Data Processing Addendum

"Customer Personal Information" means personal information within Customer Data.

"Privacy Laws" means the U.S. federal and state laws that apply to the processing of Customer Personal Information under the Agreement, including the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 and its regulations ("CCPA"), and other U.S. state comprehensive privacy laws.

"Security Breach" means a breach of WhaTap's security leading to the unauthorized acquisition of, access to, or disclosure, alteration, loss, or destruction of Customer Personal Information. It does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Information, such as pings, port scans, or denial-of-service attacks.

"Subprocessor" means a third party, including a WhaTap Affiliate, that WhaTap engages to process Customer Personal Information.

"Business," "service provider," "controller," "processor," "consumer," "personal information," "sell," and "share" have the meanings given in the applicable Privacy Laws.

2.1 Roles. For the CCPA, Customer is the business and WhaTap is the service provider. Under other Privacy Laws, Customer is the controller and WhaTap is the processor.

2.2 Business purpose and instructions. WhaTap will process Customer Personal Information only to provide, secure, maintain, and support the Service as described in the Agreement, and only on Customer's documented instructions. The Agreement, this DPA, Customer's configuration of the Service (including its Worker collection settings, Approval Configuration, and connected Third-Party Services and AI Clients), and Actions approved under the Agreement are Customer's complete instructions. WhaTap will tell Customer if it believes an instruction violates Privacy Laws, and may decline to follow it.

2.3 Customer obligations. Customer is responsible for the lawfulness of its instructions, for configuring the Worker's collection, and for giving any notices and obtaining any consents required for WhaTap's processing, including for data the Worker collects from Customer's Servers and from AI traffic that Customer routes through the Worker. Customer will not send Prohibited Data.

2.4 Details of processing. Annex 1 describes the nature, purpose, and categories of processing.

WhaTap will not: (a) sell or share Customer Personal Information; (b) retain, use, or disclose it for any purpose other than the business purpose in Section 2.2, or outside the direct business relationship between the parties, except as the CCPA permits; or (c) combine it with personal information WhaTap receives from other sources or collects from its own interactions with consumers, except as the CCPA permits. WhaTap will comply with the obligations the CCPA places on service providers, provide the level of privacy protection the CCPA requires, and notify Customer if it determines it can no longer meet these obligations. Customer may take reasonable and appropriate steps to ensure WhaTap uses Customer Personal Information consistently with Customer's CCPA obligations, and, on notice, to stop and remediate unauthorized use. WhaTap certifies that it understands and will comply with these restrictions.

4.1 WhaTap will ensure that personnel authorized to process Customer Personal Information are bound by confidentiality obligations.

4.2 WhaTap will maintain reasonable security measures appropriate to the nature of the Customer Personal Information, including those described in Annex 2. WhaTap may update those measures but will not materially reduce the overall protection of Customer Personal Information.

5.1 Authorization. Customer authorizes WhaTap to engage Subprocessors. The current list is at virca.ai/subprocessors and forms Annex 3.

5.2 Obligations. WhaTap will enter into a written contract with each Subprocessor that requires it to protect Customer Personal Information in a manner consistent with this DPA, and remains responsible for each Subprocessor's performance.

5.3 New Subprocessors. WhaTap will update the list at least 30 days before a new Subprocessor begins processing Customer Personal Information and will notify Customer's account administrators by email or through the Service. If a replacement is needed urgently for security or continuity reasons, WhaTap may give shorter notice.

5.4 Objection. Customer may object on reasonable data-protection grounds by notice within 15 days after WhaTap's notice. If the parties cannot resolve the objection within 30 days, Customer's sole remedy is to stop using, and terminate its Order Form for, the affected part of the Service, and WhaTap will refund any prepaid fees for the unused remainder of that Order Form.

6.1 Consumer requests. Taking into account the nature of the processing, WhaTap will provide reasonable assistance, primarily through the Service's features, to help Customer respond to consumer requests under Privacy Laws. If WhaTap receives such a request directly, it will refer the consumer to Customer.

6.2 Assessments. WhaTap will provide information reasonably available to it to help Customer complete data protection assessments, risk assessments, and cybersecurity audits required of Customer by Privacy Laws.

6.3 Cost. Assistance beyond what the Service's features provide may be charged at WhaTap's reasonable rates, where the law allows.

7.1 Notice. WhaTap will notify Customer of a Security Breach without undue delay after WhaTap discovers it, and in any case within the time applicable law requires.

7.2 Content. The notice will describe, to the extent known, the nature of the breach, the categories of personal information affected, the measures taken or proposed, and a contact point. WhaTap will provide further information as it becomes available.

7.3 Response. WhaTap will take reasonable steps to contain and remediate the breach and will reasonably cooperate with Customer's notification obligations.

7.4 No admission. WhaTap's notice is not an acknowledgment of fault or liability.

8.1 Questionnaire. On request no more than once a year, WhaTap will respond to Customer's reasonable written security questionnaire and provide information reasonably necessary to demonstrate its compliance with this DPA.

8.2 Further assessments. Only where applicable law requires more than Section 8.1, Customer may conduct an assessment of WhaTap's compliance with this DPA no more than once in any 12-month period, on at least 30 days' notice, during business hours, under confidentiality obligations, on a scope agreed in advance, and at Customer's expense. Customer may use an independent assessor that is not a WhaTap competitor.

9.1 During the Subscription Term, Customer may export Customer Data using the Service's export tools, where available.

9.2 After termination, Customer may request a copy of Customer Data as described in Section 7.6 of the Agreement. At Customer's written request, WhaTap will delete Customer Personal Information and confirm the deletion, except where the law requires WhaTap to keep it or it is stored in backups that are deleted in the ordinary course. Data kept for these reasons remains subject to this DPA.

WhaTap hosts Customer Data in the United States. WhaTap's Affiliates and Subprocessors may access or process Customer Personal Information in the locations listed in Annex 3.

If WhaTap receives a request from a government authority for Customer Personal Information, it will, unless legally prohibited, notify Customer and try to redirect the authority to Customer, and will disclose only what it is legally required to disclose.

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. If this DPA conflicts with the Agreement, this DPA controls for the processing of Customer Personal Information.

---

Outbound-only connection. The Worker opens a single outbound connection to the Service and requires no inbound ports on Customer's Servers.

Encryption in transit. Communication between the Worker and the Service, and web and API access to the Service, is encrypted in transit.

Credentials on Customer's side. Credentials that Functions use on Customer's Servers stay on the Worker side and are not stored in the Service.

Constrained execution. Actions run only as ActionBooks calling registered Functions, each with typed arguments, deny lists, and a declared Severity.

User access controls. The Service supports role-based access, multi-factor authentication, and SAML single sign-on for Customer's Authorized Users.

Worker authentication. Each workspace uses an access key, and each Worker session uses session-specific keys.

Personnel access. WhaTap limits access to Customer Data to personnel who need it to provide, secure, and support the Service.

Hosting. The Service is hosted by Amazon Web Services in the United States.

Subprocessor contracts. Subprocessors are bound by written contracts as described in Section 5.2.

The current list is at virca.ai/subprocessors.