or cooperation under this Section does not constitute an admission of fault or liability.

2.4. Data Protection Impact Assessment (“DPIA”) and Prior Consultation Assistance. Taking into account the nature of Processing and the information available to 4Camp, 4Camp will provide commercially reasonable assistance to Customer in ensuring compliance with the obligations related to DPIAs and consulting with regulatory authorities.

3. AUDITS

3.1. 4Camp Audits. 4Camp may procure audits by third parties to assess 4Camp’s compliance with the DPA and Data Protection Law (collectively, “Audits”). Subject to the confidentiality obligations set forth in the Agreement, 4Camp will, upon Customer’s request, provide summaries of any then-current Audit reports (“Reports”) available to 4Camp. The Reports will be 4Camp’s Confidential Information.

3.2. Customer Audits. Customer will exercise its audit rights by first requesting the Reports as described in Section 3.1 (4Camp Audits). Customer may request additional information if the Reports do not reasonably demonstrate 4Camp’s compliance with this DPA and/or applicable Data Protection Law. Any on-site audit rights shall be available only to the extent required by applicable Data Protection Law or expressly included in the applicable Service Plan or Order Form. Except in the event of a Security Incident or regulatory investigation, Customer will not request an on-site audit more than once per year, Customer will provide no less than 30 days’ advance notice of its request for an on-site audit, Customer will cooperate in good faith with 4Camp to schedule any such audit on a mutually agreeable date and time during 4Camp’s normal business hours, and Customer will be responsible for all costs associated with the audit. Any such on-site audit must be conducted by Customer or a nationally recognized independent auditor that has agreed to confidentiality provisions reasonably acceptable to 4Camp. Customer is responsible for ensuring that the audit will comply with 4Camp’s applicable on-site policies and procedures and will not unreasonably interfere with 4Camp’s business activities. Customer will provide a written summary of any audit findings to 4Camp, and the results of the audit will be 4Camp’s Confidential Information.

4. SUBPROCESSORS

4.1. Appointment of Subprocessors. Customer authorizes 4Camp to use subcontractors to Process Customer Personal Data in connection with providing the Services (each, a “Subprocessor”). A Subprocessor includes any model provider, multi-model supplier, inference provider, hosting provider, cloud service, or other downstream Processor engaged directly or indirectly by 4Camp or another Subprocessor to Process Customer Personal Data on behalf of 4Camp, including in connection with a 4Camp-Supplied Model. Customer's selection or activation of a 4Camp-Supplied Model does not change the status of a provider that otherwise acts as a Subprocessor. Customer specifically consents to 4Camp's appointment of authorized Subprocessors in accordance with this DPA and Attachment 4.

4.2. Objection Right for New Subprocessors.

4.2.1. Notice of Changes. For Customers using a Self-Service Plan, including a free or evaluation Service Plan, 4Camp will provide notice of an intended addition or replacement of a Subprocessor at least 15 days before engaging the new Subprocessor by posting the change to the Subprocessor List identified in Attachment 4. The date of posting will constitute the date of notice, and Customer is responsible for periodically reviewing the Subprocessor List. For Customers that are not using a Self-Service Plan, 4Camp will provide notice at least 15 days before engaging the new Subprocessor through the contact method specified in the applicable Order Form or, if no method is specified, by written notice to Customer’s designated account or legal contact. An Order Form may provide a longer notice period or additional notification requirements. For clarity, the addition or replacement of a downstream model provider, inference provider, or other provider behind a multi-model supplier constitutes an addition or replacement of a Subprocessor if that provider may receive or Process Customer Personal Data on behalf of 4Camp.

4.2.2. Objection and Opt-Out. Customer may object to a new Subprocessor only on reasonable grounds relating to the protection of Customer Personal Data or Customer’s documented data-location obligations under applicable Data Protection Law. Unless otherwise expressly provided in an applicable Order Form, Customer’s sole and exclusive remedy is to terminate the Services that 4Camp identifies as dependent on the new Subprocessor. Customer must exercise this remedy through 4Camp’s standard cancellation process or by written notice to legal@4camp.ai within 10 days after notice is provided under Section 4.2.1. Termination will become effective immediately before 4Camp begins using the new Subprocessor to Process Customer Personal Data. If Customer does not timely terminate the affected Services, Customer will be deemed not to have objected to the new Subprocessor. 4Camp is not required to discontinue or replace the Subprocessor, modify its Services, or provide an alternative service configuration except as expressly agreed in an applicable Order Form.

4.2.3. Fees Following Opt-Out. Customer will remain responsible for all fees accrued through the effective date of termination. If Customer terminates a prepaid annual Self-Service Plan under Section 4.2.2, 4Camp will calculate the charge for the elapsed portion of the annual term at the then-current price of the corresponding monthly plan as of the date Customer exercises its termination right or, if no corresponding monthly plan is offered, at a prorated portion of the annual plan price. That charge will not exceed the annual fee paid for the affected plan. 4Camp will refund any prepaid fees for that plan in excess of that charge in accordance with Section 3.5 of the Agreement. No additional charge will apply to a free or evaluation Service Plan. If Customer is not using a Self-Service Plan, applicable fees, credits, refunds, and termination consequences will be governed by the applicable Order Form.

4.3. Liability. 4Camp will impose data protection obligations upon any Subprocessor that are no less protective of Customer Personal Data than those included in this DPA. 4Camp will be liable to Customer for any breach of such obligations by its Subprocessors as it would for its own acts and omissions, subject to Section 6 and obligations that cannot lawfully be limited. A Provider Notation is an attribution of a provider's stated practice and is not, solely by being displayed through a Product, an independent data-protection representation, warranty, or additional obligation of 4Camp. This sentence does not reduce 4Camp's responsibility for a Subprocessor's breach of the obligations that 4Camp is required to impose under this DPA or Data Protection Law.

5. DATA TRANSFERS

5.1. Overview. The parties will conduct any transfer of Customer Personal Data subject to the GDPR, UK GDPR, or FADP to a country that is not covered by an applicable adequacy decision (a “Data Transfer”) pursuant to the transfer mechanism applicable under this Section 5. If 4Camp notifies Customer that a Data Transfer may lawfully be conducted pursuant to an alternative transfer mechanism, including the Data Privacy Framework, the parties will rely on that alternative mechanism instead of the otherwise applicable provisions below to the extent permitted by Data Protection Law.

5.2. SCCs. The parties agree to comply with the general clauses of the SCCs. Module 2 (Controller to Processor) will apply where Customer acts as a Controller, and Module 3 (Processor to Processor) will apply where Customer acts as a Processor on behalf of another Controller. In each case, Customer is the “data exporter” and 4Camp is the “data importer.”

5.3. Transfers Subject to Swiss Data Protection Law. If any Customer Personal Data subject to the Swiss Federal Act on Data Protection of September 25, 2020 (the “FADP”) is subject to a Data Transfer, the parties will conduct such transfer pursuant to the SCCs with the following modifications: the competent supervisory authority in Annex I.C under Clause 13 shall be the Federal Data Protection and Information Commissioner; references to a “Member State” and “EU Member State” will not prevent individuals in Switzerland from suing for their rights in Switzerland; and references to “GDPR” in the SCCs will be understood as references to the FADP.

5.4. Transfers Subject to the UK GDPR. Any Customer Personal Data subject to the UK GDPR and a Data Transfer will be governed by the UK Addendum. The parties incorporate by reference the mandatory clauses of the ICO-approved International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, Version B1.0, as revised in accordance with its terms. The information required by Part 1 of the UK Addendum is supplied by this DPA, the Agreement, the applicable Order Form, and the applicable Modules and Appendix Information identified in the SCCs and Attachments 2, 3, and 4.

6. LIMITATION OF LIABILITY

Each party’s and all of its affiliates’ liability, taken together in the aggregate, arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitation of liability in the Agreement. Nothing in this Section 6 is intended to restrict the rights of individuals under Data Protection Law.

7. MISCELLANEOUS

7.1. General Provisions. To the extent there is any conflict between the terms of this DPA, on the one hand, and the applicable SCCs or the UK Addendum, on the other hand, the SCCs or the UK Addendum, as appropriate, will control. Except as specifically modified by this DPA, the terms and provisions of the Agreement remain unchanged and in full force and effect. Except as expressly stated in the SCCs and the UK Addendum, the governing law and forum selection provisions of the Agreement will apply to any disputes arising out of this DPA. Except for updates expressly permitted under Section 1.5, Section 4.2, or Attachment 4, no supplement, modification, or amendment of this DPA will be binding unless executed in writing, including by electronic acceptance, by each party.

7.2. Industry-Specific Regulatory Requirements. The applicable Order Form may identify additional industry-specific privacy, security, or data protection laws or regulations that govern Customer’s use of the Services and 4Camp's Processing of Customer Personal Data on Customer's behalf. Any such laws or regulations shall be deemed included within the definition of Data Protection Law solely for purposes of the applicable Order Form and this DPA.

Attachment 1: Definitions

For purposes of this DPA, the following terms will have the meaning ascribed below:

“CCPA” means the California Consumer Privacy Act of 2018, including (a) as amended by the California Privacy Rights Act of 2020 or otherwise and (b) any regulations promulgated thereunder.

“4Camp” means 4Camp, Inc.

“Controller” means “controller” and “business” (and analogous variations of such terms) under Data Protection Law.

“Customer Personal Data” means Personal Data that 4Camp Processes on behalf of Customer in connection with providing the Services as described in Attachment 2.

“Data Protection Law” means the GDPR, the UK GDPR, the FADP, the CCPA, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Virginia Consumer Data Protection Act, the Utah Consumer Privacy Act, and any other state, federal, or international data protection or privacy laws that apply to 4Camp’s Processing of Customer Personal Data.

“Data Subject” means an identified or identifiable individual to whom Customer Personal Data relates.

“Deidentified Data” means information that cannot reasonably be linked to or associated with Customer or any Data Subject.

“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

“Personal Data” means “personal data” and “personal information” (and analogous variations of such terms) under Data Protection Law.

“Process”, “Processed”, or “Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, extending further to such operation or operations under Data Protection Law.

“Processor” means “processor” and “service provider” (and analogous variations of such terms) under Data Protection Law.

“Purpose” means to provide, operate, maintain, secure, support, and administer the Services. 4Camp’s use of Deidentified Data to improve the Services is governed by Section 1.7.

“SCCs” means Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on SCCs for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (Text with EEA relevance), available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914, as may be replaced or superseded by the European Commission. The parties make the following choices for implementing the SCCs:

• In Clause 7, the optional docking clause will apply.
• The audits contemplated by Section 8.9 shall be conducted according to the audit provisions of this DPA.
• In Clause 9, Option 2 will apply and the time period for notice of Subprocessor changes will be as set forth in this DPA.
• In Clause 11 the optional language will not apply to the SCCs or the UK Addendum.
• In Clause 17, the SCCs shall be governed by the laws of Ireland.
• In Clause 18(b), the parties agree to resolve disputes arising from the SCCs in the courts of Ireland.
• The information needed to complete Annex I of the SCCs is included in Attachment 2 to this DPA.
• The information needed to complete Annex II of the SCCs is included in Attachment 3 to this DPA.
• The Subprocessor List identified and incorporated by reference in Attachment 4 constitutes the agreed Subprocessor List for purposes of Clause 9, Option 2 of Modules 2 and 3 of the SCCs.

“Security Incident” means “personal data breach” and “security incident” (and analogous variations of such terms) under Data Protection Law.

“Services” means the services provided by 4Camp pursuant to the Agreement.

“UK GDPR” means the GDPR as incorporated into the United Kingdom law by the Data Protection Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments, etc.) (EU Exit) Regulations 2019 (each as amended, superseded, or replaced).

“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, Version B1.0, in force 21 March 2022, available at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf. Neither party can terminate the UK Addendum pursuant to Table 4 and Section 19 thereof without the written consent of the other.

Attachment 2 - Scope of Processing

Data exporter

The Customer identified in the Agreement or applicable Order Form. Customer’s address and contact details are those specified in the Agreement, applicable Order Form, or Customer account. Customer’s activities relevant to the transfer are its use and administration of the Services and its submission, configuration, or direction of Customer Personal Data for Processing through the Services. Customer acts as a Controller or Processor, as applicable. The date of signature is the date on which Customer executes or electronically accepts the Agreement, Order Form, or this DPA.

Data importer

4Camp, Inc., 5200 NW 33rd Ave Ste 200-AM260, Fort Lauderdale, FL 33309; privacy and data-protection contact: legal@4camp.ai. 4Camp’s activities relevant to the transfer are the provision, operation, maintenance, security, support, and administration of the Services. 4Camp acts as a Processor. The date of signature is the date on which Customer executes or electronically accepts the Agreement, Order Form, or this DPA.

Competent Supervisory Authority

The supervisory authority determined in accordance with Clause 13 of the SCCs based on the establishment, representative, or relevant data subjects of the applicable data exporter.

Subject-Matter and Duration of Processing

4Camp Processes Customer Personal Data in the course of providing the applicable Services in accordance with the Agreement. Processing will continue until the applicable Services expire or terminate, subject to the return, deletion, backup, and legally required retention provisions of Section 1.6.

Nature and Purpose of Processing

4Camp will Process Customer Personal Data in connection with and for the purpose of providing the Services to Customer pursuant to the Agreement. Depending on Customer’s configuration and use of the Services, Customer Personal Data may be subject to collection, transmission, retrieval, access, transformation, analysis, generation, temporary storage, persistent storage, disclosure to Customer-authorized recipients or services, and deletion. For use cases in which the Services operate principally as a transmission or computation layer, 4Camp will not intentionally retain the substantive Customer Personal Data after completion of the applicable Processing operation, except for temporary technical copies, security or operational records, Customer-selected outputs, or other data retained as described in the applicable Service Plan, Order Form, or Customer configuration.

Types of Customer Personal Data

Depending on Customer’s authorized use of the Services and the applicable Service Plan or Order Form, Customer Personal Data may include business contact information; account and user identifiers; authentication, authorization, and configuration information; communications and support information; billing contacts and transaction metadata; financial, investment, portfolio, health, medical, employment, and government-issued identification information; and any other Personal Data contained in content, documents, records, data sources, prompts, instructions, outputs, or other materials submitted, connected, transmitted, or otherwise made available by or on behalf of Customer through the Services.

Categories of Data Subjects

Depending on Customer’s use of the Services, data subjects may include Customer’s and its affiliates’ personnel, contractors, applicants, clients, customers, prospective customers, end users, patients, members, policyholders, investors, account holders, beneficiaries, counterparties, suppliers, business contacts, and other individuals whose Personal Data is submitted, connected, transmitted, or otherwise made available by or on behalf of Customer through the Services.

Special Categories of Data (as applicable)

The Services may Process special categories of Personal Data and other sensitive or regulated information only to the extent supported by the applicable Service Plan or Order Form. Customer will not submit information requiring regulatory or contractual safeguards beyond those provided by this DPA unless 4Camp has authorized the applicable use case in writing and the parties have entered into any additional agreement required by applicable law.

Frequency of Transfers

Customer Personal Data may be transferred continuously, recurrently, or intermittently during the term, depending on Customer’s use and configuration of the Services.

Processing Locations and Data Residency

Customer Personal Data may be Processed in the United States and in other countries in which 4Camp or its authorized Subprocessors operate, subject to the transfer safeguards required by this DPA. Unless expressly stated in the applicable Service Plan or Order Form, 4Camp does not commit to Process or retain Customer Personal Data exclusively within any particular country, territory, or geographic region. Customer is responsible for determining whether the applicable Service Plan and Customer’s configuration of the Services satisfy any data-location or data-sovereignty requirements applicable to Customer or Customer Personal Data. Customer will not use the Services to Process data subject to a mandatory location requirement unless the applicable Service Plan or Order Form expressly supports that requirement.

Period of Data Retention

Retention varies according to the applicable Processing activity and Customer’s configuration of the Services. Customer Personal Data processed solely for transmission or computation will be retained only for the period reasonably necessary to complete that activity, subject to temporary technical copies and security or operational records. Customer Personal Data processed through functionality involving storage, saved outputs, support, audit records, or other persistent features will be retained in accordance with the Agreement, this DPA, the applicable Service Plan or Order Form, Customer’s configuration, and Customer’s documented instructions. Following expiration or termination of the applicable Services, Customer Personal Data will be returned or deleted as provided in Section 1.6.

Attachment 3 - Data Security Exhibit

1. Program. 4Camp will implement and maintain an information security program containing administrative, technical, and organizational safeguards appropriate to the nature, scope, context, and purposes of the Processing and the risks presented, and designed to meet applicable requirements under Data Protection Law.

2. Access Controls. 4Camp will: (a) abide by the “principle of least privilege,” pursuant to which 4Camp will permit access to Personal Data by its personnel solely on a need-to-know basis; and (b) promptly terminate its personnel’s access to Personal Data when such access is no longer required for performance under the Agreement.

3. Account, Credential, and Access Management. 4Camp will manage the creation, use, review, and termination of credentials under 4Camp’s control that are used to access or administer the 4Camp systems. Such measures will include: (a) unique credentials for individual 4Camp personnel accounts; (b) restricted and controlled privileged and administrative accounts; (c) controls appropriate to the purpose and risk of non-human, service, and application credentials; and (d) prompt revocation or modification of access when no longer required. Customer is responsible for creating, assigning, configuring, reviewing, and terminating Customer-controlled user accounts, credentials, roles, and permissions through the functionality made available by the Products. Customer’s responsibilities for its accounts, Authorized Users, and access configurations are further governed by the Agreement.

4. Multi-Factor Authentication. The Products will enforce multi-factor authentication for Customer-controlled user accounts. 4Camp will require multi-factor authentication for 4Camp-controlled privileged or administrative access to production systems that Process Customer Personal Data. Where supported by the applicable system, 4Camp will also require multi-factor authentication for 4Camp personnel accounts used to access 4Camp email systems and material third-party services that store, Process, transmit, or provide access to Customer Personal Data or are used to administer the Services. Where multi-factor authentication is not technically supported, 4Camp will maintain reasonable alternative access controls appropriate to the associated risk.

5. Vulnerability and Patch Management. 4Camp will maintain a risk-based process designed to identify, assess, prioritize, and remediate vulnerabilities affecting the 4Camp systems. Such process will include monitoring relevant security advisories, periodic vulnerability assessments, and applying security patches and software updates within timeframes appropriate to the severity of the vulnerability, the risk presented, and operational considerations.

6. Security Monitoring and Network Controls. 4Camp will maintain logical access restrictions, network controls, and available platform or cloud-provider security monitoring designed to restrict unauthorized access to the 4Camp systems and identify and respond to suspicious activity. 4Camp will review and respond to security alerts in accordance with its risk-based incident-response procedures.

7. Data Protection and Managed Devices. 4Camp will maintain measures designed to reduce the risk of unauthorized access to, disclosure of, or exfiltration of Personal Data, including least-privilege access controls, encryption, restrictions on privileged access, and centrally administered endpoint or mobile-device-management controls for portable devices authorized to access 4Camp systems.

8. Encryption and Key Management. 4Camp will use industry-standard encryption to protect Customer Personal Data transmitted over public networks and Customer Personal Data retained at rest within production systems or on portable devices under 4Camp’s control. 4Camp will protect encryption keys through restricted privileged access, appropriate separation of access, and key rotation in accordance with 4Camp’s documented key-management practices.

9. Physical Safeguards. 4Camp will maintain reasonable physical safeguards for facilities and devices under its control. Where 4Camp systems are hosted in facilities operated by a third-party hosting provider, 4Camp may rely on that provider’s physical and environmental safeguards, subject to 4Camp’s Subprocessor-management obligations under this DPA.

Attachment 4 - Subprocessors

4Camp may engage third parties to Process Customer Personal Data on its behalf in connection with providing the Services (each, a “Subprocessor”). Customer generally authorizes the Subprocessors identified on the then-current Subprocessor List available at https://www.4camp.ai/legal/subprocessors, which is incorporated into this DPA by reference. The Subprocessor List will identify each direct or downstream Subprocessor that may receive or Process Customer Personal Data on behalf of 4Camp, including the Subprocessor's legal name, primary processing location, and the nature of the services provided. For a 4Camp-Supplied Model, the list will identify each applicable multi-model supplier and each downstream model or inference provider that may receive or Process Customer Personal Data. Identification of a Subprocessor's primary processing location does not constitute a data-residency commitment except as expressly provided in the applicable Service Plan or Order Form.

4Camp may add or replace Subprocessors in accordance with Section 4.2. For Customers using a Self-Service Plan, including a free or evaluation Service Plan, publication of a change to the Subprocessor List constitutes written notice under this DPA, and the date of publication constitutes the date of notice. 4Camp is not required to provide such Customers with a separate, individualized, or customized Subprocessor list or notice. Notice to Customers that are not using a Self-Service Plan will be provided as specified in Section 4.2.1 or the applicable Order Form. 4Camp will not permit a newly added model provider, inference provider, or other downstream provider to Process Customer Personal Data on its behalf before the applicable notice period has expired. If an urgent security risk or provider suspension prevents continued use of an existing Subprocessor, 4Camp may suspend the affected functionality or route Processing to a previously authorized Subprocessor while the notice period for a new Subprocessor runs. The Subprocessor List will state its most recent revision date.

For clarity, the provider or operator of any third-party software, AI Model, large language model, inference service, data source, integration, cloud service, or other third-party service is not a Subprocessor to the extent Customer accesses or uses the service as a Customer-Supplied Model under Customer's own separate account or agreement and the provider Processes Customer Personal Data pursuant to Customer's direct relationship with or independent instructions to that provider rather than on behalf of 4Camp. Customer is responsible for selecting, evaluating, authorizing, configuring, and subscribing to each such Customer-Supplied Model, and its Processing of Customer Personal Data will be governed by the agreements and privacy terms applicable between Customer and the provider. A provider engaged through an account, credential, subscription, agreement, or provider relationship maintained by 4Camp to Process Customer Personal Data on 4Camp's behalf is a Subprocessor subject to this DPA, including where Customer chooses to activate the AI Model and 4Camp integrates, orchestrates, invokes, or routes Customer Personal Data to the provider using 4Camp's credentials or through a multi-model supplier selected by 4Camp. The owner or developer of an AI Model is not a Subprocessor solely because it owns or developed the AI Model if it does not receive or Process Customer Personal Data. Any Provider Notation displayed through a Product identifies a provider-stated practice that 4Camp does not audit or independently verify and does not amend this DPA or create an additional data-protection commitment. This does not limit the obligations imposed on a Subprocessor under this DPA or 4Camp's responsibility under Section 4.3.