Data Processing Agreement

This Data Processing Agreement (“DPA”) is between Allyx, Inc., a Delaware corporation (“Allyx” or “Processor”), and the entity or individual identified as “Customer” in the applicable Terms of Service or Order Form (“Customer” or “Controller”). By accessing or using the Services, Customer agrees to be bound by this DPA.

This DPA is incorporated into and forms part of the Terms of Service between Allyx and Customer (the “Agreement”). Capitalized terms not defined in this DPA have the meanings given in the Agreement.

Recitals

A. In the course of providing the Services, Allyx may process personal data on behalf of Customer as a data processor.

B. The parties wish to set out their respective rights and obligations with respect to such processing to comply with applicable data protection law, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the UK General Data Protection Regulation (“UK GDPR”), and other applicable privacy laws.

C. The parties agree that this DPA shall supplement and prevail over the Agreement solely with respect to data protection matters.

1. Definitions

“Applicable Data Protection Law” means all laws and regulations applicable to the processing of Personal Data under this DPA, as amended from time to time, including the GDPR, UK GDPR, and any national implementing legislation.

“Customer Personal Data” means any Personal Data contained within Customer Data that Allyx processes on Customer’s behalf in the course of providing the Services.

“Data Subject” means the identified or identifiable natural person to whom Personal Data relates.

“Personal Data” has the meaning given under Applicable Data Protection Law.

“Processing” has the meaning given under Applicable Data Protection Law, and “Process,” “Processes,” and “Processed” shall be construed accordingly.

“Security Incident” means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Customer Personal Data.

“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission under Decision 2021/914/EU, as may be amended or superseded by a competent authority.

“Services” means products, services, websites, and applications provided by Allyx, Inc., together with all associated features, and any updates, enhancements, or modifications thereto.

“Sub-processor” means any third-party processor engaged by Allyx to process Customer Personal Data.

2. Scope and Roles

2.1 Controller and Processor

Customer acts as the Controller of Customer Personal Data, and appoints Allyx to act as its Processor and, where applicable under the CCPA, as its Service Provider, with respect to Customer Personal Data processed in connection with the Services.

2.2 Description of Processing

This DPA applies to the Processing of Customer Personal Data by Allyx in connection with the provision of the Services. The details of the processing activities covered by this DPA are set out in Annex I to this DPA.

2.3 Instructions

Allyx shall process Customer Personal Data only on Customer’s documented instructions and only as necessary to provide the Services, unless required to do so by applicable law. The Agreement, this DPA, any applicable Order Form, and any other written instructions agreed to by Allyx constitute Customer’s documented instructions.

Customer may provide additional instructions in writing, subject to Allyx’s right to charge for implementation costs. If Allyx is required by law to process Customer Personal Data for purposes other than Customer’s instructions, Allyx shall notify Customer before such processing (unless prohibited by law).

If Allyx believes that a Customer instruction infringes Applicable Data Protection Law, Allyx shall promptly inform Customer.

2.4 Compliance with Law

Each party shall comply with its respective obligations under Applicable Data Protection Law. Customer is responsible for: (a) the lawfulness of its instructions to Allyx; (b) ensuring that Customer has a valid legal basis for processing Customer Personal Data; and (c) providing any required notices to Data Subjects.

Customer shall not, and shall ensure its Authorized Users do not, submit special categories of personal data (Article 9 GDPR) or other sensitive data to the Services except as expressly authorized in writing by Allyx under Section 3.5(c) of the Terms. Any such authorization forms part of Customer’s documented processing instructions.

3. Security

3.1 Technical and Organizational Measures

Allyx shall implement and maintain appropriate technical and organizational security measures to protect Customer Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, or disclosure. As of the effective date, Allyx’s security measures include those set out in Annex II to this DPA.

3.2 Confidentiality of Processing

Allyx shall ensure that persons authorized to process Customer Personal Data are subject to appropriate confidentiality obligations (whether by contract or under applicable law).

3.3 Updates to Security Measures

Allyx may update its security measures from time to time to reflect changes in technology and industry practice, provided that such updates do not materially diminish the overall security of Customer Personal Data.

4. Security Incidents

4.1 Notification

Allyx shall notify Customer without undue delay, and in any event within seventy-two (72) hours of Allyx confirming a Security Incident affecting Customer Personal Data. The notification shall include, to the extent known at the time:

(a) a description of the nature of the Security Incident, including the categories and approximate number of Data Subjects affected and the categories and approximate number of records affected;

(b) the name and contact details of Allyx’s data protection contact;

(c) the likely consequences of the Security Incident; and

(d) the measures taken or proposed to be taken to address the Security Incident, including measures to mitigate its possible adverse effects.

Where it is not possible to provide all information within 72 hours, the initial notification shall contain the information then available, with further information provided promptly thereafter.

4.2 Cooperation

Allyx shall cooperate reasonably with Customer’s investigation and mitigation of a Security Incident. Customer is solely responsible for making any notifications to supervisory authorities and Data Subjects that may be required under Applicable Data Protection Law.

5. Sub-processors

5.1 Authorization

Customer hereby provides general authorization to Allyx to engage Sub-processors, subject to the requirements of this Section 5.

5.2 Current Sub-processors

The Sub-processors currently authorized to process Customer Personal Data are listed in Annex III to this DPA and at fairleadhq.com/legal/subprocessors.

5.3 Changes to Sub-processors

Allyx shall give Customer at least thirty (30) days’ prior written notice (which may be provided by email or by posting an update to fairleadhq.com/legal/subprocessors) before engaging a new Sub-processor or making a material change to an existing Sub-processor.

If Customer reasonably objects to a new or changed Sub-processor on data protection grounds, Customer shall notify Allyx in writing within thirty (30) days of receiving notice. The parties shall negotiate in good faith to resolve the objection. If the objection is not resolved within a further thirty (30) days, Customer may terminate the Services by providing thirty (30) days’ written notice to Allyx, and Allyx shall provide a pro-rata refund of any prepaid Fees covering the period after termination.

5.4 Sub-processor Obligations

Allyx shall impose on each Sub-processor data protection obligations that are no less protective of Customer Personal Data than those imposed on Allyx by this DPA. Where a Sub-processor processes Customer Personal Data outside the EEA, UK, or Switzerland, Allyx shall ensure an appropriate transfer mechanism (such as the Standard Contractual Clauses) is in place with that Sub-processor. Allyx remains responsible and liable to Customer for the acts and omissions of its Sub-processors (including onward transfers) to the same extent Allyx would be liable if performing the Sub-processor’s services directly.

6. Data Subject Rights

Allyx shall provide Customer with reasonable technical assistance to enable Customer to respond to Data Subject requests to exercise rights under Applicable Data Protection Law (including rights of access, rectification, erasure, portability, restriction, and objection). If Allyx receives a request directly from a Data Subject purporting to relate to Customer Personal Data, Allyx shall promptly forward the request to Customer and shall not respond to the request except as instructed by Customer or required by law.

7. Data Protection Impact Assessments

To the extent required by Applicable Data Protection Law, Allyx shall provide Customer with reasonable assistance in conducting data protection impact assessments and, where required, in consulting with supervisory authorities, taking into account the nature of the processing and the information available to Allyx.

8. Data Deletion

8.1 Upon Termination

This DPA is terminated upon the termination or expiration of the Agreement. Unless required or permitted by applicable law, Allyx will delete all remaining copies of Customer Personal Data within sixty (60) days following termination or expiration of the Agreement.

8.2 Retention by Law

Notwithstanding Section 8.1, Allyx may retain Customer Personal Data to the extent required by applicable law, provided that Allyx continues to protect such data in accordance with this DPA and only processes it to the extent necessary for the required purpose.

9. Audit Rights

9.1 Information and Audit

Customer may, no more than once per calendar year (unless there is a reasonable cause related to a Security Incident or regulatory requirement), request information from Allyx to demonstrate compliance with this DPA by:

(a) requesting that Allyx complete a reasonable written questionnaire provided by Customer; or

(b) conducting an audit of Allyx’s processing activities, upon at least thirty (30) days’ prior written notice, at Customer’s cost, during Allyx’s normal business hours, and subject to reasonable confidentiality obligations.

Audits shall be conducted in a manner that minimizes disruption to Allyx’s operations and shall not unreasonably access information belonging to other Allyx customers.

9.2 Certifications

Where Allyx holds relevant third-party security certifications or audit reports (such as a SOC 2 Type II report or ISO/IEC 27001 certificate), Allyx may satisfy Customer’s audit request by providing such certifications or reports (or summaries thereof), subject to applicable confidentiality terms. As of the effective date, Allyx does not hold such certifications; until it does, Customer’s audit rights are exercised under Section 9.1.

10. International Data Transfers

10.1 Transfers from EEA/UK to United States

Where Customer Personal Data is transferred from the EEA, UK, or Switzerland to the United States or another country not recognized as providing an adequate level of data protection, such transfers shall be governed by the Standard Contractual Clauses, which are incorporated into this DPA by reference as follows:

• For EEA transfers: Module Two (Controller to Processor) of the SCCs adopted by the European Commission under Decision 2021/914/EU, with Customer as “data exporter” and Allyx as “data importer.”
• For UK transfers: The UK International Data Transfer Addendum to the EU SCCs (IDTA) as issued by the Information Commissioner’s Office, incorporated by reference.
• For Swiss transfers: The Swiss Standard Contractual Clauses as applicable.

The details required by the SCCs (including processing purposes, categories of data, and technical measures) are set out in the Annexes to this DPA.

10.2 Supplementary Measures

Allyx shall implement and maintain supplementary measures as necessary to ensure that transfers of Customer Personal Data to Sub-processors comply with Applicable Data Protection Law.

10.3 Conflicts with SCCs

In the event of a conflict between this DPA and the SCCs incorporated under Section 10.1, the SCCs shall prevail solely to the extent necessary to resolve the conflict.

10.4 Data Privacy Framework

Where Allyx is certified under the EU-U.S. Data Privacy Framework (and, as applicable, the UK Extension and the Swiss-U.S. Data Privacy Framework), Allyx may rely on such certification as the transfer mechanism for the relevant transfers in lieu of the SCCs. As of the effective date, Allyx is not certified under the Data Privacy Framework and relies on the SCCs (Section 10.1); this Section 10.4 will apply if and when Allyx self-certifies.

11. Liability and Indemnification

Each party’s liability under this DPA is subject to the limitations set forth in the Agreement. For the avoidance of doubt, claims arising under or in connection with this DPA — including claims arising from a Security Incident or a breach of data-protection obligations — are subject to the limitations of liability in the Agreement, including any exclusions and carve-outs in Section 10 of the Terms. Nothing in this DPA limits a party’s liability to Data Subjects or supervisory authorities, or in respect of a party’s obligations under Applicable Data Protection Law.

12. General

12.1 Precedence

In the event of a conflict between this DPA and the Agreement, this DPA shall prevail solely with respect to data protection matters.

12.2 Governing Law

This DPA shall be governed by the laws of the State of Delaware, without prejudice to the application of Applicable Data Protection Law and the exclusive jurisdiction of supervisory authorities and courts in the EEA or UK for GDPR/UK GDPR matters.

12.3 Amendment

Allyx may amend this DPA to reflect changes in Applicable Data Protection Law.

12.4 Severability

If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

13. Government and Law-Enforcement Access Requests

13.1 Handling of Requests

If Allyx receives a legally binding request from a public authority, court, or law-enforcement body for disclosure of Customer Personal Data (a “Government Access Request”), Allyx shall, unless legally prohibited:

(a) promptly notify Customer of the request so that Customer may seek a protective order or other appropriate remedy;

(b) inform the requesting authority that Allyx is a processor acting on Customer’s behalf and that the request should be directed to Customer where possible;

(c) review the legality of the request and challenge any request that Allyx considers to be unlawful, overbroad, or disproportionate, including by pursuing available avenues of appeal where there is a reasonable legal basis to do so; and

(d) disclose only the minimum amount of Customer Personal Data necessary to respond to the request.

13.2 Prohibition on Notice

If Allyx is legally prohibited from notifying Customer of a Government Access Request, Allyx shall use reasonable efforts to obtain a waiver of that prohibition and shall document its efforts so as to provide the information to Customer as soon as it is legally permitted to do so.

13.3 Records

Allyx shall maintain a record of Government Access Requests relating to Customer Personal Data and shall make summary information available to Customer on reasonable request, to the extent legally permitted.

14. US State Privacy Laws Addendum

14.1 Scope

This Section 14 applies to the extent Allyx processes Customer Personal Data that is subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”), or to other applicable US state privacy laws (including, but not limited to, the Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, and Texas TDPSA) (together, “US State Privacy Laws”). Terms such as “Business,” “Service Provider,” “Contractor,” “Controller,” “Processor,” “Sell,” “Share,” and “Process” have the meanings given in the applicable US State Privacy Law.

14.2 Roles

With respect to Customer Personal Data subject to the CCPA, Customer is the Business and Allyx is a Service Provider. Where other US State Privacy Laws apply, Customer is the Controller and Allyx is the Processor.

14.3 Service Provider / Processor Obligations

Allyx shall:

(a) process Customer Personal Data only for the limited and specified business purpose of providing the Services under the Agreement, and shall not retain, use, or disclose it for any other purpose, or outside the direct business relationship with Customer, except as permitted by US State Privacy Laws;

(b) not Sell and not Share Customer Personal Data (as “Sell” and “Share” are defined under the CCPA);

(c) not combine Customer Personal Data with personal information that Allyx receives from, or on behalf of, any other person, or collects from its own interaction with the data subject, except as permitted by the CCPA;

(d) comply with the applicable obligations of a Service Provider/Processor under US State Privacy Laws and provide the same level of privacy protection as required of a Business/Controller; and

(e) promptly notify Customer if Allyx determines that it can no longer meet its obligations under US State Privacy Laws.

14.4 Certification

Allyx certifies that it understands the restrictions set out in this Section 14 and will comply with them.

14.5 Assistance and Oversight

Allyx shall reasonably assist Customer in responding to verifiable consumer requests under US State Privacy Laws (consistent with Section 6) and grants Customer the right to take reasonable and appropriate steps to ensure that Allyx uses Customer Personal Data in a manner consistent with Customer’s obligations under US State Privacy Laws.

14.6 Deidentified Data

If either party processes deidentified data, it shall maintain the information as deidentified, shall not attempt to reidentify it, and shall otherwise comply with the deidentified-data requirements of US State Privacy Laws.

Annex I — Description of Processing

Annex II — Technical and Organizational Security Measures

As of the effective date of this DPA, Allyx implements and maintains the following technical and organizational measures, as applicable to the Services:

Security Management

Allyx maintains technical and organizational safeguards designed to protect Customer Personal Data against unauthorized access, disclosure, alteration, loss, or destruction. Security controls are incorporated into the design, development, deployment, and operation of the Services.

Access Control

Access to Customer Personal Data and production systems is restricted to authorized personnel with a legitimate business need and is granted according to the principle of least privilege.

Administrative access to production infrastructure is protected using multi-factor authentication (MFA), single sign-on (SSO), and role-based access controls, as applicable. Administrative and production system access and activity are logged to support security monitoring and investigation.

Personnel authorized to access Customer Personal Data are subject to confidentiality obligations.

Data Segregation and Processing

Allyx logically segregates Customer Personal Data within its production systems and uses isolated processing environments for execution of customer-specific tasks.

Task execution environments are provisioned with isolated filesystems and are terminated following completion of the applicable task. Customer source code materialized within such environments is retained only for the period necessary to perform the applicable processing.

Customer data stored in shared platform services is separated using account- or tenant-specific access controls and storage boundaries.

Encryption and Key Management

Customer Personal Data transmitted over public networks is protected using industry-standard encryption, including TLS 1.2 or higher.

Customer Personal Data is encrypted at rest using industry-standard encryption mechanisms. Sensitive credentials, access tokens, and platform secrets are additionally protected using managed encryption, key-management, and secrets-management services.

Allyx restricts access to cryptographic keys and secrets according to least-privilege principles.

Network and Infrastructure Security

Allyx uses established cloud service providers to host and operate the Services. Such providers maintain physical, environmental, and infrastructure security controls and independent security assurance programs, including SOC 2 and ISO 27001 certifications, as applicable to their respective services.

Allyx uses network and perimeter security controls appropriate to the Services, including web application firewall (WAF) and distributed denial-of-service (DDoS) protections for public-facing endpoints.

Task execution environments are isolated from direct inbound public internet access. Service-to-service and infrastructure access is restricted according to operational requirements and least-privilege principles.

Secure Development and Change Management

Allyx maintains secure software development and deployment practices designed to reduce the risk of introducing security vulnerabilities into production systems.

Changes to production software are subject to review prior to deployment. Allyx uses automated security checks as part of its software development process, including static application security testing, dependency vulnerability scanning, and secret detection.

Development and production access are controlled and restricted according to their respective operational purposes.

Vulnerability Management and Security Monitoring

Allyx uses automated tools and operational processes to identify security vulnerabilities in application code, software dependencies, and production systems.

Identified vulnerabilities and security issues are evaluated and addressed based on their severity and associated risk.

Allyx monitors production infrastructure for security and operational events and maintains logs designed to support detection, investigation, and response to security incidents.

Data Retention and Deletion

Allyx maintains data retention practices designed to limit retention of Customer Personal Data to periods necessary for providing the Services and satisfying applicable contractual or legal requirements.

Customer source code used in task execution environments is removed following completion of the applicable processing task. Other Customer Personal Data is retained and deleted in accordance with the Agreement, this DPA, and applicable retention settings.

Upon termination of the Services, Customer Personal Data may be exported and will be deleted in accordance with the deletion requirements set forth in this DPA, except where retention is required by applicable law.

Business Continuity and Resilience

Allyx maintains technical measures designed to reduce the risk of service disruption and loss of Customer Personal Data.

Critical production data stores use redundancy and backup mechanisms appropriate to the applicable infrastructure and service.

Allyx uses backup and recovery mechanisms appropriate to the applicable production data store and also relies on the durability, redundancy, and recovery capabilities provided by its managed cloud infrastructure providers.

Sub-processors and Third-Party Infrastructure

Allyx uses established cloud and technology service providers in connection with the processing of Customer Personal Data.

Allyx evaluates the security and data-protection practices of material service providers involved in processing Customer Personal Data and requires such providers to be subject to appropriate contractual data-protection obligations.

Physical security of third-party data centers is managed by the applicable cloud infrastructure providers in accordance with their respective security programs and independent certifications.

Annex III — Authorized Sub-processors

The following Sub-processors are authorized to process Customer Personal Data as of the effective date of this DPA. The current list is maintained at fairleadhq.com/legal/subprocessors.

The current, authoritative list (with vendor trust-center and sub-processor-list links) is published at fairleadhq.com/legal/subprocessors.

Annex IV — Standard Contractual Clauses Reference

The SCCs incorporated by reference in Section 10.1 of this DPA are those adopted by the European Commission on 4 June 2021 under Decision 2021/914/EU (Module Two: Controller to Processor).

• Clause 7 (Docking clause): Not applicable.
• Clause 9 (Use of sub-processors): Option 2 (General written authorization) applies, with the notice period specified in Section 5.3 of this DPA.
• Clause 11 (Redress): The optional language is not included.
• Clause 13 (Supervision): The competent supervisory authority shall be determined based on the Customer’s EEA establishment or habitual residence.
• Clause 17 (Governing law): The SCCs shall be governed by the law of the Member State in which the data exporter (Customer) is established.
• Clause 18 (Choice of forum): Disputes arising from the SCCs shall be subject to the courts of the Member State in which the data exporter (Customer) is established.

Annexes I, II, and III to the SCCs correspond to Annexes I, II, and III of this DPA respectively.

fairleadhq.com/legal/dpa

© 2026 Allyx, Inc. All rights reserved.