Data Processing Addendum

1. Introduction and Scope

This Data Processing Addendum ("DPA") forms part of the agreement governing the use of services provided by Sigma Automate, Inc. ("Sigma"), including Sigma's Terms of Service, applicable subscription agreements, master services agreements, order forms, or other written agreements (collectively, the "Agreement").

This DPA establishes the parties' respective obligations regarding the processing of Personal Data by Sigma on behalf of its customers ("Customer") in connection with Sigma's software, platforms, and related services (the "Services").

This DPA applies only to the extent that Sigma processes Personal Data on behalf of Customer and such processing is subject to applicable Data Protection Laws.

Where the Agreement incorporates this DPA by reference, this DPA forms part of the Agreement without requiring separate execution. Where a separately executed data processing agreement applies, that agreement will control unless the parties agree otherwise.

2. Definitions

For purposes of this DPA:

"Applicable Data Protection Laws" means applicable laws and regulations governing the privacy, protection, security, or processing of Personal Data, including, where applicable, the European Union General Data Protection Regulation ("GDPR"), the United Kingdom GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), and other applicable U.S. state privacy laws.

"Customer Personal Data" means Personal Data processed by Sigma on behalf of Customer in connection with the Services.

"Controller" means the entity that determines the purposes and means of processing Personal Data.

"Processor" means the entity that processes Personal Data on behalf of a Controller.

"Personal Data" means information relating to an identified or identifiable natural person, or other information defined as personal data or personal information under Applicable Data Protection Laws.

"Processing" means any operation performed on Personal Data, including collection, access, storage, use, disclosure, transmission, modification, or deletion.

"Personal Data Breach" means a breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by Sigma.

"Subprocessor" means a third party engaged by Sigma to process Customer Personal Data on behalf of Customer in connection with the Services.

Terms not otherwise defined have the meanings assigned under Applicable Data Protection Laws or the Agreement.

3. Roles and Responsibilities

3.1. Customer Responsibilities

Customer acts as the Controller of Customer Personal Data or, where Customer processes Personal Data on behalf of another Controller, as a Processor.

Customer is responsible for:

• Determining the purposes and lawful basis for processing Customer Personal Data.

• Providing legally required notices and obtaining necessary authorizations or consents.

• Ensuring that Personal Data submitted to or made accessible through the Services is processed lawfully.

• Establishing appropriate access permissions and authorization controls.

• Providing lawful and documented processing instructions to Sigma.

• Ensuring that its use of the Services complies with Applicable Data Protection Laws.

3.2. Sigma Responsibilities

Sigma acts as a Processor, or Subprocessor where applicable, when processing Customer Personal Data on behalf of Customer.

Sigma will process Customer Personal Data only in accordance with Customer's documented instructions, including the Agreement and this DPA, unless otherwise required by applicable law.

Sigma will notify Customer if it determines that an instruction infringes applicable Data Protection Laws, unless prohibited from doing so by law.

3.3. Independent Processing

This DPA does not govern Personal Data that Sigma processes as an independent Controller for its own legitimate business purposes, such as account administration, business communications, billing, or website operations. Such processing is governed by Sigma's Privacy Policy and applicable law.

4. Processing of Personal Data

4.1. Processing Instructions

Customer instructs Sigma to process Customer Personal Data as reasonably necessary to:

• Provide, maintain, operate, and support the Services.

• Perform infrastructure automation and orchestration functions authorized by Customer.

• Enable configuration and secrets management functionality.

• Facilitate integrations with Customer-authorized infrastructure, applications, and systems.

• Perform troubleshooting, maintenance, and security operations.

• Comply with documented Customer instructions consistent with the Agreement.

Sigma will not process Customer Personal Data for purposes unrelated to providing the Services unless authorized by Customer or required by applicable law.

If Sigma is legally required to process Customer Personal Data contrary to Customer's instructions, Sigma will notify Customer in advance unless the applicable law prohibits such notice.

4.2. Processing Details

The subject matter, duration, nature, purpose, categories of Personal Data, and categories of Data Subjects are described in Schedule 1.

4.3. Confidentiality

Sigma will ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.

Access to Customer Personal Data will be limited to personnel with a legitimate business need consistent with their responsibilities.

5. Security Measures

Sigma will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against unauthorized access, disclosure, alteration, destruction, or loss.

Such measures will be appropriate to the risks presented by the processing and will include, as applicable:

• Identity and access management controls.

• Role-based access restrictions and least-privilege principles.

• Multifactor authentication for applicable administrative and privileged access.

• Encryption of Personal Data in transit and at rest, where appropriate.

• Logging and monitoring of relevant security events.

• Vulnerability management and security patching processes.

• Secure software development and change management practices.

• Backup, recovery, and business continuity procedures.

• Personnel security awareness and confidentiality training.

• Security incident detection, response, and remediation procedures.

• Appropriate oversight of subprocessors.

Sigma may update its security measures as technologies and security practices evolve, provided such changes do not materially reduce the overall protection afforded to Customer Personal Data.

Customer acknowledges that it remains responsible for configuring and using the Services appropriately, including managing authorized users, credentials, integrations, and access to Customer-controlled systems.

6. Subprocessors

6.1. Authorization

Customer grants Sigma general authorization to engage Subprocessors as reasonably necessary to provide the Services.

Sigma will remain responsible for the performance of its Subprocessors' data protection obligations to the extent required by Applicable Data Protection Laws.

6.2. Subprocessor Requirements

Sigma will enter into written agreements with Subprocessors imposing data protection obligations appropriate to the services performed and substantially equivalent to those applicable to Sigma under this DPA.

6.3. Subprocessor Information and Changes

Sigma will make information about its current Subprocessors available to Customer upon request or through a published Subprocessor list.

Sigma will provide reasonable advance notice of intended additions or replacements of Subprocessors that process Customer Personal Data, allowing Customer an opportunity to object on reasonable data protection grounds.

If Customer objects, the parties will work in good faith to address the concern. If a reasonable resolution cannot be reached, Customer may discontinue the affected Services in accordance with the Agreement and applicable law.

7. Personal Data Breach Notification

Sigma will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data.

Such notification will include, to the extent reasonably available:

• A description of the nature of the breach.

• Categories of Customer Personal Data affected.

• Known or reasonably estimated scope of the incident.

• Measures taken or proposed to contain, investigate, and remediate the incident.

• Information reasonably necessary to assist Customer in meeting applicable notification obligations.

Sigma may provide information in phases as its investigation progresses.

Sigma will take reasonable measures to investigate, contain, mitigate, and remediate the breach and cooperate with Customer as required by Applicable Data Protection Laws.

Notification of an incident does not constitute an admission of fault or liability.

8. Assistance with Data Protection Obligations

Taking into account the nature of the processing and information reasonably available to Sigma, Sigma will provide reasonable assistance to Customer in fulfilling applicable obligations relating to:

• Requests from individuals to exercise their privacy or data protection rights.

• Personal Data Breach assessments and notifications.

• Data protection impact assessments.

• Prior consultations with supervisory authorities where legally required.

• Demonstrating compliance with applicable processor obligations.

Where Customer receives a request from a Data Subject concerning Customer Personal Data processed through the Services, Sigma will provide reasonable assistance consistent with its role as Processor.

If Sigma receives such a request directly, Sigma will, where legally permitted, direct the requester to Customer or notify Customer without independently responding to the substance of the request, unless authorized or legally required to do so.

9. Data Retention and Deletion

Sigma will retain Customer Personal Data only for the duration necessary to provide the Services, comply with documented Customer instructions, or satisfy applicable legal obligations.

Upon termination or expiration of the Agreement, Sigma will, at Customer's choice and subject to applicable law and the Agreement, delete or return Customer Personal Data within a reasonable period.

Sigma may retain information where required by law, provided that retained information remains subject to appropriate confidentiality and security protections and is not processed for unrelated purposes.

Personal Data contained in backup systems may be deleted in accordance with established backup retention and deletion cycles, provided such data remains protected and is not restored to active processing except where necessary for legitimate recovery or compliance purposes.

10. Audits and Compliance Verification

Sigma will make available information reasonably necessary to demonstrate its compliance with the obligations set forth in this DPA.

Such information may include, where available and applicable:

• Independent security assessment or audit reports.

• Security certifications or attestations.

• Relevant summaries of security policies and controls.

• Responses to reasonable security or compliance questionnaires.

Where required by Applicable Data Protection Laws, Sigma will permit and contribute to reasonable audits or inspections concerning the processing of Customer Personal Data.

Audits will be subject to reasonable advance notice, confidentiality protections, security requirements, and procedures designed to avoid disruption to Sigma's operations or exposure of other customers' information.

The parties will first seek to satisfy audit requests through existing documentation and independent assessments where sufficient to meet applicable legal requirements.

11. International Data Transfers

Customer acknowledges that the provision of the Services may involve processing or access to Customer Personal Data across geographic locations, subject to applicable contractual commitments and Data Protection Laws.

Where Customer Personal Data is transferred internationally and Applicable Data Protection Laws require specific safeguards, the parties will implement an appropriate lawful transfer mechanism.

For transfers subject to the GDPR, such mechanisms may include the European Commission's Standard Contractual Clauses ("SCCs"), where applicable, or another valid transfer mechanism recognized under Applicable Data Protection Laws.

Where transfers are subject to United Kingdom data protection requirements, the parties will implement the applicable UK International Data Transfer Addendum, International Data Transfer Agreement, or another valid transfer mechanism.

Any required SCCs or transfer instruments, including applicable modules, annexes, and supplementary measures, will be incorporated through a separate written agreement or addendum between the parties.

Nothing in this DPA authorizes international transfers prohibited by Applicable Data Protection Laws.

12. U.S. State Privacy Law Requirements

To the extent applicable under the CCPA or other U.S. state privacy laws, Sigma acts as a service provider, contractor, or processor with respect to Customer Personal Data.

Sigma will:

• Process Customer Personal Data only for the business purposes specified in the Agreement and this DPA, or as otherwise permitted by applicable law.

• Not sell or share Customer Personal Data as those terms are defined under applicable law.

• Not retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer except as permitted by applicable law.

• Not combine Customer Personal Data with Personal Data obtained from other sources except as expressly permitted by applicable law.

• Provide the level of privacy protection required of service providers, contractors, or processors under applicable law.

• Notify Customer if Sigma determines it can no longer meet its applicable obligations.

• Cooperate with Customer's reasonable requests to verify compliance and remediate unauthorized processing.

Customer may take reasonable and appropriate steps to help ensure that Sigma uses Customer Personal Data consistently with its obligations under applicable privacy laws.

13. Government and Third-Party Requests

If Sigma receives a legally binding request from a government authority or third party seeking disclosure of Customer Personal Data, Sigma will, where legally permitted:

• Notify Customer of the request.

• Review the legal validity and scope of the request.

• Disclose only information legally required.

• Provide reasonable cooperation to Customer in connection with lawful challenges or protective measures.

Sigma will not voluntarily disclose Customer Personal Data in response to an invalid or unauthorized request.

14. Limitation of Liability

The liability of each party arising from or relating to this DPA will be subject to the applicable limitations of liability, exclusions, and other provisions of the Agreement, except to the extent such limitations are prohibited by applicable law or conflict with mandatory provisions of an applicable international data transfer mechanism.

Nothing in this DPA limits the rights of Data Subjects or supervisory authorities where such limitation is prohibited by Applicable Data Protection Laws.

15. Order of Precedence

If a conflict arises between this DPA and the Agreement regarding the processing or protection of Customer Personal Data, this DPA will control solely with respect to that subject matter, except where a separately negotiated and executed agreement expressly provides otherwise.

Where applicable Standard Contractual Clauses conflict with this DPA or the Agreement, the Standard Contractual Clauses will prevail to the extent required by law.

16. Updates to This DPA

Sigma may update this DPA periodically to reflect changes in applicable law, regulatory requirements, or data processing practices.

Sigma will provide notice of material changes in accordance with the Agreement.

Changes that materially diminish Customer's rights or protections regarding Customer Personal Data will not apply to an existing Agreement without Customer's agreement, except where required by applicable law.

17. Contact Information

Questions regarding this DPA or Sigma's processing of Customer Personal Data may be directed to Sigma through its published contact channels.

Schedule 1 — Details of Personal Data Processing

A. Subject Matter

Processing of Customer Personal Data in connection with the delivery, operation, maintenance, support, and security of Sigma's enterprise software and related Services.

B. Duration

For the duration of the Agreement, plus any applicable retention or deletion period required by law or established under the Agreement.

C. Nature and Purpose of Processing

Processing activities may include:

• Authentication and user access management.

• Infrastructure discovery and inventory management.

• Automation, orchestration, and execution of authorized operational workflows.

• Configuration and secrets management.

• Integration with cloud, virtualization, and enterprise IT platforms.

• Technical troubleshooting, logging, monitoring, and support.

• Service maintenance, security, and incident response.

D. Categories of Data Subjects

Depending on Customer's use of the Services, Data Subjects may include:

• Customer employees and contractors.

• Customer-authorized users and administrators.

• Customer IT personnel and service providers.

• Other individuals whose Personal Data may be present in systems, records, or environments made accessible to the Services.

E. Categories of Personal Data

Depending on Customer configuration and use, Customer Personal Data may include:

• Names, business email addresses, and user identifiers.

• Account details, roles, and access permissions.

• IP addresses, device identifiers, and system metadata.

• Authentication and access records.

• Infrastructure inventory and configuration information associated with identifiable individuals.

• Operational logs, diagnostic information, and audit trails.

• Other Personal Data intentionally or incidentally made accessible to the Services by Customer.

Sigma's Services are not specifically designed to process sensitive categories of Personal Data unless expressly agreed between the parties.

F. Categories of Processing Operations

Collection, receipt, access, retrieval, organization, storage, transmission, consultation, use, modification, disclosure to authorized subprocessors, restriction, deletion, and other operations necessary to provide the Services.

G. Processing Instructions

Customer's processing instructions consist of:

• The Agreement.

• This DPA.

• Customer's authorized configuration and use of the Services.

• Additional documented instructions accepted by Sigma.