valueIQ Data Processing Addendum

1.2 GDPR Terms

Where this DPA uses terms defined in the GDPR — including "Controller," "Processor," "Data Subject," "Personal Data," and "Processing" — those terms carry the meaning given in the GDPR, applied by analogy to Data Protection Laws outside the EU/UK/Switzerland where the context requires.

1.3 Interpretation

Headings are for convenience only. This DPA takes precedence over the Principal Agreement on the subject of Controller Personal Data processing; the Principal Agreement governs everything else, including liability, which Section 12 addresses.

2.2 Customer Instructions

Customer instructs valueIQ to process Controller Personal Data as necessary to provide the Services under the Principal Agreement, and as further described in Schedule 1. Customer may give additional documented instructions consistent with the Principal Agreement's terms and the nature of the Services.

2.3 Customer Obligations

Customer represents and warrants that it has complied, and will continue to comply, with Data Protection Laws in respect of its collection and provision of Controller Personal Data, including having all necessary rights, consents, and lawful bases to provide that data to valueIQ for the purposes described in Schedule 1. Customer will not provide, or instruct valueIQ to process, Controller Personal Data that Section 1.3 of the Acceptable Use Policy or Section 8.2 of the Principal Agreement restricts.

2.4 California and Other US State Privacy Laws

Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA"), or a substantially similar US state privacy law applies to Controller Personal Data, valueIQ processes that data as a "service provider" or "processor" (as those terms are defined under the applicable law), and will not: sell or share Controller Personal Data; retain, use, or disclose it for any purpose other than providing the Services and the specific business purposes described in Schedule 1; or combine it with personal information valueIQ receives from other sources, except as the applicable law permits.

4.2 Risk Assessment

valueIQ takes into account the risks presented by processing — in particular the risk of accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Controller Personal Data — when determining the appropriate level of security.

4.3 Security Certifications

valueIQ doesn't currently hold a third-party security certification (such as SOC 2 Type II or ISO 27001). On request, no more than once every twelve months, valueIQ will provide a completed security questionnaire, as Section 10 of this DPA and Section 12.5 of the Principal Agreement both describe. If valueIQ obtains a certification in the future, this Section 4.3 and Schedule 2 will be updated to reflect it.

4.4 Data Location

Data location for each Subprocessor is set out in the Subprocessor List.

5.2 Subprocessor Obligations

valueIQ will:

1. enter into a written agreement with each Subprocessor imposing data protection obligations no less protective than this DPA;
2. remain fully liable to Customer for a Subprocessor's performance of valueIQ's obligations under this DPA; and
3. conduct reasonable due diligence on a Subprocessor's ability to meet those obligations before engaging it.

5.3 Changes to Subprocessors

valueIQ will post updates to the Subprocessor List at the URL in Section 5.1 at least 30 days before a new Subprocessor begins processing Controller Personal Data, except where a shorter period is necessary to address a security, legal, or operational need. Customer may object on reasonable data-protection grounds by emailing privacy@valueiq.ai within that 30-day period; if the parties can't resolve the objection within a further 30 days, Customer may cancel the affected subscription under Section 5.1 of the Principal Agreement.

6.2 Requests Received Directly

If valueIQ receives a request from an individual concerning Controller Personal Data, valueIQ will promptly notify Customer and won't respond to the request itself, except to confirm receipt and direct the individual to Customer, unless required to respond by law.

7.2 Breach Information

To the extent known at the time, valueIQ's notification will describe: the nature of the breach, including the categories and approximate number of Data Subjects and records affected; valueIQ's contact point for further information; the likely consequences of the breach; and the measures valueIQ has taken or proposes to take to address it.

7.3 Cooperation

valueIQ will cooperate with Customer and take reasonable steps to investigate, mitigate, and remediate the breach.

9.2 Subprocessor Retention

Deletion at the Subprocessor level follows each Subprocessor's own data-handling practices, as described where available in the Subprocessor List.

9.3 Certification

On written request, valueIQ will confirm in writing that it has complied with this Section 9.

9.4 Retention Required by Law

valueIQ may retain Controller Personal Data to the extent required by law, provided it keeps that data confidential and doesn't process it for any other purpose.

10.2 Security Questionnaire

This DPA's audit right is the same one set out in Section 12.5 of the Principal Agreement: on request, no more than once every twelve months, valueIQ will provide a completed security questionnaire. This DPA doesn't create a broader on-site or third-party audit right beyond what Section 12.5 of the Principal Agreement provides. Where Customer is required by Data Protection Laws, or by a sector regulator, to conduct an audit the questionnaire doesn't satisfy, the parties will discuss a reasonable path in good faith, consistent with the confidentiality and scope limits that would apply to any such audit.

11.2 Canada's Adequacy Status

The European Commission has determined that Canada ensures an adequate level of data protection for personal data transferred to organizations subject to PIPEDA. On that basis, valueIQ's own receipt of Controller Personal Data as a Canadian processor doesn't require Standard Contractual Clauses or another Article 46 transfer mechanism.

11.3 SCCs Available on Request

Notwithstanding Section 11.2, if Customer's own compliance program requires it, valueIQ will, on request, execute the Standard Contractual Clauses (Module Two: Controller to Processor) with Customer, completed as set out in Section 11.4, as a contractual backstop alongside the adequacy decision.

11.4 Module Two SCC Completion

Where Section 11.3 applies, the SCCs are completed as follows:

1. Docking Clause (Clause 7): Included.
2. Subprocessor authorization (Clause 9(a)): Option 2 (general written authorization), with the 30-day objection right in Section 5.3 of this DPA.
3. Redress (Clause 11): The optional language isn't included.
4. Governing law (Clause 17): Ireland.
5. Jurisdiction (Clause 18(b)): The courts of Ireland.
6. Annex I.A: Customer is the data exporter; valueIQ is the data importer.
7. Annex I.B: As described in Schedule 1.
8. Annex I.C: The competent supervisory authority is determined per Clause 13.
9. Annex II: As described in Schedule 2.
10. Annex III: As described in Section 5.1 and the Subprocessor List.

11.5 Onward Transfers to Subprocessors — Module Three SCCs

Because Canada's adequacy decision covers valueIQ's own receipt of Controller Personal Data but doesn't extend to valueIQ's Subprocessors located outside the EEA, UK, Switzerland, or another adequate jurisdiction, valueIQ incorporates the Standard Contractual Clauses (Module Three: Processor to Sub-Processor) by reference to govern those onward transfers, with valueIQ as the data exporter and the relevant Subprocessor as the data importer. This is the mechanism that actually does the work for valueIQ's US-based Subprocessors (Supabase, Vellum, OpenAI, Anthropic, Resend, Stripe, lovable.dev, and beehiiv) — not the Module Two clauses in Section 11.4, which cover a different transfer leg (EEA Customer → Canadian valueIQ) that adequacy already covers. Rackspace, valueIQ's Canada-located Subprocessor, doesn't require this mechanism at all: an onward transfer from valueIQ to a Subprocessor within Canada stays inside an adequate jurisdiction under Section 11.2, the same way the Customer-to-valueIQ leg does.

The Module Three SCCs are completed as follows:

1. Docking Clause (Clause 7): Included.
2. Copies of sub-processor agreements on request (Clause 9(c)): Included, subject to the confidentiality protections that would ordinarily apply to a commercially sensitive third-party contract.
3. Redress (Clause 11): The optional language isn't included.
4. Governing law (Clause 17): Ireland.
5. Jurisdiction (Clause 18(b)): The courts of Ireland.
6. Annex I.A: valueIQ is the data exporter; the relevant Subprocessor, as identified in the Subprocessor List, is the data importer.
7. Annex I.B: As described in Schedule 1, to the extent the Subprocessor's processing relates to Controller Personal Data.
8. Annex I.C: The competent supervisory authority is determined per Clause 13, by reference to the Customer whose Controller Personal Data is transferred.
9. Annex II: The Subprocessor's own technical and organizational measures, as described in that Subprocessor's data processing agreement linked from the Subprocessor List, supplemented by the measures in Schedule 2 that valueIQ itself applies upstream.
10. Annex III: Not applicable — this Section 11.5 doesn't itself authorize a further sub-processor beyond the Subprocessor named as data importer; any additional layer is addressed under Section 5 of this DPA and the Subprocessor List.

11.6 UK Transfers

For transfers subject to UK GDPR, the UK's own recognition of Canada's adequacy applies on the same basis as Section 11.2. Where SCCs are needed regardless — including for the same reason described in Section 11.5 for UK-originating data reaching a non-UK-recognized Subprocessor — the UK's International Data Transfer Addendum to the EU SCCs is incorporated by reference.

11.7 Swiss Transfers

For transfers subject to the Swiss FADP, Switzerland's own recognition of Canada's adequacy applies on the same basis as Section 11.2. Where SCCs are needed regardless, they apply with these modifications: references to "GDPR" are read as references to the Swiss FADP; references to the "EU" or a "Member State" are read to include Switzerland; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; and Swiss law governs.

11.8 Supplementary Measures

Where Controller Personal Data is transferred under the SCCs incorporated by Sections 11.4 or 11.5, valueIQ applies these supplementary technical measures: encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent), and role-based access controls; and these organizational and contractual measures: prompt notice to Customer of a government access request affecting Controller Personal Data, unless legally prohibited from doing so; and prompt notice if valueIQ or a Subprocessor becomes unable to comply with the SCCs, in which case Customer may suspend the affected transfer or terminate the affected Services.

13.2 Order Form Customers

A Customer under an Order Form may instead execute this DPA separately, as the Order Form specifies.

14.2 Notices

Notices to valueIQ under this DPA go to privacy@valueiq.ai, or to valueIQ's address above. Notices to Customer go to the address or contact on Customer's Account or Order Form.

14.3 Governing Law and Jurisdiction

This DPA is governed by British Columbia law and applicable Canadian federal law, and the courts of British Columbia in Vancouver have exclusive jurisdiction, matching Section 16.4 of the Principal Agreement — except that the SCCs incorporated under Section 11 are governed by their own governing-law and jurisdiction clauses as completed in Section 11.4, and except for a Data Subject's or supervisory authority's own rights under Data Protection Laws.

14.4 Term

This DPA remains in effect for as long as valueIQ processes Controller Personal Data on Customer's behalf.

14.5 Amendments

valueIQ may update this DPA as Section 16.2 of the Principal Agreement describes for changes to the Terms generally. A negotiated Order Form may instead require written signature to amend this DPA, as that Order Form specifies.

2. Nature and Purpose of Processing

1. Ingestion, storage, and display of Customer Content, including Controller Personal Data it may contain;
2. Generation of Output using AI models, including via Model Providers;
3. Execution of Agent Actions within Customer's workspace at Customer's direction;
4. User authentication and account access management;
5. Usage logging for security, support, and performance purposes.

3. Categories of Data Subjects

Customer's employees and other individuals it authorizes as Users; and individuals whose Personal Data may incidentally appear within Customer Content — for example, a stakeholder's or contact's name in a deal record, value model, or business case.

4. Categories of Personal Data

Contact information (name, work email, job title); account credentials, via valueIQ's authentication provider; Customer Content that may incidentally contain Personal Data about individuals connected to Customer's business dealings; and usage and log data (login activity, feature usage).

5. Special Categories of Personal Data

Customer will not submit special categories of Personal Data (as Article 9 GDPR defines them), sensitive personal information, protected health information, payment card numbers, government identification numbers, or biometric data, consistent with Section 1.3 of the Acceptable Use Policy and Section 8.2 of the Principal Agreement, unless valueIQ has agreed in writing to process that category.

6. Frequency of Transfer

Continuous, for the duration of the Principal Agreement.

7. Retention Period

Per Section 9 of this DPA and Section 5.4 of the Principal Agreement: 30 days post-termination for Customer's access request, then deletion from production systems and backups on valueIQ's normal rotation.

8. Subprocessors and Processing Locations

The current list of Subprocessors, their descriptions of processing, and their processing locations are set out in the Subprocessor List — https://www.valueiq.ai/subprocessors — maintained under Section 5 of this DPA. That list, not this Schedule, is the authoritative and current source; it's kept separate so it can be updated on the notice-and-objection cycle in Section 5.3 without requiring a DPA amendment each time.

2. Access Controls

Role-based access controls; least-privilege principle. Multi-factor authentication is enforced for production infrastructure access.

3. Infrastructure Security

Per the Subprocessor List (Section 5.1 and Schedule 1, item 8). No formal vulnerability or penetration testing program is documented today.

4. Monitoring and Logging

Usage and login activity logging, as described in Schedule 1, item 4. No separately documented centralized monitoring or alerting program exists today beyond each Subprocessor's own platform-level logging.

5. Business Continuity

No formal backup or disaster-recovery plan is documented today; valueIQ relies on Supabase's platform-level backup capabilities, not formally documented as valueIQ's own program.

6. Personnel Security

Confidentiality obligations for personnel with access to Controller Personal Data, per Section 3 of this DPA. No formal background-check or data-protection-training program is documented today — the obligation currently rests on the contractual confidentiality commitment in Section 3, not a documented HR process.

7. Incident Response

Breach notification per Section 7 of this DPA. No separate written incident response plan is documented today — beyond the contractual notice commitment in Section 7, there isn't yet a documented internal playbook for how valueIQ investigates and contains an incident.

8. Vendor Management

Subprocessor due diligence and flow-down obligations per Section 5 of this DPA.

9. Security Certifications

None currently held. See Section 4.3.