This Scribe Data Processing Agreement (this “DPA”) is a part of and incorporated into the Master Services Agreement (“MSA”) by and between Colony Labs, Inc. dba Scribe (“Scribe” or “we” and “us”) and the Customer set forth in the MSA (“Customer” or “you” and “your”), and shall be effective as of the Effective Date as defined and set forth in the MSA. Scribe and Customer are each a “Party” and together are the “Parties”.

In the course of providing the Services to Customer under the MSA, Scribe may process Personal Data on behalf of Customer. All terms of the MSA apply to this DPA; provided that, in the event of any conflict among terms of the MSA and this DPA, the terms of this DPA will take precedence and govern and control to the extent of such conflict. The Parties agree to the following terms with respect to such processing.

1. Definitions.

All capitalized terms not defined herein will have the meaning set forth in the MSA. The terms “Business”, “Consumer”, “Controller”, “Data Subject”, “Processor”, and “Service Provider” have the meanings given to them in Data Protection Laws, or, where not specifically defined, the meanings of analogous terms under Data Protection Laws. For the avoidance of doubt, “Controller” is deemed to also refer to “Business”, and “Processor” is deemed to also refer to “Service Provider”. “Data Subject” is deemed to include “Consumer”.

“Authorized Affiliate” means any Customer Affiliate that is subject to the Data Protection Laws and is permitted to use the Services pursuant to the MSA.

“CCPA” means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et. seq., as amended by the California Privacy Rights Act of 2020 and together with any implementing regulations.

“Customer” means the entity defined and named above and its Authorized Affiliates.

“Customer Account Data” means Personal Data that relates to Customer’s relationship with Scribe, including with respect to provisioning of and access to Customer’s account, and billing information associated with Customer’s account. Customer Account Data also includes any data Scribe Processes in its capacity as a Controller, including with respect to account support, account management, sales and marketing, and other activities not related to the Processing of Content by or within the Services.

“Customer Personal Data” means any information relating to (i) an identified or identifiable natural person and, (ii) an identified or identifiable legal entity (where such information is protected similarly as personal data, personal information, or personally identifiable information under applicable Data Protection Laws), where for each (i) and (ii), such information is Content. For the avoidance of doubt, Customer Personal Data excludes Customer Account Data.

“Data Protection Laws” means the applicable laws, regulations, rules and/or binding guidance and interpretations of the foregoing of the European Union, the EEA, Switzerland, the United Kingdom, the United States, Canada, Australia, Israel, Brazil, Turkey, or any other jurisdiction that govern or otherwise apply to Customer Personal Data Processed under this DPA and the MSA, as each may be supplemented, amended, and updated from time-to-time, including, without limitation, GDPR, FADP, the UK Data Protection Law, Canada’s Personal Information Protection and Electronic Documents Act, Quebec’s Law 25, Brazil’s General Data Protection Law 13.709/2018, and the CCPA.

“EU AI Act” Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828.

“Europe” means the European Union, the European Economic Area, Switzerland, and the United Kingdom.

“FADP” means the Swiss Federal Act on Data Protection of 25 September 2020.

“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) and includes any relevant implementing measure in each relevant Member State.

“Guernsey Addendum” means the Bailiwick of Guernsey (“Guernsey”) Addendum to the EU SCCs completed as described in Schedule 3 (Additional Provisions for Certain Jurisdictions).

“Jersey Addendum” means the Bailiwick of Jersey (“Jersey”) Addendum to the EU SCCs completed as described in Schedule 3 (Additional Provisions for Certain Jurisdictions).

“Process” and its cognates (e.g., “Processing”) means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Scribe Privacy Notice” means the Scribe Privacy Policy available at https://scribe.com/legal/privacy.

“Security Incident” means the unauthorized or unlawful acquisition, destruction, loss, alteration, disclosure of, or access to, Content, Customer Personal Data, and/or Customer Account Data.

“Standard Contractual Clauses” means (i) the Annex to the European Commission’s implementing decision (EU) 2021/914 of 4 June 2021 on Standard Contractual Clauses for the transfer of personal data to processors established in third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of the European Union and subject to required amendments for Switzerland further described in Schedule 3 (Additional Provisions for Certain Jurisdictions) completed as set forth in this DPA (the “EU SCCs”); (ii) the UK Addendum, Jersey Addendum and Guernsey Addendum; (iii) the Standard Contractual Clauses approved by the Resolution CD/ANPD No. 19, August 23, 2024 completed as set forth herein (the “Brazil SCCs”); (iv) Turkish SCCs; and (v) the such other standard contractual clauses and similar instruments referenced and completed in this DPA, including in Schedule 3 (Additional Provisions for Certain Jurisdictions) and any other appendices hereto.

“Subprocessor” means any third-party Processor engaged by the Scribe Group to Process Personal Data.

“Supervisory Authority” means a governmental or government-chartered regulatory body having binding legal authority over Customer or Personal Data pursuant to applicable Data Protection Laws.

“Scribe Group” means Scribe and its affiliates (if any) engaged in the Processing of Personal Data.

“Turkish SCCs” means the Standard Contractual Clauses issued in accordance with the guidelines and regulations of the Turkish Data Protection Authority (KVKK) under the Turkish Data Protection Law No. 6698, as updated or amended, and decision no. 2024/959 and dated 4/6/2024 for the transfer of personal data to third countries or international organizations, completed as described in Schedule 3 (Additional Provisions for Certain Jurisdictions).

“UK Addendum” means the United Kingdom International Data Transfer Addendum to the EU Commission Standard Contractual Clauses available as of 21 March 2022, completed as described in Schedule 3 (Additional Provisions for Certain Jurisdictions).

“UK Data Protection Law” means Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, as may be amended from time to time by the Data Protection Laws of the United Kingdom.

2. Scope and Roles; Processing Details.

2.1. Scope. This DPA will apply only to the extent of the Processing of Personal Data by Scribe in connection with the provision of Services to Customer.

2.2. Roles of the Parties.

2.2.1. Scribe as Processor. In relation to the Processing of Customer Personal Data, Customer is the Controller or a Processor and Scribe is the Processor. The Scribe Group may engage Subprocessors pursuant to the requirements set out in this DPA.

2.2.2. Scribe as a Controller. In relation to the Processing of Customer Account Data, Customer is a Controller and Scribe is an independent Controller, not a joint Controller with Customer. Scribe will Process Customer Account Data as a Controller in order to (a) manage the relationship with Customer; (b) carry out Scribe’s core business operations; (c) detect, prevent, or investigate Security Incidents, fraud, and other abuse or misuse of the Services; (d) perform identity verification; (e) comply with Scribe’s legal, regulatory and compliance obligations; and (f) as otherwise permitted under applicable Data Protection Law and in accordance with this DPA, the MSA, and the Scribe Privacy Notice.

2.3. Details of Processing. The subject matter of the Processing of Personal Data by Scribe is the performance of the Services pursuant to the MSA. The duration of the Processing, the nature and purpose of the Processing, and the types of Personal Data and categories of Data Subjects Processed under this DPA are further specified in Schedule 1 (Details of Processing).

2.4. Compliance with Laws. Each Party will comply with all laws, rules and regulations applicable to it and binding on it in the performance of its respective obligations under this DPA, including Data Protection Laws.

3. Scribe’s Obligations.

3.1. Processing of Customer Personal Data. Scribe will treat Personal Data as Customer’s Confidential Information and will Process Customer Personal Data on behalf of and only in accordance with Customer’s documented instructions for the following purposes: (i) Processing in accordance with the MSA and applicable Order(s), including to perform the Services, prevent, mitigate, and investigate Security Incidents, and resolve issues, bugs and errors; (ii) Processing resulting from Customer Users’ use of the Services; and (iii) Processing to comply with other documented reasonable written instructions provided by Customer, where such instructions are consistent with the terms of the MSA. Customer's documented instructions include, and Scribe will Process Customer Personal Data only on such instructions with regard to, transfers of Customer Personal Data to a third country or an international organization, unless Scribe is required to carry out such Processing or transfer by European Union, Member State, or other applicable law to which Scribe is subject. In such a case, Scribe will inform Customer of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.

3.2. Processing Restrictions. Scribe will not:

3.3. Notification of Unlawful Instructions; Unauthorized Processing. Scribe will immediately inform Customer if, in its opinion, an instruction given by Customer violates any Data Protection Laws, or Scribe is unable to comply with or perform its obligations under applicable Data Protection Laws or comply with Customer’s instructions for the Processing of Customer Personal Data. Customer retains the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data, including uses of Personal Data not authorized in this DPA or the Scribe Privacy Notice.

3.4. Compelled Disclosure. If a governmental body demands or otherwise requires that Scribe disclose Customer Personal Data, Scribe will exercise commercially reasonable efforts to have the governmental body request such information from Customer directly. If compelled to disclose Customer Personal Data to a governmental body, Scribe will, to the extent practicable and legally-permissible, give Customer reasonable notice of the demand to allow Customer, at its sole costs and expense, to seek a protective order or other appropriate remedy. Where Scribe is not permitted by law to notify Customer of the request, Scribe will only respond to the requesting party if required to do so and will make reasonable efforts to work with the requesting party to narrow the scope of the Content request.

3.5. Personnel; Data Protection Officer. Scribe personnel engaged in the Processing of Customer Personal Data shall be informed of the confidential nature of the Customer Personal Data, receive annual training on their responsibilities under this DPA and Data Protection Laws, and have executed written confidentiality agreements. Scribe personnel engaged in the Processing of Customer Personal Data will be limited to those personnel performing Services in accordance with the MSA. Scribe's data protection officer, appointed for certain jurisdictions, may be reached at [email protected].

3.6. Records of Processing Activities. Scribe maintains a written record of all categories of Processing activities carried out on behalf of Customer, containing the information required under applicable Data Protection Laws. Scribe will make such records available to a Supervisory Authority on request. Upon Customer's reasonable written request at reasonable intervals, Scribe will also make available to Customer the information contained in such record that relates to Scribe's Processing of Customer Personal Data and is reasonably necessary for Customer to demonstrate compliance with its own obligations under Data Protection Laws, provided that Scribe may withhold or redact information relating to other customers of Scribe, information subject to obligations of confidentiality owed to third parties, and information the disclosure of which would compromise the security of the Services.

4. Customer Obligations.

In its use of the Services, Customer will comply with and Process Personal Data in accordance with applicable Data Protection Laws and the EU AI Act, including any applicable requirements to provide notice to and/or obtain consent from Data Subjects for Processing by Scribe in accordance with this DPA, the MSA, and any Order(s). Customer will ensure that its instructions for the Processing of Customer Personal Data comply with Data Protection Laws and the EU AI Act. Customer will be solely responsible for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data. Customer will ensure that its use of the Services will not violate the rights of any Data Subject that has opted-out from sales, sharing, or other disclosures of Personal Data, to the extent applicable under Data Protection Laws.

5. Data Subject Rights and Third Party Requests.

5.1. Requests from Data Subjects. Scribe will, to the extent legally permitted, promptly notify Customer if Scribe receives a complaint or request from a Data Subject with respect to the Processing of their Personal Data covered by this DPA or an exercise of their rights under applicable Data Protection Laws (each, a “Data Subject Request”). Customer authorizes Scribe on its behalf, and on behalf of its Controllers when Customer is acting as a Processor, to respond to any Data Subject with respect to a Data Subject Request, to confirm that Scribe has forwarded the request to Customer. To the extent Customer, in its use of the Services, does not have the ability to address a Data Subject Request, Scribe will, upon Customer’s reasonable request, use commercially reasonable efforts to assist Customer in responding to such Data Subject Request, to the extent Scribe is legally permitted to do so and the response to such Data Subject Request is required under Data Protection Laws.

5.2. Requests for Materials and Consultations. Customer agrees that Scribe’s then-current SOC 2 audit reports (or comparable industry-standard successor reports) and/or the certifications, attestations, and other resources contained in the Scribe Trust Center at https://trust.scribehow.com will be used by Customer to carry out its data protection impact assessments (“DPIAs”) and prior consultations. To the extent Customer requires additional assistance to meet its obligations under applicable Data Protection Laws or the EU AI Act, including Articles 35 and 36 of the GDPR to carry out a DPIA and prior consultation with the competent Supervisory Authority related to Customer’s use of the Services, Scribe will, taking into account the nature of Processing and the information available to Scribe, provide commercially reasonable assistance to Customer.

6. Security and Incident Management.

6.1. Controls for the Protection of Content, Customer Personal Data and Customer Account Data. Scribe has implemented and will maintain appropriate physical, technical and organizational measures to protect the security, confidentiality and integrity of Content, Customer Personal Data, and Customer Account Data, and to protect such information from a Security Incident, in accordance with Schedule 2 (Technical and Organizational Measures). Scribe may update or change these measures from time-to-time to, among other things, comply with changes in Data Protection Laws and prevailing industry standards, but will not materially decrease the overall security of the Services during a Subscription Term. Customer is solely responsible for making an independent determination as to whether the technical and organizational measures set forth in this DPA meet Customer’s requirements.

6.2. Third-Party Audit Reports and Certifications. Upon Customer’s written request at reasonable intervals, and subject to the obligations in this DPA and the MSA (including confidentiality), Scribe will make available to Customer or Customer's independent, third-party auditor a copy of Scribe’s then-current third-party SOC 2 audit report (including via the Scribe Trust Center at https://trust.scribehow.com), and of any other audit reports and certifications that Scribe generally makes available to its customers, provided Customer or its independent auditor, as applicable, is not a competitor of Scribe.

6.3. Incident Management and Notification. Scribe maintains security incident management policies and procedures and will, to the extent permitted and required by applicable Data Protection Laws, notify Customer without undue delay (and in no event later than 72 hours) after becoming aware of an actual or reasonably suspected Security Incident. Scribe will make reasonable efforts to identify the cause of such Security Incident and take such steps as Scribe deems necessary and reasonable to remediate the cause of such Security Incident to the extent the remediation is within Scribe’s reasonable control.

6.4. Notice Assistance. To enable Customer to notify applicable Supervisory Authorities or Data Subjects (as applicable) of the Security Incident, Scribe will cooperate with and assist Customer by including in the notification provided under Section 6.3 such information related to the Security Incident that Scribe is permitted to disclose to Customer, taking into account the nature of the Processing, the information available to Scribe, and any restrictions on disclosing the information, such as confidentiality.

7. Subprocessors.

7.1. Appointment of Subprocessors. Customer grants Scribe a general authorization to appoint Subprocessors in connection with the Services, in accordance with the procedures outlined in this DPA. Scribe confirms that it, or an Affiliate in the Scribe Group, has entered into a written agreement with each Subprocessor containing privacy and data protection obligations not less protective than those in this DPA with respect to the protection of Content, Customer Account Data, and Customer Personal Data, to the extent applicable to the nature of the services provided by such Subprocessor.

7.2. Current Subprocessors and Notification of New Subprocessors. A list of Subprocessors for the Services, and a means for subscribing to updates of and notifications related to such list is available at https://trust.scribehow.com/subprocessors. Scribe will endeavor to provide Customer written notice thirty (30) days prior to any addition or replacement of a Subprocessor, but will give written notice no less than ten (10) days prior to any such change. Any such notice will identify the name and location of the proposed Subprocessor and describe the Processing activities to be performed by it.

7.3. Objection Right for New Subprocessors. Customer may object to Scribe’s use of a new Subprocessor by notifying Scribe in writing within thirty (30) days after receipt of notice of the new Subprocessor. If Customer objects to a new Subprocessor as permitted in the preceding sentence, Scribe will use commercially reasonable efforts to make available to Customer a change in the Services or recommend a change to Customer’s configuration or use of the Services, to avoid Processing of Personal Data by the objected-to Subprocessor without unreasonably burdening Customer. If Scribe is unable to make available such change in the Services, or to recommend such a change to Customer’s configuration or use of the Services that is satisfactory to Customer, within a reasonable period of time (which will in no event exceed thirty (30) days unless agreed with Customer), Customer may terminate the applicable Order(s) with respect only to those Services which cannot be provided without the use of the objected-to Subprocessor by providing written notice to Scribe. Upon the effective date of such termination, Customer shall be relieved of any liability for fees payable after the termination date and shall be entitled to the prompt pro rata refund of any prepaid and unearned fees for the period after such date.

7.4. Liability for Subprocessors. Scribe will be liable for the acts and omissions of its Subprocessors to the same extent Scribe would be liable if performing the services of each Subprocessor directly under the terms of this DPA and the MSA.

8. Audit.

8.1. Audit Requests. Customer agrees that Scribe’s then-current SOC 2 audit reports (or comparable industry-standard successor reports) and/or the certifications, attestations, and other resources contained in the Scribe Trust Center at https://trust.scribehow.com will be used to satisfy any audit or inspection requests by or on behalf of Customer. Any supplementary materials will be requested and shared remotely.

8.2. Physical Audit. In the event that Customer, a Supervisory Authority, or another regulatory or governmental body with jurisdiction over Customer requires additional information, including information necessary to demonstrate compliance with this DPA, or an audit related to the Service, such information and/or audit will be made available, provided that any physical audit of Scribe’s Processing activities covered by this DPA (“Physical Audit”) may only be conducted when: (i) the information otherwise available pursuant to this DPA is insufficient to demonstrate compliance with the material obligations set out in this DPA; (ii) Customer has received a notice from Scribe of a Security Incident prior to such request; or (iii) a Physical Audit is required by Data Protection Laws or in writing by Customer’s competent Supervisory Authority. Any Physical Audits will be limited to Customer Personal Data Processing and persistent storage facilities operated and controlled by the Scribe Group.

8.3. Physical Audit Scope and Procedures. Customer acknowledges that Scribe operates a multi-tenant cloud environment hosted on infrastructure provided by third parties (e.g., AWS) and the scope of any Physical Audit and the procedures undertaken to complete the audit must mitigate risks with respect to, and including, service levels, availability, and confidentiality of other Scribe customers’ information. Any Physical Audit will require no less than thirty (30) days’ advance written notice, be conducted no more frequently than once annually, and be conducted by Customer acting reasonably, in good faith, taking into account the nature and complexity of the Services used by Customer and in a proportional manner during Scribe’s normal business hours and without unreasonably interfering with Scribe’s day-to-day operations. If an emergency or governmental requirement justifies a shorter notice period, Scribe will use good faith efforts to accommodate such requests. The Physical Audit can be conducted through a third-party independent contractor that is not a Scribe competitor (“Third-Party Auditor”) if, prior to the Physical Audit, the Third-Party Auditor enters into a customary non-disclosure agreement containing confidentiality provisions no less protective than those set forth in the MSA to protect Scribe’s proprietary information. All costs of the Third-Party Auditor are at Customer’s expense. Customer must promptly provide Scribe with information regarding any actual or suspected non-compliance discovered during the course of a Physical Audit. Before the commencement of any audit, Customer and Scribe will mutually agree upon the scope, timing, and duration of the audit. In no event will any audit of a Subprocessor, beyond a review of reports, certifications and documentation made available by the Subprocessor, be permitted without the Subprocessor’s consent.

9. Return and Deletion of Content and Customer Personal Data.

Scribe will return Content and Customer Personal Data to Customer in customary machine readable formats upon Customer’s request on or prior to the termination of the MSA and the Services or Customer’s migration or exportation of Content and Customer Personal Data to another provider or Scribe account, as applicable, and Scribe shall delete any and all remaining Content and Customer Personal Data in accordance with the procedures and timeframes specified in this DPA and MSA, not to exceed thirty (30) days, unless further preservation is required or deletion otherwise prohibited by applicable law. Upon Customer's written request following such deletion, Scribe will confirm to Customer in writing that the deletion has been completed and will identify any Content or Customer Personal Data retained together with the legal basis for its retention.

10. Authorized Affiliates.

10.1. Contractual Relationship. The Customer entity signing this DPA does so for itself and in the name and on behalf of each of its Authorized Affiliates, creating a separate DPA between Scribe and each such Authorized Affiliate subject to the terms of the MSA, this Section and Section 12 (Limitation of Liability). Each Authorized Affiliate agrees to be bound by this DPA as if it were a direct signatory and party and, as applicable, the MSA. For the avoidance of doubt, Authorised Affiliates do not become parties to the MSA solely by virtue of this Section, and are only a party to this DPA. Any breach of the terms of the MSA by an Authorized Affiliate, to the extent that it relates to its obligations under this DPA, will be deemed a breach by Customer.

10.2. Communication. Customer will act as the single point of contact for all communications with Scribe under this DPA, including on behalf of its Authorized Affiliates.

10.3. Rights of Customer Affiliates.

Where an Authorized Affiliate becomes a party to this DPA, it may exercise rights and seek remedies under this DPA to the extent required by applicable Data Protection Laws, subject to the following:

10.3.1. Unless applicable Data Protection Laws require an Authorized Affiliate to act directly against Scribe, Customer will exercise all rights and seek any remedies under this DPA and shall do so on behalf of itself and such Authorized Affiliates, collectively, rather than individually.

10.3.2. When conducting a permitted audit, Customer will take all reasonable measures to combine audit requests for itself and its Authorized Affiliates into a single audit in order to minimise disruption to Scribe and its Subprocessors.

11. Applicable Transfer Mechanism for Europe.

11.1. Customer acknowledges that the Services may involve cross-border transfers of Customer Personal Data, Customer Account Data and other Content. Scribe agrees that it will comply with all applicable Data Protection Laws if it engages in any cross-border Processing of Customer Personal Data, Customer Account Data and other Content, or transmits any Customer Personal Data, Customer Account Data and other Content to any country outside of the country from which such Customer Personal Data, Customer Account Data and other Content was provided. To the extent required by Data Protection Laws, Scribe will ensure that a lawful data transfer mechanism is in place prior to engaging in any onward transfers of Customer Personal Data, Customer Account Data and other Content from one country to another and, to the extent that they apply to the transfer, the specific jurisdiction’s provisions set forth in Schedule 3 (Additional Provisions for Certain Jurisdictions).

11.2. To the extent legally required, by entering into this DPA, the Parties are deemed to have signed the applicable Standard Contractual Clauses which form part of this DPA and are deemed completed as detailed and set out in Schedule 3 (Additional Provisions for Certain Jurisdictions).

11.3. In the event that the Standard Contractual Clauses are invalidated, amended, or replaced the Parties will work in good faith to enact such alternative transfer mechanism to enable the continued Processing of Personal Data contemplated by the MSA. The use of such alternative transfer mechanism will be subject to each Party’s fulfillment of all legal requirements for use of such transfer mechanism.

11.4. Without limiting Clause 14 and Clause 15 of the EU SCCs, Scribe will, upon Customer's reasonable request, provide Customer with the information reasonably available to Scribe that Customer requires in order to carry out and document a transfer impact assessment in respect of the Services, and will continue to cooperate with Customer in ensuring compliance with the Standard Contractual Clauses.

12. Limitation of Liability.

To the extent permitted by Data Protection Laws, each Party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to this DPA and all DPAs between any Authorized Affiliates and Scribe whether in contract, tort or under any other theory of liability, is subject to the “Limitation of Liability” Section of the MSA, and any reference in such clauses to the liability of a Party means the aggregate liability of that Party and all of its Affiliates under the MSA and all DPAs.

13. Modification.

Scribe may modify the terms of this DPA from time-to-time; provided, however, Scribe will provide at least thirty (30) days prior written notice to Customer before the effective date of such modification if any modified provision materially increases the obligations of Customer or materially reduces Customer's rights or protections hereunder, except to the extent any modification is required under applicable law, inlcuding any applicable Data Protection Laws.

SCHEDULE 1 - Details of Processing

1. DETAILS OF THE PARTIES

Data Exporter(s):

Full Legal Name: The data exporter is the entity identified as “Customer” in the DPA.

Main Address: The address for Customer is as set forth in the MSA and/or the applicable Order.

Contact and Contact Email: If not otherwise provided the relevant contact person for Customer are as set forth in the MSA and/or the applicable Order, as updated in Customer’s account from time-to-time.

Data Importer:

Full Legal Name: Colony Labs, Inc. dba Scribe

Main Address: 427 Brannan St, San Francisco, CA, 94107, United States

Contact: Scribe Privacy Team

Contact Email: [email protected]

Where Module Three applies, Customer will identify the relevant Controller or Controllers to Scribe on request, and Annex I.A is deemed completed with that information

2. DETAILS OF TRANSFER AND PROCESSING

Categories of Data Subjects

Customer may submit and/or make available Customer Personal Data to the Services, the extent of which is determined and controlled by Customer in its sole discretion, and which may include, but is not limited to, Personal Data relating to the following categories of data subjects:

• Prospective, current and former, customers, business partners, employees, contractors, agents and vendors of Customer (who are natural persons);
• Customer’s Users of the Services; and/or
• Any other individual whose Personal Data is received by Scribe through a third-party application or integration used with the Services that Customer has enabled or from users in connection with their use of Services.

Categories of Personal Data

Customer may submit Personal Data to the Services, the extent of which is determined and controlled by Customer in its sole discretion, and which may include, but is not limited to: Names, business addresses, phone numbers and business email addresses, Job Titles, Employers, emails and phone numbers, ID data and other governmental identifiers, IP addresses, Public Profile URL, Localisation data, and Communications information (information shared during communications using the Services).

Special Categories of Personal Data (each, if applicable)

Subject to any applicable restrictions and/or conditions in the MSA and this DPA, Customer may also submit special categories of Personal Data to the Services, the extent of which is determined and controlled by Customer in its sole discretion, which may include Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data processed for the purposes of uniquely identifying a natural person, data concerning health and/or data concerning a natural person’s sex life or sexual orientation. See the measures in Schedule 2 (Technical and Organizational Measures) for how Scribe protects special categories of data and other Personal Data.

Frequency of Transfer and Processing

Continuous basis, as determined by Customer through its use of the Services.

Nature of Processing

Scribe will Process Customer Personal Data and Content as necessary to perform the Services pursuant to the MSA and Order(s), and as further instructed by Customer in its use of the Services. Additional information regarding the nature of the Processing (including transfer) is described in respective Orders for relevant Services and Documentation referring to technical capabilities and features, including but not limited to collection, structuring, storage, transmission, or otherwise making available of Personal Data by automated means.

Purposes of Processing

Scribe will Process Customer Personal Data as a Processor in accordance with Customer’s documented instructions to: (a) provide and improve the Services for Customer only, and enable the use of various features and functionalities in accordance with the Documentation and as directed by Customer and its Users, including investigating Security Incidents, and resolving issues, bugs and errors; and (b) enforce the terms of the MSA.

In accordance with the terms of the MSA and this DPA, Scribe must de-identify and aggregate Content so that it cannot reasonably be used to single out, infer information about, or otherwise be linked to Customer or an individual data subject before using such System Data to improve the Services generally. Scribe is a Controller of Customer Account data and other Personal Data as specified in Scribe’s Privacy Notice and this DPA does not limit or prohibit Scribe from acting in that capacity.

The Parties agree that the business purposes identified in this section are the limited and specified business purposes for which Customer discloses Customer Personal Data to Scribe, that they are described specifically and not in generic terms, and that Scribe will not retain, use, or disclose Customer Personal Data for any other purpose except as expressly permitted by applicable Data Protection Laws.

Duration of Processing

Scribe will Process Customer Personal Data for as long as necessary to perform the Services in accordance with each Order and the MSA, unless otherwise agreed in writing.

Retention

Subject to Section 9 (Return and Deletion of Content and Customer Personal Data), Scribe will retain Customer Personal Data in the Services for the duration of the MSA, unless otherwise agreed in writing, and for a fixed period following termination of the MSA prior to deletion in accordance with the terms of the MSA and the DPA. Such fixed period will not exceed thirty (30) days following termination or expiration of the MSA, except where further preservation is required, or deletion is prohibited, by applicable law.

Transfers to Subprocessor(s)

The subject matter, nature, and duration of the Processing for any transfers to Subprocessors are the same as for Scribe and as necessary to perform the Services pursuant to the MSA and each Order.

3. SUPERVISORY AUTHORITY

To the extent permitted by applicable law, including Data Protection Laws, the Parties agree that the competent Supervisory Authority shall be the Irish Data Protection Commission, or, where the competent Supervisory Authority is required to be determined in accordance with Clause 13 of the EU SCCs, the Supervisory Authority so determined.

SCHEDULE 2 - Technical and Organizational Measures

This Schedule 2 will serve as Annex II to the EU SCCs and such other applicable schedule, annex, or portion of any other Standard Contractual Clauses.

Scribe maintains a comprehensive, risk-based Information Security Program (“Program”) designed to (i) protect the confidentiality, security, integrity, and availability of Content, Customer Personal Data, and Customer Account Data against accidental or unlawful loss, access, or disclosure, (ii) identify reasonably foreseeable risks to the security and availability of the Services, and (iii) minimize physical and logical security risks to the Services, including through regular risk assessments and testing. The Program is reviewed and approved annually by Scribe’s senior management and is continuously improved through ongoing monitoring, assessments, and incident reviews.

The following table provides more information regarding the technical and organizational measures comprising Scribe’s information security program. Additional details regarding Scribe’s technical and organizational security measures are available through Scribe’s Trust Center at https://trust.scribehow.com.

‍

Technical and Organizational MeasureDetailsMeasures of pseudonymisation and encryption of Personal Data.

‍Scribe has deployed secure methods and protocols for transmission of confidential or sensitive information over public networks. Databases housing sensitive customer data are encrypted at rest. Scribe uses only recommended secure cipher suites and protocols to encrypt all traffic in transit and Customer Data is securely encrypted with strong ciphers and configurations when at rest (AES 256).

‍Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services.

Scribe’s customer agreements contain strict confidentiality obligations. Additionally, Scribe requires every downstream Subprocessor and service provider to sign agreements containing confidentiality provisions that are substantially similar to those contained in Scribe's customer agreements.

Scribe has undergone SOC 2 Type II audits that include the Security Trust Service Criteria, and maintains annual ongoing SOC 2 Type II audits that includes the Security Trust Service Criterion.

Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.

Daily and monthly backups of production datastores are taken. Backups are encrypted, geographically redundant, and validated through automated verification processes. Backups are periodically tested in accordance with information security and data management policies.

Measures for ensuring business continuity and disaster recovery.

Scribe maintains robust business continuity and disaster recovery (BC/DR) plans that are tested at least annually. These plans ensure the restoration of Content and Services within the following targets: a Recovery Time Objective (RTO) of four (4) hours and a Recovery Point Objective (RPO) of twelve (12) hours. We have failover capabilities between AWS East and West, ensuring that the alternate data center sites are geographically separated to reduce susceptibility to similar threats. This separation helps protect against regional disasters.

Processes for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures in order to ensure the security of the processing.

Scribe has undergone a SOC 2 Type II audit that included the Security and Processing Integrity Trust Service Criteria, and maintains ongoing SOC 2 Type II audits that includes the Security Trust Service Criterion. Monthly vulnerability scanning and annual penetration testing are conducted to identify and mitigate risks. Dynamic Application Security Testing (DAST) is performed before major releases, and Static Application Security Testing (SAST) is incorporated into the Secure Development Lifecycle. All findings are remediated promptly according to documented risk management procedures.

Measures for ensuring endpoint and device security.

‍Scribe employs enterprise-grade Mobile Device Management (MDM) and Endpoint Detection and Response (EDR) systems across all corporate devices that access Content. These systems enforce full-disk encryption and remote wipe capabilities, automatic patch and update deployment, malware detection and automated containment, and strong authentication and device posture verification prior to granting access. All access to production systems is restricted to managed devices that comply with Scribe’s MDM and EDR control.

‍Measures for user identification and authorization.

‍Scribe uses secure access protocols and processes and follows industry best-practices for authentication, including Single Sign On (SSO). All production access requires the use of two-factor authentication, and network infrastructure is securely configured to vendor and industry best practices to block all unnecessary ports, services, and unauthorized network traffic.

‍Measures for the protection of data during transmission.

‍Scribe has deployed secure methods and protocols for transmission of confidential or sensitive information over public networks. Scribe uses only recommended secure cipher suites and protocols to encrypt all traffic in transit (i.e. TLS 1.2+).

‍Measures for the protection of data during storage.

‍Encryption-at-rest is automated using AWS’s transparent disk encryption, which uses industry standard AES-256 encryption to secure all volume (disk) data. All keys are fully managed by AWS using secure, segregated key management services that include rotation and strict access control procedures.

‍Measures for physical and environmental security.

Scribe’s data centers and office environments are protected by physical access controls that include badge systems, video surveillance, visitor logging, and a 24/7 security presence. All Scribe processing occurs in physical data centers that are managed by AWS. More details can be found at https://aws.amazon.com/compliance/data-center/controls/. All such facilities comply with industry standards such as SOC 2 Type II or ISO 27001, ensuring environmental and power redundancy, controlled access, and protection against unauthorized entry.

Measures for ensuring events logging.

Scribe monitors access to applications, tools, and resources that process or store Customer Personal Data and Customer Account Data, including cloud-based services. Monitoring of security logs is managed by Scribe’s security and engineering teams. Log activities are investigated when necessary and escalated appropriately.

Logs are stored in an immutable, encrypted vault with heightened access control, ensuring protection from unauthorized access, modification, and deletion.

Measures for system monitoring, detection, and response.

Scribe maintains continuous cloud infrastructure monitoring and intrusion detection systems (IDS) to identify and respond to unauthorized activities, configuration anomalies, and potential threats. Centralized monitoring tooling aggregates logs across environments and supports automated alerting, correlation, and forensic investigation. All security events are triaged and managed according to a documented incident response plan, with monitoring coverage in place at all times.

Measures for ensuring system configuration, including default configuration.

‍Scribe adheres to a change management process to administer changes to the production environment for the Services, including changes to its underlying software, applications, and systems. All production changes are automated through CI/CD tools to ensure consistent configurations.

‍Measures for internal IT and IT security governance and management.

‍Scribe maintains an ISO 31000-informed and SOC 2 Type II audited risk-based information security governance program. The framework for Scribe’s security program includes administrative, organizational, technical, and physical safeguards reasonably designed to protect the Services and confidentiality, integrity, and availability of Customer Personal Data and Customer Account Data.

‍Measures for certification/assurance of processes and products.

‍Scribe undergoes annual SOC 2 Type II audits that include the Security Trust Service Criterion.

‍Measures for ensuring data minimisation.

‍Scribe’s Customers unilaterally determine what Customer Personal Data they make available to the Services. As such, Scribe operates on a shared responsibility model. Scribe gives Customers control over exactly what Customer Personal Data enters and persists in Scribe’s platform. Additionally, Scribe has built in self-service functionality to the Services that allows Customers to delete and suppress Personal Data collection and Processing at their discretion.

‍Measures for ensuring data quality.

Scribe has a multi-tiered approach for ensuring data quality. These measures include: (i) unit testing to ensure quality of logic used to process API calls, (ii) database schema validation rules which execute against data before it is saved to our database, (iii) a schema-first API design using GraphQL and strong typing to enforce a strict contract between official clients and API resolvers. Scribe applies these measures across the board, both to ensure the quality of any usage data that Scribe collects and to ensure that Scribe’s Services operate within expected parameters.

Scribe ensures that data quality is maintained from the time a Customer makes available Customer Personal Data to the Services and until such Customer Personal Data is presented or exported.

Measures for ensuring limited data retention.

‍Scribe Customers unilaterally determine what Customer Data they route through the Services. As such, Scribe operates on a shared responsibility model. If a Customer is unable to delete Customer Personal Data via the self-services functionality of the Services, then Scribe deletes Customer Personal Data upon the Customer's written request, within the timeframe specified in the DPA and in accordance with Applicable Data Protection Law. All Customer Personal Data is deleted from the Services following service termination.

‍Measures for ensuring accountability.

‍Scribe has adopted measures for ensuring accountability, such as implementing data protection and information security policies across its business, recording and reporting Security Incidents involving Personal Data, and formally assigning roles and responsibilities for information security and data privacy functions. Additionally, Scribe conducts regular third-party audits to ensure compliance with our privacy and security standards. Scribe maintains a record of the categories of Processing activities carried out on behalf of Customer in accordance with applicable Data Protection Laws (e.g., Article 30(2) of the GDPR).

‍Measures for allowing data portability and ensuring erasure.

All Customer Personal Data in the Services may be deleted by the Customer or at the Customer’s request.

The collection and Processing of Personal Data is incidental to Scribe’s Services. Based on Privacy by Design and Data Minimization principles, Scribe severely limits the instances of Personal Data collection and Processing within the Services. Most use cases for porting Customer Personal Data from the Scribe Services and platform are not applicable. However, Scribe will respond to all requests for data porting in order to address Customer needs.

Technical and organizational measures of subprocessors and service providers.

Scribe maintains a formal Vendor Risk Management Program to evaluate and monitor all third parties that process or access Customer Personal Data, Customer Account Data, and Content. Subprocessors and service providers are required to maintain equivalent or greater levels of security, and risk assessments are conducted before onboarding and at regular intervals thereafter.

Scribe enters into Data Processing Agreements with its Subprocessors with data protection obligations substantially similar to those contained in this DPA. Scribe monitors vendor compliance and ensures that data handling practices meet contractual and regulatory obligations.

Measures for secure software development.

‍Scribe maintains a secure software development lifecycle consistent with OWASP best practices. This includes formal code review and change management processes, dependency and container scanning, regular security training for developers, and segregation between development, staging, and production environments.

‍Measures for appropriate access control.

‍Access to Customer Personal Data, Customer Account Data, and Content is governed by the principle of least privilege and is enforced through role-based access control (RBAC) and multi-factor authentication (MFA). Administrative and developer privileges are granted only to authorized personnel with a demonstrable business need, subject to documented approvals and periodic access reviews. Access provisioning and deprovisioning are logged, monitored, and subject to regular audits.

Measures for personnel security and training.

‍Scribe has implemented and routinely evaluates and updates processes to ensure we onboard the right people and keep them up to date on the latest information security, privacy, and compliance practices, including through robust interviewing practices, execution of confidentiality agreements, and, as legally-permitted, customary background checks, least-privilege account provisioning, comprehensive and continuous (e.g., at least annually and with material changes in applicable law or industry standards and practices) education and training, phishing and emerging threat campaigns and testing, and disciplinary actions up to and including separation for non-compliance with Scribe security, privacy, and compliance policies and practices.

‍Measures for data protection in the use of artificial intelligence systems.

‍No inputs, outputs, Content or Personal Data is used by Scribe or any Subprocessor to train or fine-tune any underlying foundation model. This restriction is enforced contractually with all Subprocessors. Scribe enables limited data retention configurations with Subprocessors where available and feasible with respect to the functionality of the Services to prevent durable storage of Content and/or Personal Data after processing.

‍Measures for limited data retention by Scribe’s subprocessors used in connection with artificial intelligence functionality.

‍Scribe’s subprocessors used by Scribe to provide Generative AI features may retain Content for up to 30 days only as necessary to provide their services and detect potential misuse. After 30 days, Content will be removed from such subprocessors’ systems, unless retention is required by any applicable laws.

‍Measures for transparency in the use of artificial intelligence systems.

‍Users are informed when they are interacting with artificial intelligence features, and output from artificial intelligence systems are obvious or clearly labelled as such in the Scribe user interface. For example, where the Services generate synthetic text or other synthetic content, such output is marked as artificially generated in a machine-readable format in accordance with applicable law (e.g., Article 50(2) of the EU AI Act). Users are allowed to review, modify, and verify AI-generated content before finalizing.

‍Measures for human oversight and human intervention in the use of artificial intelligence systems.

Scribe platform services and features are designed so that humans remain in control of significant decisions, particularly those that may have material impacts on individuals. Scribe’s artificial intelligence systems do not independently or autonomously make final decisions on recruitment, hiring, performance, separation, or other high-stakes decisions affecting individuals, which decisions fully remain with the end-users of Scribe’s platform.

Human oversight is integrated through Reinforcement Learning from Human Feedback (RLHF) to ensure data quality. We also implement data minimization and content moderation to reduce potential bias.

SCHEDULE 3 - Additional Provisions for Certain Jurisdictions

This Schedule applies to the extent that relevant Data Protections Laws apply to transfers of Customer Personal Data in, to or from the jurisdictions listed in this Schedule 3, in which case the specific jurisdiction provisions of the relevant jurisdiction will also apply as set forth herein.

1. Transfer Mechanisms

Scribe will comply with Data Protection Laws if it engages in any cross-border Processing of Customer Personal Data, or transmits any Customer Personal Data, Customer Account Data, or Content to any country outside of the country from which such Customer Personal Data, Customer Account Data, or Content was provided to it. To the extent required by Data Protection Laws, Scribe will ensure that a lawful data transfer mechanism is in place prior to engaging in any onward transfers of Customer Personal Data from one country to another and, to the extent that they apply to the transfer, the specific jurisdiction’s provisions set forth in this Schedule 3.

In the absence of another specified lawful transfer mechanism, the Standard Contractual Clauses, as completed herein, will apply to any cross-border transfers, to the extent such transfers are subject to the Data Protection Laws. The terms of this Schedule are intended to clarify and not to modify the Standard Contractual Clauses. In the event of any conflict or inconsistency between the body of this Schedule and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail.

2. Transfers Subject to the Standard Contractual Clauses

(a) Transfers from the EEA. To the extent required by applicable Data Protection Laws, the Parties are deemed to have signed the EU SCCs concurrently with execution of this DPA, which EU SCCs form part of this DPA and the Parties agree are deemed completed as follows (for each Module, where applicable):

(i) Module Two (Controller to Processor) will be applied where Customer, acting as Controller, transfers Customer Personal Data to Scribe, acting as Processor.

(ii) Module One (Controller to Controller) of the EU SCCs will be applied where Customer, acting as a Controller, transfers Customer Account Data to Scribe, acting as a Controller;

(iii) Module Three (Processor to Processor) will be applied where Customer, acting as a Processor on behalf of a third-party Controller, transfers Customer Personal Data to Scribe, acting as a Subprocessor.

(iv) Clause 7 (the optional docking clause) will not apply.

(v) Clause 9, Option 2 (general written authorization) will apply and the Parties agree that Data transfers to Subprocessors may rely on a transfer mechanism other than the Standard Contractual Clauses. The initial list of subprocessors is made available to Customer at https://trust.scribehow.com/subprocessors and the time period for prior written notice of subprocessor changes will be as set forth in Section 7.2 (Current Subprocessors and Notification of Subprocessor Changes) of this DPA. For the purposes of Clause 9(a), the specified time period for prior notice is ten (10) days. Customer may object to subprocessor changes in accordance with Section 7.3 (Objection Right for New Subprocessors) of this DPA.

(vi) Clause 11 (redress): The optional language in Clause 11(a) providing for the referral of disputes to an independent dispute resolution body will not apply. Clause 11 otherwise applies in full.

(vii) Clause 17 (governing law), Option 1 (the law of an EU Member State that allows for third-party beneficiary rights) will apply and the Parties choose the laws of the Republic of Ireland as the governing law.

(viii) Clause 18 shall place disputes associated with the DPA in the courts specified in the MSA, unless such court is not located in an EU Member State, in which case the forum for such disputes will be the courts of the Republic of Ireland.

(ix) Annex I (List of Parties) is completed with the information in Schedule 1 (Details of Processing) of this DPA.

(x) Annex II (Technical and Organizational Measures) is completed with the information in Schedule 2 (Technical and Organizational Measures) of this DPA.

(xi) Annex III does not apply pursuant to the general authorization agreed to with respect to Clause 9.

(b) Transfers from the United Kingdom. To the extent required by applicable Data Protection Laws, the Parties are deemed to have signed the UK Addendum concurrently with execution of this DPA, which UK Addendum forms a part of this DPA (and takes precedence over the terms of the DPA) and the Parties agree the tables of the UK Addendum are deemed completed as follows:

(i) Table 1 (Parties’ details) will be the details of the Parties and their Affiliates to the extent involved in an applicable transfer, and the Key Contact will be those contacts in Schedule 1 (Details of Processing) of this DPA.

(ii) Table 2 (approved EU SCCs) will be the EU SCCs as completed and entered into by the Parties pursuant to Section 2(a) of this Schedule 3 (Additional Provisions for Certain Jurisdictions).

(iii) Table 3, Annexes I and II are set forth in Schedule 1 (Details of Processing) and Schedule 2 (Technical and Organizational Measures) of this DPA, and Annex III does not apply.

(iv) Table 4 will permit either Party to terminate this DPA in accordance with its terms as set forth in Section 19 of the UK Addendum.

(c) Transfers from Guernsey. To the extent legally required, by entering into this DPA, the Parties are deemed to be signing the Guernsey Addendum, which forms part of this DPA and takes precedence over the rest of this DPA as set forth in the Guernsey Addendum.

(d) Transfers from Jersey. To the extent legally required, by entering into this DPA, the Parties are deemed to be signing the Jersey Addendum, which forms part of this DPA and takes precedence over the rest of this DPA as set forth in the Jersey Addendum.

(e) Transfers from Switzerland. With respect to any transfer of Customer Personal Data that is subject to the FADP, the EU SCCs as set forth in Section 2(a) of this Schedule 3 form part of this DPA with the following modifications to the extent required by the FADP:

(i) References in the EU SCCs to GDPR shall be references to FADP to the extent the data transfers are subject exclusively to FADP and not GDPR, and references to personal data in the EU SCCs also refer to data about identifiable legal entities until the entry into force of FADP revisions that eliminate this broader scope.

(ii) The term “member state” in EU SCCs will not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs.

(iii) The relevant Supervisory Authority is the Swiss Federal Data Protection and Information Commissioner (for transfers subject to the FADP and not the GDPR), or both such Commissioner and the Supervisory Authority identified in the EU SCCs (where the FADP and GDPR apply, respectively).

(iv) In Clause 17, the EU SCCs are governed by the laws of Switzerland.

(v) In Clause 18(b), disputes will be resolved before the courts of Switzerland.

(f) Transfers from Brazil. To the extent required by applicable Data Protection Laws, the Parties have agreed to comply with the Brazil SCCs, which form part of this DPA (and takes precedence over the terms of the DPA) as set forth in the Brazil SCCs. The Brazil SCCs are deemed completed as follows:

(i) Clause 1: The Parties shall be Exporter and Importer, as applicable, with their respective details in Schedule 1 (Details of Processing) of this DPA.

(ii) Clause 2 shall be completed with the information in Schedule 1 (Details of Processing) of this DPA.

(iii) Clause 3, Option A will apply.

(iv) Clause 4, Option A will apply to transfers of Customer Personal Data from Customer, as a Controller, to Scribe, as a Processor, and Customer is responsible for the compliance obligations set forth in Clauses 4.1(a) - (c) unless otherwise provided in this DPA. For any transfers of Customer Personal Data from Customer, as a Processor, to Scribe, as a Subprocessor, Option B will apply and Customer is responsible for making a list of applicable Controllers available to Scribe.

(v) Schedule III is completed with the information in Schedule 2 (Technical and Organizational Measures) of this DPA.

(g) Transfers from Turkey. To the extent required by applicable Data Protection Laws, the Parties have agreed to comply with the Turkish SCCs, which form part of this DPA (and takes precedence over the terms of this DPA) as set forth in the Turkish SCCs. The Turkish SCCs are deemed completed as follows:

(i) The Standard Contract for the Transfer of Personal Data Abroad - 2 (Controller to Processor) applies to transfers of Customer Personal Data from Customer (as a Controller) to Scribe (as a Processor), and the Standard Contract for the Transfer of Personal Data Abroad - 3 (Processor to Processor) applies to transfers of Customer Personal Data from Customer (as a Processor) to Scribe (as a Subprocessor), and the Standard Contract for the Transfer of Personal Data Abroad - 1 (Controller to Controller) applies to transfers of Customer Account Data and other Personal Data from Customer (as a Controller) to Scribe (as a Controller).

(ii) Clause 8 (SubProcessors): The Parties select Option 2 (General written authorization). The initial list of Subprocessors is available to Customer, and Scribe will propose an update to that list, as set forth in Section 7 of this DPA. The Parties agree that any objections to new Subprocessors shall be handled as set forth in Section 7 of this DPA.

(iii) Clause 10 (Redress): The optional language requiring that Data Subjects be permitted to lodge a complaint with an independent dispute resolution body is not included.

(iv) Clause 16 (Notification of the Contract to Authority): The Parties agree that Customer will be responsible for notifying the Turkish Data Protection Authority of use of the Turkish SCCs within five (5) business days following the finalization of all signatures.

(v) Annex I (List of Parties) of the Turkish SCCs shall be completed with the information in Schedule 1 (Details of Processing) of this DPA.

(vi) Annex II (Technical and organizational measures) of the Turkish SCCs shall be deemed completed with the information in Schedule 2 (Technical and Organizational Measures) of this DPA.

(vii) Annex III (List of subprocessors) is not applicable because the Parties have chosen General Authorization under Clause 8 (Subprocessors) of the Turkish SCCs.

3. Specific Jurisdiction Provisions

(a) United States

(i) De-Identified Data. To the extent that Customer permits or instructs Scribe to Process Customer Personal Data in a de-identified form as part of the Services, Scribe shall: (a) adopt reasonable measures to prevent such de-identified data from being used to infer information about, or otherwise being linked to, a particular natural person or household; (b) publicly commit to maintain and use such de-identified data in that form and not attempt to re-identify such data, except as may be permitted by applicable Data Protection Laws; and (c) prior to sharing de-identified data with any third party, including Subprocessors, contractually obligate such recipients to comply with the requirements of this paragraph.

(ii) Additional CCPA Service Provider Obligations. To the extent that Customer Personal Data is subject to the CCPA, and in addition to the Processing restrictions already set out in this DPA, Scribe shall: (a) not combine Customer Personal Data with Personal Data received from or on behalf of any other third party, or collected from Scribe's own interactions with individuals, provided that Scribe may combine Customer Personal Data for a purpose permitted under the CCPA if directed to do so by Customer or as otherwise permitted by the CCPA; (b) notify Customer without undue delay if Scribe determines that it can no longer meet its obligations under the CCPA; and (c) if Customer reasonably believes that Scribe's Processing of Customer Personal Data is inconsistent with the CCPA and notifies Scribe accordingly, the Parties will cooperate in good faith to promptly remedy such inconsistency or, if Customer reasonably determines no remedy is available, Scribe will cease Processing the affected Customer Personal Data upon written instruction from Customer.

(iii) Limited and Specified Business Purposes. Customer discloses Customer Personal Data to Scribe only for the limited and specified business purposes set out in Schedule 1 (Details of Processing) under the heading "Purposes of Processing," which the Parties agree are described specifically and not in generic terms. Scribe will not retain, use, or disclose Customer Personal Data for any purpose other than those business purposes, or for any commercial purpose other than those business purposes, except as expressly permitted by the CCPA and its implementing regulations.

(iv) CCPA Compliance; Level of Privacy Protection. Scribe will comply with all sections of the CCPA and its implementing regulations applicable to it as a Service Provider and will, with respect to Customer Personal Data, provide the same level of privacy protection as is required of businesses by the CCPA and its implementing regulations, including by implementing and maintaining the reasonable security procedures and practices described in Schedule 2 (Technical and Organizational Measures) and by cooperating with Customer in responding to Consumer requests in accordance with Section 5.1 (Requests from Data Subjects).

(v) Customer's Right to Verify Compliance. Customer may take reasonable and appropriate steps to ensure that Scribe uses Customer Personal Data in a manner consistent with Customer’s obligations under the CCPA and its implementing regulations. Such steps will be exercised through the mechanisms set out in Section 6.2 (Third-Party Audit Reports and Certifications) and Section 8 (Audit), including Customer's review, not more frequently than once every twelve (12) months, of Scribe's then-current SOC 2 Type II report and of the assessments, audits, and technical and operational testing described in Schedule 2 (Technical and Organizational Measures).

(vi) Consumer Requests; Sensitive Personal Information. Upon Customer's documented instruction, and to the extent Customer is unable to give effect to the request through the functionality of the Services, Scribe will delete, correct, or cease or limit the Processing of Customer Personal Data as necessary to enable Customer to comply with a Consumer's request under the CCPA, including a Consumer's request to limit the use and disclosure of sensitive personal information under Cal. Civ. Code § 1798.121. Scribe does not use or disclose sensitive personal information for any purpose other than the purposes permitted under Cal. Civ. Code § 1798.121(a) (via 11 CCR § 7027(m)) and the business purposes set out in Schedule 1 (Details of Processing).

(vii) Customer Obligations. Customer shall not take any action that would: (a) render the provision of Content to Scribe a "sale" or "share" under United States Data Protection Laws; or (b) cause Scribe to no longer qualify as a "service provider" under the CCPA or a "processor" under applicable United States Data Protection Laws.

(b) Mexico.

(i) To the extent Customer acts as a Controller of Customer Personal Data collected within Mexico:

1. Scribe will Process Customer Personal Data in accordance with (1) Customer’s privacy notice made available to the Data Subject prior to the Processing of their Customer Personal Data, which provides the Data Subject with information regarding what Customer Personal Data is collected about them and for what purposes and (2) applicable Data Protection Law, including Ley Federal de Protección de Datos Personales en Posesión de los Particulares and all of its implementing regulations, including Reglamento de la Ley Federal de Protección de Datos Personales en Posesión de los Particulares.
2. Customer agrees that any Processing of Customer Personal Data by Scribe in accordance with this DPA is deemed to be in accordance with the Customer’s privacy notice.

(ii) Scribe may only transfer Customer Personal Data to a person that is not a Processor or Subprocessor as agreed in writing by Customer, or as necessary to comply with a valid request made by a competent legal authority. Customer agrees that, to the extent required, this provision shall constitute Customer’s written authorization to disclose Customer Personal Data to certain third-party vendors acting as Controllers (including professional advisers such as lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance and accounting services).

(iii) Upon termination or expiration of the MSA, Scribe will, at Customer's request, cease Processing Customer Personal Data.

(iv) Upon termination or expiration of the MSA, Scribe will provide Customer with the opportunity to retrieve Customer Personal Data; and upon Customer’s request, provide Customer with Customer Personal Data.

(c) Canada.

(i) Scribe will take reasonable steps to ensure that Customer Personal Data originating in Quebec that is accessed, stored, transferred or otherwise Processed by Scribe outside of Quebec receives adequate protection in accordance with applicable Data Protection Laws and that any transfer to a third-party is subject to a written agreement containing data protection obligations no less protective than those contained in this DPA, unless otherwise permitted by applicable Data Protection Laws.

(ii) Scribe will provide Customer, upon request, with information about the jurisdictions in which Customer Personal Data is accessed, stored, transferred or otherwise Processed by Scribe, to the extent such information is necessary for Customer to comply with applicable Data Protection Laws or to respond to a request by a competent Supervisory Authority.

(d) South Korea.

(i) To the extent Customer discloses or otherwise makes available de-identified data to Scribe, Scribe will maintain and use such de-identified data in a de-identified form and not attempt to re-identify the de-identified data; and before sharing de-identified data with any third party, including Subprocessors contractually obligate such third parties to comply with the foregoing requirement, including imposing this requirement on any further recipient of the de-identified data.

(ii) Customer agrees that it has provided notice and obtained all consents and rights necessary under applicable law, including the South Korean Personal Information Protection Act and its Enforcement Decrees to permit Scribe to Process Personal Data pursuant to the MSA.

(iii) With respect to Scribe’s Processing of Customer Personal Data provided by or on behalf of Customer, Scribe will limit access to Customer Personal Data to those personnel who reasonably require such access for the purposes of the processing, and establish and maintain the safeguards contained in Schedule 2 (Technical and Organizational Measures) to this DPA and such other measures for the protection of Customer Personal Data that may be required under Data Protection Laws from time to time (as applicable to an overseas transferee of Customer Personal Data) and be subject to training and supervision by the Customer with respect to Scribe’s handling of the Customer Personal Data Scribe Processes, and supervision and audit by relevant Supervisory Authorities.

(e) Singapore.

(i) Scribe will not transfer any Customer Personal Data from Singapore unless the transferee provides a written undertaking that such Customer Personal Data will be protected at a standard that is comparable to that under Singapore’s Personal Data Protection Act 2012.

(f) Japan.

(i) The definition of Data Protection Laws includes Japan’s Act on the Protection of Personal Information (APPI), the definition of “Personal Data” includes “Personal Information”, the definition of “Controller” includes “Business Operator”, and the definition of “Processor” includes a business operator entrusted by the Business Operator with the handling of Personal Data in a secure manner (a “trustee”), as each is defined under applicable Data Protection Law.

(g) Israel.

(i) The definition of “Data Protection Laws” includes the Israel Protection of Privacy Law 1981, the definition of “Controller” includes “Database Owner”, and the definition of “Processor” includes “Holder” as each is defined under applicable Data Protection Law.

(ii) Customer will collect all consents from Data Subjects required by Data Protection Laws, and as otherwise required for the Processing of Customer Personal Data under this DPA, including without limitation for the transfer of the Customer Personal Data outside of Israel.

(iii) Scribe will: (1) take sufficient steps to ensure the privacy of the Data Subjects whose Personal Data is Processed pursuant to this DPA and apply adequate data security requirements to applicable Customer Personal Data in accordance with Schedule 2 (Technical and Organizational Measures) of this DPA, including appointing an officer responsible for data security and conducting reasonable background checks for personnel with access to Customer Personal Data ; (2) logically segregate the Customer Personal Data from information obtained from unaffiliated third-parties or information obtained for other purposes; (3) periodically audit (or coordinate and permit periodic audits by the Customer or a mutually agreed upon third-party who will execute a confidentiality agreement) and, upon Customer’s reasonable request, make reports to Customer with respect to Customer Personal Data Processing activities and compliance with this DPA in accordance with Section 8 (Audit) of this DPA; and (4) destroy or return Customer Personal Data in its possession in accordance with Section 9 (Return and Deletion of Content and Customer Personal Data) of this DPA.

(h) South Africa.

(i) “Data Protection Laws” includes the Protection of Personal Information Act No. 4 of 2013, as amended from time to time, (“POPIA”).

(ii) To the extent Customer Personal Data is required to be transferred outside of South Africa, Customer will (i) transfer such Customer Personal Data to Scribe in compliance with Section 72 of POPIA and (ii) ensure that any transfer of “Special Personal Information” as defined in POPIA or Personal Data relating to individuals below the age of 18 years contained in the Customer Personal Data is in compliance with Chapter VI of POPIA, which requires prior authorization from the Information Regulator (the Supervisory Authority in South Africa).

‍

‍