QuickSignals Data Processing Addendum

Effective Date: September 15, 2026

Last Updated: September 15, 2026

This Data Processing Addendum ("DPA") forms part of the QuickSignals Terms of Service, Master Services Agreement, Order Form, Enterprise Agreement, or other written agreement governing the Customer's use of the Services (collectively, the "Agreement").

This DPA is entered into between QuickSignals LLC ("QuickSignals," "Processor," "Service Provider," "Contractor," "we," or "us") and the customer identified in the applicable Agreement ("Customer," "Controller," "Business," or "you").

This DPA governs QuickSignals' Processing of Customer Personal Data on behalf of Customer.

1. Purpose

The purpose of this DPA is to establish the parties' respective obligations regarding the Processing of Personal Data in connection with the Services.

The parties intend this DPA to address applicable data-protection requirements, including, where applicable:

• The EU General Data Protection Regulation ("GDPR").
• The UK GDPR.
• Applicable U.S. state privacy laws.
• The California Consumer Privacy Act, as amended ("CCPA").
• Other applicable privacy and data-protection laws.

Where applicable law requires additional contractual provisions, those provisions will apply to the extent required.

2. Definitions

For purposes of this DPA:

"Applicable Data Protection Law" means applicable laws and regulations governing the Processing, privacy, security, protection, or transfer of Personal Data.

"Controller" means the person or entity that determines the purposes and means of Processing Personal Data.

"Customer Personal Data" means Personal Data Processed by QuickSignals on behalf of Customer in connection with the Services.

Customer Personal Data does not automatically include all data available through QuickSignals.

"Data Subject" means an identified or identifiable person to whom Personal Data relates.

"Personal Data" means information relating to an identified or identifiable natural person, or any substantially similar concept such as "personal information" or "personal data" defined under Applicable Data Protection Law.

"Process" or "Processing" includes any operation performed on Personal Data, including:

• Collecting.
• Accessing.
• Storing.
• Organizing.
• Analyzing.
• Transmitting.
• Modifying.
• Retrieving.
• Using.
• Disclosing.
• Deleting.
• Otherwise handling Personal Data.

"Processor" means a party that Processes Personal Data on behalf of a Controller.

"Security Incident" means a confirmed breach of security resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to Customer Personal Data.

"Subprocessor" means a third party engaged by QuickSignals to Process Customer Personal Data on behalf of Customer.

3. Scope of This DPA

This DPA applies only to Customer Personal Data that QuickSignals Processes on behalf of Customer.

For example, it may apply when Customer:

• Uploads contact lists.
• Uploads CRM records.
• Provides prospect lists.
• Uploads customer data.
• Connects a CRM or other business system.
• Submits keywords associated with identifiable individuals.
• Sends Personal Data through an API.
• Instructs QuickSignals to analyze Customer-provided Personal Data.
• Otherwise causes QuickSignals to Process Personal Data on Customer's behalf.

4. Data Outside the Scope of This DPA

This DPA does not automatically apply to Personal Data for which QuickSignals independently determines the purposes and means of Processing.

This may include, depending on the circumstances:

• QuickSignals account-registration information.
• Billing information.
• Security logs.
• Fraud-prevention information.
• Product analytics.
• QuickSignals' own business contacts.
• Information processed to comply with legal obligations.
• Personal Data within QuickSignals-controlled datasets for which QuickSignals acts as an independent Controller.
• Information QuickSignals processes independently for legitimate operational purposes.

Such Processing is governed primarily by the QuickSignals Privacy Policy and Applicable Data Protection Law.

Nothing in this DPA changes the legal role of either party where applicable law assigns a different role based on the actual Processing activity.

5. Roles of the Parties

For Customer Personal Data:

• Customer generally acts as Controller or Business.
• QuickSignals generally acts as Processor, Service Provider, or Contractor.

If Customer itself acts as a Processor for another Controller, QuickSignals may act as Customer's Subprocessor.

Each party is responsible for complying with the legal obligations applicable to its role.

6. Customer Instructions

QuickSignals will Process Customer Personal Data only:

• According to Customer's documented instructions.
• As necessary to provide the Services.
• As provided in the Agreement and this DPA.
• As required by applicable law.

The Agreement, Customer's configuration of the Services, Customer's use of functionality, API requests, integrations, and documented support requests constitute Customer instructions.

If QuickSignals believes that an instruction violates Applicable Data Protection Law, QuickSignals may notify Customer and suspend the affected Processing until the issue is resolved, where legally permitted.

7. Customer Responsibilities

Customer represents and warrants that:

• It has a lawful basis or other legal authority to Process and provide Customer Personal Data.
• It has provided all notices required by applicable law.
• It has obtained legally required consents where applicable.
• Its instructions to QuickSignals comply with Applicable Data Protection Law.
• It will not direct QuickSignals to engage in unlawful Processing.
• Customer Personal Data provided to QuickSignals was obtained lawfully.

Customer remains responsible for determining whether the Services are appropriate for Customer's intended use.

8. Purpose Limitation

QuickSignals will Process Customer Personal Data only for the limited and specified purposes described in:

• The Agreement.
• This DPA.
• The applicable Order Form.
• Customer's documented instructions.
• The description of Processing contained in Schedule 1.

QuickSignals will not materially expand the purpose of Processing Customer Personal Data without authorization where required by applicable law.

9. Confidentiality

QuickSignals will ensure that personnel authorized to Process Customer Personal Data are subject to appropriate confidentiality obligations.

Access to Customer Personal Data will be limited to individuals who reasonably require access for legitimate operational purposes.

10. Security

QuickSignals will maintain reasonable and appropriate administrative, technical, and organizational safeguards designed to protect Customer Personal Data.

Measures may include, as appropriate:

• Authentication controls.
• Role-based access controls.
• Least-privilege access.
• Encryption in transit.
• Encryption at rest where appropriate.
• Logging and monitoring.
• Vulnerability management.
• Malware protection.
• Secure software-development practices.
• Backups.
• Incident-response procedures.
• Employee security awareness.
• Vendor security controls.
• Access reviews.
• Business-continuity measures.

Additional measures are described in Schedule 3 – Technical and Organizational Measures.

QuickSignals may modify security measures over time provided that the overall level of protection is not materially reduced.

11. Security Incidents

QuickSignals will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data where notification is required under applicable law or the Agreement.

Notification may include information then reasonably available concerning:

• The nature of the incident.
• Categories of affected information.
• Categories or approximate number of affected Data Subjects, where known.
• Measures taken or proposed.
• Potential consequences, where reasonably known.
• Contact information for follow-up.

QuickSignals may provide information in phases as an investigation progresses.

Notification of a Security Incident does not constitute an admission of fault or liability.

12. Customer Security Responsibilities

Customer is responsible for:

• Securing Customer credentials.
• Configuring account permissions appropriately.
• Controlling Authorized Users.
• Protecting exported data.
• Securing Customer systems.
• Promptly removing unauthorized users.
• Maintaining appropriate security for connected systems.
• Notifying QuickSignals of suspected unauthorized account access.

QuickSignals is not responsible for a Security Incident caused solely by Customer's failure to maintain reasonable account or system security, except to the extent applicable law provides otherwise.

13. Subprocessors

Customer provides QuickSignals with general authorization to engage Subprocessors as necessary to provide the Services.

Subprocessors may provide services including:

• Cloud hosting.
• Infrastructure.
• Data processing.
• AI processing.
• Communications.
• Authentication.
• Analytics.
• Customer support.
• Security.
• Data enrichment.
• Data collection.
• Other supporting services.

QuickSignals will maintain a Subprocessor List identifying applicable Subprocessors.

14. Subprocessor Obligations

QuickSignals will enter into appropriate contractual obligations with Subprocessors requiring them to protect Customer Personal Data in a manner consistent with applicable requirements imposed on QuickSignals under this DPA.

QuickSignals remains responsible for its Subprocessors' Processing of Customer Personal Data to the extent required by applicable law and this DPA.

15. New Subprocessors

Where required by applicable law or contract, QuickSignals will provide Customer reasonable notice before engaging a new Subprocessor that will materially Process Customer Personal Data.

Customer may object to a new Subprocessor on reasonable and documented data-protection grounds.

The parties will work in good faith to address the objection.

If no commercially reasonable resolution can be reached, QuickSignals may allow Customer to discontinue the affected portion of the Services.

Any refund rights will be governed by the applicable Agreement.

16. Data-Subject Requests

Taking into account the nature of the Processing, QuickSignals will provide reasonable assistance to Customer in responding to applicable Data Subject requests involving Customer Personal Data.

Such requests may include:

• Access.
• Correction.
• Deletion.
• Restriction.
• Portability.
• Objection.
• Opt-out requests.

If QuickSignals receives a request concerning Customer Personal Data and can reasonably identify Customer as the appropriate Controller, QuickSignals may direct the requester to Customer unless applicable law requires QuickSignals to respond directly.

QuickSignals will not independently respond on Customer's behalf unless authorized or legally required.

17. Regulatory Assistance

Taking into account the nature of the Processing and information available to QuickSignals, QuickSignals will provide reasonable assistance with Customer's applicable obligations concerning:

• Security.
• Security Incident notifications.
• Data-protection impact assessments.
• Regulatory consultations.
• Data Subject rights.

Assistance beyond standard Service functionality may be subject to reasonable fees where permitted under the Agreement and applicable law.

18. Data Protection Impact Assessments

Where required by applicable law and reasonably related to QuickSignals' Processing of Customer Personal Data, QuickSignals will provide Customer with information reasonably necessary to support a Data Protection Impact Assessment or similar assessment.

Customer remains responsible for determining whether such an assessment is legally required.

19. Audit and Compliance Information

QuickSignals will make available information reasonably necessary to demonstrate compliance with its applicable obligations under this DPA.

QuickSignals may satisfy audit obligations through:

• Independent security reports.
• Certifications.
• Questionnaires.
• Compliance documentation.
• Other appropriate evidence.

Where an onsite or additional audit is legally required and the available information is insufficient, the parties will cooperate regarding a reasonable audit.

Audits must:

• Provide reasonable advance notice.
• Occur during normal business hours.
• Avoid unreasonable disruption.
• Protect QuickSignals and third-party confidential information.
• Be limited to matters relevant to Customer Personal Data.

Customer will bear audit costs unless applicable law requires otherwise or the audit identifies a material violation by QuickSignals.

20. Return and Deletion of Customer Personal Data

Upon termination or expiration of the applicable Services, QuickSignals will, subject to applicable law and technical limitations:

• Delete Customer Personal Data.
• Return Customer Personal Data where the Services provide export functionality.

QuickSignals may retain information where required for:

• Legal obligations.
• Fraud prevention.
• Security.
• Dispute resolution.
• Backup retention.
• Regulatory compliance.
• Establishment or defense of legal claims.

Retained Personal Data will remain subject to appropriate protections and will not be used for unrelated purposes.

21. Backups

Customer Personal Data may remain temporarily within backup systems following deletion from active systems.

Backup copies will be isolated from ordinary use and deleted or overwritten according to QuickSignals' ordinary backup-retention cycle unless retention is legally required.

U.S. PRIVACY LAW PROVISIONS

22. U.S. State Privacy Laws

Where QuickSignals Processes Customer Personal Data as a Processor, Service Provider, or Contractor under applicable U.S. state privacy laws, QuickSignals will comply with contractual requirements applicable to that role.

23. California Service Provider / Contractor Terms

To the extent the CCPA applies and QuickSignals acts as a Service Provider or Contractor:

QuickSignals will Process Personal Information only for the limited and specified business purposes identified in this DPA and the Agreement.

QuickSignals will not:

• Sell Customer Personal Information.
• Share Customer Personal Information for cross-context behavioral advertising except as expressly permitted by applicable law and written agreement.
• Retain, use, or disclose Customer Personal Information outside the direct business relationship with Customer except as legally permitted.
• Retain, use, or disclose Customer Personal Information for purposes other than the specified business purposes except where permitted by the CCPA.
• Combine Customer Personal Information with Personal Information received from another person or collected through QuickSignals' own interaction with a consumer except where the CCPA permits such combination.

California regulations specifically require service-provider and contractor agreements to identify the specific business purposes for Processing rather than relying on a generic reference to the contract.

24. CCPA Compliance

QuickSignals will comply with applicable CCPA obligations imposed on Service Providers or Contractors.

QuickSignals will:

• Provide an appropriate level of privacy protection.
• Notify Customer if QuickSignals determines it can no longer meet applicable contractual privacy obligations.
• Permit Customer to take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Information where required by law.

Nothing in this section prevents QuickSignals from Processing Personal Information where expressly permitted under the CCPA.

25. U.S. Consumer Requests

Where required under applicable U.S. state privacy laws, QuickSignals will reasonably assist Customer in responding to consumer requests concerning Customer Personal Data.

Customer remains responsible for:

• Receiving consumer requests.
• Verifying requests where required.
• Determining applicable rights.
• Providing the substantive response.

These responsibilities apply unless applicable law assigns them differently.

EUROPEAN DATA PROTECTION TERMS

26. GDPR Article 28 Requirements

Where the GDPR applies and QuickSignals acts as Processor, QuickSignals will:

• Process Personal Data only on documented instructions.
• Ensure authorized personnel are subject to confidentiality.
• Implement appropriate security measures.
• Comply with applicable Subprocessor requirements.
• Assist with Data Subject rights.
• Assist with certain security and regulatory obligations.
• Delete or return Personal Data upon completion of Services, subject to lawful retention requirements.
• Make information reasonably necessary to demonstrate compliance available.
• Inform Customer where an instruction appears to violate applicable data-protection law.

The European Commission has adopted controller-processor clauses specifically addressing GDPR Article 28 requirements.

27. International Data Transfers

If Customer Personal Data subject to the GDPR is transferred to a country that does not benefit from an applicable adequacy decision, the parties will use an appropriate lawful transfer mechanism.

Such mechanisms may include the European Commission's Standard Contractual Clauses ("SCCs").

The European Commission adopted updated SCCs for international transfers on June 4, 2021.

28. EU Standard Contractual Clauses

Where required, the European Commission Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 are incorporated into this DPA.

The appropriate module will apply according to the parties' roles.

Generally:

• Module Two – Controller to Processor applies where Customer is Controller and QuickSignals is Processor.
• Module Three – Processor to Processor applies where Customer is itself a Processor and QuickSignals is its Subprocessor.

If the SCCs conflict with another provision of this DPA regarding an international transfer covered by the SCCs, the SCCs will control to the extent of the conflict.

29. SCC Annex Information

For purposes of the SCCs:

• Data Exporter: Customer.
• Data Importer: QuickSignals LLC, where applicable.

The description of Processing in Schedule 1 will serve as the relevant transfer description to the extent appropriate.

The Technical and Organizational Measures described in Schedule 3 will serve as the applicable security description.

The Subprocessor information maintained by QuickSignals will serve as relevant subprocessor information where permitted.

Specific SCC election details should be completed in the applicable Enterprise Agreement or SCC annex.

30. Transfer Impact Assessments

Where reasonably required in connection with an international transfer, each party will cooperate in good faith regarding information reasonably necessary for a transfer impact assessment.

Each party remains responsible for its obligations under applicable transfer law.

31. Government Access Requests

Where legally permitted, QuickSignals will:

• Review government requests for Customer Personal Data.
• Seek clarification where appropriate.
• Challenge requests that QuickSignals reasonably determines are unlawful or overbroad where appropriate.
• Notify Customer where legally permitted.

QuickSignals will disclose only information reasonably required by a valid legal demand.

UK DATA PROTECTION

32. United Kingdom Transfers

Where the UK GDPR applies to a restricted international transfer, the parties will use an appropriate transfer mechanism recognized under UK law.

Where appropriate, the UK International Data Transfer Addendum to the EU SCCs will apply.

The UK ICO explains that the EU SCCs are not independently sufficient for restricted transfers under UK GDPR, but they can be used with the UK Addendum.

The ICO's current Addendum is designed to provide appropriate safeguards for covered restricted transfers.

33. Other International Requirements

Where Personal Data subject to another jurisdiction's transfer requirements is Processed under the Services, the parties will cooperate in good faith to implement legally required contractual mechanisms.

Any jurisdiction-specific addendum agreed by the parties will form part of this DPA.

QUICKSIGNALS-SPECIFIC DATA TERMS

34. QuickSignals Intelligence Data

Customer acknowledges that QuickSignals may separately maintain information obtained from:

• Third-party data providers.
• Public sources.
• Licensed datasets.
• Professional databases.
• Social platforms.
• Business databases.
• Other permitted sources.

Where QuickSignals determines the purposes and means of Processing such information independently of Customer, that information is not automatically Customer Personal Data solely because Customer can access it through the Services.

QuickSignals' independent Processing remains subject to Applicable Data Protection Law and the QuickSignals Privacy Policy.

35. Customer Search Instructions

A Customer's:

• Search query.
• Keyword.
• Monitoring request.
• Enrichment request.
• Contact request.
• API call.
• Uploaded identifier.
• Other configuration

may constitute an instruction to QuickSignals to Process Personal Data.

Customer is responsible for ensuring that such instructions are lawful.

36. Contact Enrichment

Where Customer submits Personal Data to QuickSignals for contact enrichment, verification, matching, or analysis, QuickSignals may transmit necessary identifiers to authorized Subprocessors or data providers for the purpose of completing the requested service.

QuickSignals will limit such transmission to information reasonably necessary to perform the requested functionality.

37. AI Processing

Where Customer Personal Data is processed through AI functionality, QuickSignals will Process such data consistent with:

• Customer's instructions.
• The Agreement.
• This DPA.
• Applicable Data Protection Law.

QuickSignals may use third-party AI providers as Subprocessors where appropriate.

Customer should not submit highly sensitive Personal Data to AI functionality unless expressly supported by QuickSignals and legally authorized.

38. No Sale of Customer Personal Data by Processor

Where QuickSignals acts solely as Processor, Service Provider, or Contractor with respect to Customer Personal Data, QuickSignals will not sell that Customer Personal Data for its own independent commercial purposes except where Customer has expressly authorized such Processing and the activity is permitted under applicable law.

This restriction does not determine whether separate QuickSignals-controlled datasets constitute a "sale" or "sharing" under a particular privacy law.

Such independent activities are addressed separately in QuickSignals' Privacy Policy.

39. Data Accuracy

Customer acknowledges that information submitted for analysis, matching, enrichment, or processing may contain inaccuracies.

QuickSignals does not guarantee that all:

• Matches.
• Enrichment results.
• Phone numbers.
• Emails.
• Classifications.
• AI outputs.
• Third-party records

will be accurate or current.

The parties will reasonably cooperate regarding correction of Customer Personal Data where required by applicable law.

40. Liability

Liability arising under this DPA is subject to the applicable exclusions and limitations of liability contained in the Agreement unless Applicable Data Protection Law prohibits such limitation.

Nothing in this DPA increases either party's liability beyond what is provided in the Agreement unless expressly required by law.

Where SCCs or another mandatory legal mechanism provides different liability requirements, those requirements will apply to the extent legally required.

41. Order of Precedence

If there is a conflict concerning Processing of Customer Personal Data, the following order generally applies:

• Mandatory Applicable Data Protection Law.
• Applicable Standard Contractual Clauses or mandatory transfer mechanism.
• This DPA.
• Applicable Enterprise Agreement or Order Form.
• QuickSignals Terms of Service.

However, a negotiated agreement may expressly establish a different order of precedence where legally permissible.

42. Term and Survival

This DPA becomes effective when Customer becomes subject to the Agreement and remains effective for as long as QuickSignals Processes Customer Personal Data.

Privacy, confidentiality, security, deletion, liability, and international-transfer obligations that by their nature survive termination will continue for as long as applicable.

43. Modifications

QuickSignals may update this DPA where reasonably necessary to:

• Comply with law.
• Reflect regulatory developments.
• Update security provisions.
• Address new transfer mechanisms.
• Reflect changes to the Services.

QuickSignals will provide notice of material changes where required by law or contract.

Changes will not materially reduce legally required protections for Customer Personal Data.

44. Governing Law

Except where mandatory data-protection law, the SCCs, or another legally required transfer mechanism provides otherwise, this DPA will be governed according to the governing-law provisions contained in the Agreement.

45. Execution

This DPA may be incorporated into the Agreement electronically.

Acceptance of the Agreement may constitute execution of this DPA where the DPA is incorporated by reference and such method is legally permitted.

Enterprise customers may request a separately executed version where appropriate.

SCHEDULE 1

Details of Processing

A. Subject Matter

QuickSignals' provision of business intelligence, social listening, contact intelligence, prospect intelligence, analytics, enrichment, AI, API, and related Services as requested by Customer.

B. Duration

For the duration of Customer's use of the Services and any applicable retention period following termination.

C. Nature of Processing

Processing may include:

• Collection.
• Reception.
• Storage.
• Organization.
• Retrieval.
• Analysis.
• Classification.
• Enrichment.
• Matching.
• Verification.
• Transmission.
• Hosting.
• AI analysis.
• Deletion.
• Other Processing necessary to provide the Services.

D. Purposes

Processing Customer Personal Data for:

• Providing the Services.
• Authenticating Customer.
• Executing Customer searches.
• Enriching Customer records.
• Generating analytics.
• Generating requested intelligence.
• Generating reports.
• Providing APIs.
• Providing integrations.
• Maintaining security.
• Preventing abuse.
• Supporting Customer.
• Troubleshooting.
• Complying with law.
• Carrying out Customer's documented instructions.

E. Categories of Data Subjects

Depending on Customer's use of QuickSignals, Data Subjects may include:

• Customer employees.
• Customer contractors.
• Customer users.
• Customer clients.
• Customer prospects.
• Business contacts.
• Professional contacts.
• Representatives of organizations.
• Social-media users.
• Individuals identified within Customer-provided datasets.
• Other individuals whose Personal Data Customer lawfully submits.

F. Categories of Personal Data

Depending on Customer's use, Personal Data may include:

• Name.
• Professional title.
• Employer.
• Company.
• Business email.
• Telephone number.
• Social-media handle.
• Professional profile.
• Company affiliation.
• Business location.
• IP address.
• Online identifiers.
• CRM information.
• Public professional information.
• Customer-created notes.
• Communication metadata.
• Search identifiers.
• Other Personal Data submitted by Customer.

G. Sensitive Personal Data

The Services are not designed for Customer to upload highly sensitive Personal Data unless expressly authorized.

Customers should not intentionally upload:

• Social Security numbers.
• Account passwords.
• Payment credentials.
• Private medical records.
• Biometric authentication credentials.
• Similar highly sensitive information

unless QuickSignals expressly supports the relevant Processing and the parties have established appropriate contractual safeguards.

SCHEDULE 2

Subprocessors and Data Providers

QuickSignals maintains two separate categories of third parties:

• Subprocessors: third parties engaged by QuickSignals to Process Customer Personal Data on Customer's behalf.
• Third-Party Data Providers: companies from which QuickSignals independently obtains, licenses, or receives datasets for QuickSignals-controlled Processing.

Classification depends on what each company actually does with Customer Personal Data.

For example:

• A provider such as Apify may be a Subprocessor if QuickSignals sends Customer Personal Data to that provider to perform processing on QuickSignals' behalf.
• A company from which QuickSignals independently licenses its own dataset may instead be classified as a Data Provider, not necessarily a Subprocessor.

The current Subprocessor and Data Provider lists are available upon request at contact@quicksignals.io.

The lists may include providers supporting:

• Hosting.
• Cloud infrastructure.
• AI.
• Analytics.
• Security.
• Communications.
• Authentication.
• Customer support.
• Data enrichment.
• Contact intelligence.
• Web-data collection.
• Other infrastructure.

SCHEDULE 3

Technical and Organizational Measures

QuickSignals will maintain reasonable safeguards appropriate to the nature of the Customer Personal Data being Processed.

The applicable measures may include:

Access Management

• Unique user accounts.
• Role-based access.
• Least-privilege principles.
• Authentication controls.
• Administrative-access restrictions.
• Periodic access review.

Encryption

• Encrypted network transmission using appropriate protocols.
• Encryption of Personal Data at rest where appropriate and supported.

Infrastructure Security

• Cloud security controls.
• Network protections.
• Logging.
• Monitoring.
• Malware protection.
• Patch management.
• Vulnerability management.

Application Security

• Secure-development practices.
• Code review where appropriate.
• Dependency management.
• Vulnerability remediation.
• Production-access controls.

Personnel Security

• Confidentiality obligations.
• Role-based access.
• Security awareness.
• Access termination procedures.

Incident Management

• Security-event monitoring.
• Escalation procedures.
• Incident investigation.
• Containment.
• Remediation.
• Legally required notification procedures.

Business Continuity

• Backups.
• Service-recovery measures.
• Disaster-recovery planning appropriate to the Services.

Vendor Management

QuickSignals will maintain processes designed to evaluate appropriate security and privacy obligations for Subprocessors handling Customer Personal Data.

SCHEDULE 4

International Transfer Mechanisms

Where legally required:

European Economic Area

The European Commission's 2021 Standard Contractual Clauses will apply using the appropriate module.

The Commission provides separate modules for relationships such as Controller-to-Processor and Processor-to-Processor.

United Kingdom

The applicable UK International Data Transfer Agreement or UK Addendum to the EU SCCs will be used where required.

Other Jurisdictions

The parties will use another valid transfer mechanism where required by applicable law.

SCHEDULE 5

Contact Information

QuickSignals LLC

• Privacy: /privacy
• Mailing Address: Atlanta, GA; contact@quicksignals.io

Customer

The Customer's contact information is the information associated with its QuickSignals account or applicable Order Form.