Data Processing Addendum

This Data Processing Addendum ("DPA") is incorporated into, and is subject to the terms and conditions of, NewsCatcher's Terms and Conditions or any other written or electronic agreement covering the Service ("Agreement") between NewsCatcher, Inc. ("NewsCatcher") and the entity identified as "Customer" in the Agreement ("Customer"). This DPA applies where NewsCatcher's Processing of Customer Personal Data is subject to the Data Protection Laws. This DPA shall be effective for the term of the Agreement. Where Customer accepts NewsCatcher's Terms and Conditions online or signs a Services Agreement that incorporates them, this DPA applies automatically from that acceptance or signature and no separate signature of this DPA is required; Customer may request a countersigned copy at support@newscatcherapi.com.

1.1. For the purposes of this DPA:

1.1.1. "Controller" means the entity which determines the purposes and means of the Processing of Personal Data;

1.1.2. "Customer Personal Data" means the Personal Data described under Schedule 1 to this DPA, in respect of which Customer is the Controller;

1.1.3. "CCPA" means the California Consumer Privacy Act and its implementing regulations;

1.1.4. "Data Protection Laws" means all laws relating to data protection and privacy applicable to NewsCatcher's Processing of Customer Personal Data, including without limitation, the CCPA, the GDPR and member state laws implementing the GDPR, the United Kingdom's Data Protection Act 2018, and applicable privacy and data protection laws of any other jurisdiction, each as amended, repealed, consolidated or replaced from time to time;

1.1.5. "Data Subjects" means the individuals identified in Schedule 1.

1.1.6. "GDPR" means the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;

1.1.7. "Personal Data", "Personal Data Breach" and "Processing" will each have the meaning given to them in the Data Protection Laws. The term "Personal Data" includes "personal information," "personally identifiable information," and equivalent terms as such terms may be defined by the Data Protection Laws. The term "Personal Data Breach" includes equivalent terms as defined by the Data Protection Laws;

1.1.8. "Processor" means the entity which Processes Personal Data on behalf of the Controller; and

1.1.9. "Sell" and "Share" have the meaning given in the Data Protection Laws.

1.2. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement.

2.1. The parties acknowledge and agree that Customer is the Controller of Customer Personal Data and NewsCatcher is the Processor of Customer Personal Data. NewsCatcher will only Process Customer Personal Data as a Processor on behalf of and in accordance with Customer's prior written instructions, including any instructions provided through Customer's use of the Service. NewsCatcher is hereby instructed to Process Customer Personal Data to the extent necessary to provide the Service as set forth in the Agreement. NewsCatcher shall not (1) retain, use, or disclose Customer Personal Data other than as provided for in the Agreement, as needed to provide the Service, or as otherwise permitted by Data Protection Laws; or (2) sell or share Customer Personal Data. NewsCatcher shall not combine Customer Personal Data with personal information it receives from other sources or collects from its own interactions with individuals, except as permitted by the CCPA. NewsCatcher certifies that it understands and will comply with the restrictions contained in this Section 2.1.

2.2. NewsCatcher will immediately inform Customer if, in its opinion, an instruction from Customer infringes the Data Protection Laws.

2.3. A description of NewsCatcher's Processing of Customer Personal Data is set forth in Schedule 1.

2.4. If applicable laws preclude NewsCatcher from complying with Customer's instructions, NewsCatcher will inform Customer of its inability to comply with the instructions, to the extent permitted by law.

2.5. Both Customer and NewsCatcher will comply with their respective obligations under the Data Protection Laws.

3.1. NewsCatcher will require NewsCatcher's personnel who access the Customer Personal Data to commit to protecting the confidentiality of Customer Personal Data.

3.2. NewsCatcher will implement commercially reasonable technical and organizational measures that are designed to protect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.

3.3. To the extent required by Data Protection Laws, NewsCatcher will provide Customer with reasonable assistance as necessary for the fulfillment of Customer's obligations under Data Protection Laws to maintain the security of Customer Personal Data.

4.1. Customer agrees that NewsCatcher may engage sub-Processors to Process Customer Personal Data on Customer's behalf. NewsCatcher will inform Customer of any intended changes concerning the addition or replacement of any sub-Processors by updating its published sub-processor list and emailing customers who have subscribed to updates (by writing to support@newscatcherapi.com), and Customer will have an opportunity to object to such changes on reasonable grounds within fifteen (15) business days after being notified. If the parties are unable to resolve such objections, either party may terminate the Agreement by providing written notice to the other party, and NewsCatcher will refund any prepaid, unused fees and credits for the terminated Service.

4.2. NewsCatcher will impose on the sub-Processors substantially the same obligations that apply to NewsCatcher under this DPA. Where any of its sub-Processors fails to fulfill its data protection obligations, NewsCatcher will be liable to Customer for the performance of its sub-Processors' obligations.

Customer is responsible for responding to any Data Subject requests relating to Customer Personal Data ("Requests"). If NewsCatcher receives any Requests during the term, NewsCatcher will advise the Data Subject to submit the request directly to Customer or the appropriate Controller. NewsCatcher will provide the Customer with reasonable assistance to permit the Customer to respond to Requests.

NewsCatcher will notify the Customer without undue delay after it becomes aware of any Personal Data Breach affecting any Customer Personal Data. At the Customer's request, NewsCatcher will promptly provide the Customer with reasonable assistance necessary to enable the Customer to notify Personal Data Breaches to the competent data protection authorities and/or affected Data Subjects, if the Customer is required to do so under the Data Protection Laws. Customer is responsible for complying with Personal Data Breach notification requirements applicable to Customer and fulfilling any third-party notification obligations related to any Personal Data Breach. NewsCatcher's notice of or response to a Personal Data Breach under this Section 6 will not be an acknowledgment or admission by NewsCatcher or any fault or liability with respect to the Personal Data Breach.

NewsCatcher will provide Customer with reasonable assistance to facilitate conducting data protection impact assessments and consultation with data protection authorities, if the Customer is required to engage in such activities under applicable Data Protection Laws, and solely to the extent that such assistance is necessary and relates to the Processing by NewsCatcher of the Customer Personal Data, taking into account the nature of the Processing and the information available to NewsCatcher.

Customer instructs NewsCatcher to delete Customer Personal Data within sixty (60) days of the termination of the Agreement and delete existing copies unless applicable law requires otherwise, with one exception: API request logs, which may contain the text of Customer's queries, are kept in their original form for ninety (90) days and are then stored in compressed archives until they are deleted in periodic storage clean-ups, as described in NewsCatcher's Privacy Policy. Archived logs remain protected by the measures in Annex II and are not used for any other purpose. In the event that NewsCatcher is legally required to retain the Customer Personal Data, NewsCatcher undertakes to destroy the Customer Personal Data at the end of the said legal retention obligation.

9.1. Customer may audit NewsCatcher's compliance with its obligations under this DPA up to once per year. On-site audits are available only to customers with a signed agreement with NewsCatcher; other customers will receive NewsCatcher's most recent Audit Report (see Section 9.4) and written answers to reasonable questions instead. In addition, in the event of a Personal Data Breach or where required by the Data Protection Laws, including where mandated by regulatory or governmental authorities with jurisdiction over Customer Personal Data, Customer or Customer's regulatory or governmental authority may perform more frequent audits (including inspections). NewsCatcher will contribute to such audits by providing Customer or Customer's regulatory or governmental authority with the information and assistance reasonably necessary to conduct the audit, including any relevant records of Processing activities applicable to the Service.

9.2. To request an audit, Customer must submit a detailed proposed audit plan to support@newscatcherapi.com at least one month in advance of the proposed audit start date, unless there is an emergency or crisis situation or such a delay would lead to a situation where the audit would no longer be effective. The proposed audit plan must describe the scope, duration, start date of the audit, and the identity of any third-party Customer the Customer intends to appoint to perform the audit. NewsCatcher will review the proposed audit plan and provide the Customer with any concerns or questions (for example, NewsCatcher may object to the third-party auditor as described in Section 9.3, provide an Audit Report as described in Section 9.4, or identify any requests for information that could compromise NewsCatcher confidentiality obligations or security, privacy, employment, or other relevant policies). The parties will negotiate in good faith to agree on a final audit plan at least 2 weeks before the proposed audit start date (except in a crisis or emergency situation as described above). Nothing in this Section 9 shall require NewsCatcher to breach any duties of confidentiality.

9.3. If a third party is to conduct the audit, NewsCatcher may object to the auditor if the auditor is, in NewsCatcher's reasonable opinion, not suitably qualified or independent, a competitor of NewsCatcher, or otherwise manifestly unsuitable. Such an objection by NewsCatcher will require the Customer to appoint another auditor or conduct the audit itself.

9.4. If the requested audit scope is addressed in an SSAE 18/ISAE 3402 Type 2, ISO, NIST or similar audit report performed by a qualified third party auditor on NewsCatcher's systems that Process Customer Personal Data ("Audit Reports") within twelve (12) months of Customer's audit request and NewsCatcher confirms there are no known material changes in the controls audited, Customer agrees to accept the Audit Report in lieu of requesting an audit of the controls covered by the report. However, the Customer may maintain its decision to carry out an audit, under the conditions set out in this article, if it justifies that the certification and/or audit report provided by NewsCatcher are insufficient in nature, scope, relevance, and quality to meet the objectives of the audit assignment and the key controls identified by the Customer in its initial audit request.

9.5. The audit must be conducted at a mutually agreeable time during regular business hours at the applicable facility, subject to the agreed final audit plan and NewsCatcher's health and safety or other relevant policies, and may not unreasonably interfere with NewsCatcher business activities.

9.6. Any audits are at the Customer's expense.

Customer acknowledges and agrees that NewsCatcher may create de-identified, aggregated usage statistics (such as request volumes, latency and error rates) in accordance with WP29's Opinion 05/2014 on Anonymisation Techniques (or any other amended or revised version) that does not identify Customer or any Data Subject ("Analytics Data"), and use such Analytics Data to operate and improve the Service. Analytics Data never includes the content of Customer's queries, instructions or files, and NewsCatcher does not use Customer Personal Data to train or fine-tune AI models.

11.1. Each party's liability towards the other party under or in connection with this DPA will be limited in accordance with the provisions of the Agreement.

11.2. Customer acknowledges that NewsCatcher is reliant on Customer for direction as to the extent to which NewsCatcher is entitled to Process Customer Personal Data on behalf of Customer in performance of the Service. Consequently, NewsCatcher will not be liable under the Agreement for any claim brought by a Data Subject arising from (a) any action or omission by NewsCatcher in compliance with Customer's instructions or (b) from Customer's failure to comply with its obligations under the Data Protection Laws.

With regard to the subject matter of this DPA, in the event of inconsistencies between the provisions of this DPA and the Agreement, the provisions of this DPA shall prevail.

Where Customer Personal Data is transferred outside the EEA, UK, or Switzerland, such transfers shall be governed by Appendix 2 (International Data Transfers), which forms part of this DPA. NewsCatcher's personnel and contractors located outside the United States, including outside the EEA, may access Customer Personal Data to provide and support the Service, subject to the confidentiality obligations in Section 3.1 and the safeguards in Appendix 2.

1. Categories of Data Subject

The personal data transferred concerns the following categories of "Data Subjects":

• Category 1: Customer's employees, contractors and other authorized users ("Employees"), only to the extent their personal data is included in Customer's inputs. NewsCatcher processes account, billing and usage-log information about these individuals as an independent controller under its Privacy Policy, not under this DPA; and
• Category 2: individuals whose personal data Customer chooses to include in queries, agent instructions, entity lists or files submitted to the Service ("Input Subjects").

2. Types of Personal Data

• Category 1 of Data Subjects: "Employees". Any personal data about Employees that Customer includes in its queries, agent instructions, entity lists or uploaded files. Account, billing and usage-log information is excluded (see Category 1 above).
• Category 2 of Data Subjects: "Input Subjects". Any personal data that Customer chooses to include in its queries, agent instructions, entity lists or uploaded files. NewsCatcher does not require any personal data in these inputs, and Customer should not submit special categories of personal data.

3. Subject-Matter and Nature of the Processing. The subject matter of Processing of Customer Personal Data by NewsCatcher is the provision of the Service to the Customer. Customer Personal Data will be subject to those Processing activities which NewsCatcher needs to perform in order to provide the Service pursuant to the Agreement.

4. Purpose of the Processing. Customer Personal Data will be processed by NewsCatcher for purposes of providing the Service as set out in the Agreement.

5. Duration of the Processing. Customer Personal Data will be processed for the duration of the Agreement, subject to Section 8 of the DPA.

Authorized sub-Processors. To help NewsCatcher deliver the Service, NewsCatcher engages the sub-Processors listed on its sub-processor page. That page forms part of this DPA and is published at https://www.newscatcherapi.com/company/legal/sub-processors, and NewsCatcher will notify Customer of changes as described in Section 4.

This Appendix forms part of the Data Processing Addendum ("DPA") between Customer and NewsCatcher, Inc.

1. Standard Contractual Clauses

1.1 To the extent that Customer Personal Data is transferred from the European Economic Area ("EEA"), the United Kingdom, or Switzerland to a country that has not been recognized by the applicable authority as providing an adequate level of protection for Personal Data, the parties agree that such transfers shall be governed by the applicable Standard Contractual Clauses.

1.2 For transfers subject to Regulation (EU) 2016/679 ("GDPR"), the Standard Contractual Clauses adopted by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914, as amended, replaced or superseded from time to time ("EU SCCs"), are hereby incorporated into and form an integral part of this DPA as though fully set forth herein.

1.3 The parties agree that:

• Module Two (Controller to Processor) shall apply where Customer acts as Controller and NewsCatcher acts as Processor.
• Module Three (Processor to Processor) shall apply where Customer acts as Processor and NewsCatcher acts as Sub-Processor.
• Clause 7 (Docking Clause) shall apply.
• Clause 9 shall apply using Option 2 (General Written Authorization), with changes notified as set out in Section 4 of this DPA.
• Clause 11 (Independent Dispute Resolution) shall not apply.
• Clause 17 (Governing Law): Option 1 applies, and the EU SCCs are governed by the law of Ireland.
• Clause 18 (Choice of Forum and Jurisdiction): disputes arising from the EU SCCs are resolved by the courts of Ireland.

2. United Kingdom Transfers

Where Customer Personal Data is subject to the UK GDPR, the EU SCCs shall be deemed amended by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office ("UK Addendum"), as updated or replaced from time to time.

3. Swiss Transfers

Where Customer Personal Data is subject to the Swiss Federal Act on Data Protection, the EU SCCs shall apply with the modifications required by applicable Swiss law.

4. Order of Precedence

In the event of any conflict or inconsistency between this DPA and the EU SCCs, the EU SCCs shall prevail solely with respect to the relevant international transfer of Customer Personal Data.

5. SCC Annexes

The Annexes required under the EU SCCs are completed by Appendix 3 to this DPA. Appendix 3 is hereby incorporated into and forms an integral part of the EU SCCs.

This Appendix completes the Annexes required under the EU SCCs and is incorporated into and forms an integral part of the EU SCCs.

Annex I: Parties and Description of Transfer

1. List of Parties

Data Exporter: The Customer identified in the Agreement.
Role: Controller, or Processor, where applicable.
Contact details: As specified in the Agreement.
Activities relevant to the transfer: Use of the Services provided under the Agreement.
Signature and date: Execution of the Agreement and this DPA constitutes execution of the incorporated EU SCCs and these Annexes.

Data Importer: NewsCatcher, Inc.
Role: Processor.
Contact details: support@newscatcherapi.com
Activities relevant to the transfer: Provision of the NewsCatcher platform and related services.
Processing instructions: The data importer processes Customer Personal Data solely for the purposes described in the Agreement and this DPA and in accordance with the documented instructions of the data exporter.
Signature and date: Execution of the Agreement and this DPA constitutes execution of the incorporated EU SCCs and these Annexes.

2. Description of Transfer

Purpose of Processing: Provision of the Services under the Agreement.

Categories of Data Subjects:

• Customer employees;
• Customer contractors;
• Authorized users;
• Individuals whose personal data Customer includes in its inputs to the Services.

Categories of Personal Data: As described in Schedule 1 of this DPA.

Special Categories of Personal Data: No special categories of Personal Data are intentionally processed as part of the Services unless submitted by Customer.

Frequency of Transfer: Continuous during the term of the Agreement.

Nature of Processing: Collection, storage, organization, consultation, transmission, hosting, retrieval, deletion and other processing activities necessary for providing the Services.

Duration of Processing: For the duration of the Agreement and any applicable retention period specified in this DPA.

Purpose(s) of Transfer: Provision of the Services under the Agreement.

3. Competent Supervisory Authority

The competent supervisory authority shall be determined in accordance with Clause 13 of the EU SCCs.

Annex II: Technical and Organizational Measures

NewsCatcher maintains appropriate technical and organizational measures designed to ensure a level of security appropriate to the risks associated with the Processing of Personal Data, including:

• Encryption of Personal Data in transit using industry-standard TLS;
• Encryption of Personal Data at rest, where appropriate;
• Role-based access controls implementing the principle of least privilege;
• Multi-factor authentication for privileged accounts;
• Secure authentication and authorization controls;
• Logging and monitoring of production systems;
• Security incident detection, response, and management procedures;
• Regular vulnerability scanning and timely application of security updates;
• Backup, disaster recovery, and business continuity procedures;
• Employee confidentiality obligations;
• Security awareness and privacy training for personnel;
• Vendor risk management procedures;
• Physical security provided by trusted cloud infrastructure providers;
• Annual independent SOC 2 Type II assessment.

NewsCatcher may update these technical and organizational measures from time to time, provided that such updates do not materially diminish the overall level of protection provided to Customer Personal Data.

Annex III: List of Authorized Sub-processors

The list of authorized Sub-processors is set forth on NewsCatcher's sub-processor page referred to in Appendix 1 (Sub-Processors) of this DPA. Appendix 1 is hereby incorporated into this Annex by reference and forms an integral part of the EU SCCs. NewsCatcher shall maintain and update the list of Sub-processors in accordance with Section 4 of this DPA.