Data Processing Addendum

EFFECTIVE DATE: June 29, 2026

This Data Processing Addendum (the “DPA”) is incorporated into and forms part of the Master Subscription Agreement or other agreement (the “Agreement”) between SnapLogic, Inc. and the party identified in the Agreement as the “Customer” (together the “Parties”). Capitalized terms used in this DPA but not defined herein shall have the meanings set forth in the Agreement.

Subject Matter and Duration.
1. Subject Matter. This DPA reflects the Parties’ commitment to abide by Applicable Data Protection Laws concerning the Processing of Personal Data in the provision of SnapLogic’s Services pursuant to the Agreement. To the extent that language in this DPA or any of its Exhibits conflicts with the Agreement, this DPA shall control.
2. Duration and Survival. This DPA will become legally binding upon the later of: (i) the effective date of the Agreement or (ii) the date that the Parties sign this DPA. SnapLogic will Process Personal Data until the Agreement terminates. SnapLogic’s obligations and Customer’s rights under this DPA will continue in effect so long as SnapLogic Processes Personal Data.
Definitions.

For the purposes of this DPA, the following terms apply.

“Applicable Data Protection Law(s)” means all worldwide data protection and privacy laws and regulations applicable to the Personal Data in question (as they may be amended, superseded, or replaced from time to time), including, where applicable:

“EU Data Protection Law”: Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (“GDPR”) and the EU e-Privacy Directive (Directive 2002/58/EC), each as implemented and transposed into local law by any EU member states.

“Swiss DPA”: the Swiss Federal Act on Data Protection 1992.

“UK Data Protection Law”: the UK Data Protection Act and GDPR as incorporated into UK law by the Data Protection Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.

“US Data Protection Law”: all applicable comprehensive state data protection laws and regulations in each case as may be amended or superseded from time to time, including the California Privacy Rights Act (“CPRA”); Colorado Privacy Act; Connecticut Personal Data Privacy and Online Monitoring Act; Delaware Personal Data Privacy Act; Indiana Consumer Data Protection Act; Iowa Consumer Data Protection Act; Montana Consumer Data Privacy Act; Oregon Consumer Privacy Act; Tennessee Information Protection Act; Texas Data Privacy and Security Act; Utah Consumer Privacy Act; Virginia Consumer Data Protection Act.

“Controller” “Processor”, “Data Subject” and “Process” (whether or not capitalized) have the meanings ascribed to them by GDPR and include equivalent terms in other Applicable Data Protection Laws, in each case as applicable to the Services.
“Personal Data” means any Customer Data: (a) relating to an identified or identifiable individual, within the meaning of GDPR (regardless of whether GDPR applies), (b) constituting “personal information” as such term is defined in US Data Protection Law, and (c) equivalent terms in other Applicable Data Protection Laws.
“SCCs” or “Standard Contractual Clauses” means the Standard Contractual Clauses for the Transfer of Personal Data to Processors Established in Third Countries under GDPR, as approved by European Commission Implementing Decision 2021/914. Exhibit A to this DPA contains certain interpretive and supplementary provisions regarding application of the Standard Contractual Clauses.
“Security Incident(s)” means the breach of security leading to the accidental or unlawful loss, unauthorized disclosure of or unauthorized access to Customer Personal Data Processed by SnapLogic.
“Services” means any and all services that SnapLogic performs under the Agreement.
“Sub-processor” means SnapLogic’s authorized contractors, agents, vendors and third party service providers (i.e., sub-processors) that Process Personal Data.

Data Use and Processing.
1. Customer and SnapLogic agree that: (i) Customer is the Controller or Processor of Personal Data and SnapLogic is the Processor or subprocessor, as applicable; and (ii) this Addendum applies where and only to the extent that SnapLogic Processes Personal Data on behalf of Customer as Processor or subprocessor in the course of providing the Services. To the extent the parties share business contact information to maintain their relationship, each party is a separate Controller of such Personal Data.
2. The Customer agrees that: (i) it has obtained all relevant consents or ensured it has other lawful legal basis (as applicable), permissions and rights and provided all relevant notices necessary under Applicable Data Protection Laws for SnapLogic to lawfully Process Personal Data in accordance with this Agreement including, without limitation, Customer’s sharing and/or receiving of Personal Data with third-parties via the Services; (ii) it shall comply with, and is responsible for its affiliates’ and users’ compliance with Applicable Data Protection Laws; and (iii) its Processing instructions to SnapLogic are consistent with Applicable Data Protection Laws and all instructions from third-party Controllers, if applicable.
3. Compliance with Laws. Personal Data shall be Processed in compliance with the terms of this DPA and all Applicable Data Protection Law(s).
4. Documented Instructions. SnapLogic and its Sub-processors shall Process Personal Data only in accordance with the documented instructions of Customer or as specifically authorized by this DPA, the Agreement, or any applicable Statement of Work. SnapLogic will, unless legally prohibited from doing so, inform Customer in writing if it reasonably believes that there is a conflict between Customer’s instructions and applicable law or if it otherwise seeks to Process Personal Data in a manner that is inconsistent with Customer’s instructions.
5. Authorization to Use Sub-processors. To the extent necessary to fulfill SnapLogic’s contractual obligations under the Agreement or any Statement of Work, Customer hereby authorizes SnapLogic to engage Sub-processors. Any Sub-processor Processing of Personal Data shall be consistent with Customer’s documented instructions and comply with all Applicable Data Protection Law(s).
6. SnapLogic and Sub-processor Compliance. SnapLogic agrees to (i) enter into a written agreement with each Sub-processor regarding its Processing of Personal Data that imposes on such Sub-processor data protection and security requirements for Personal Data that are compliant with Applicable Data Protection Law(s); and (ii) remain responsible to Customer for SnapLogic’s Sub-processors’ failure to perform their obligations with respect to the Processing of Personal Data in accordance with such instructions, the Agreement and this DPA.
7. Right to Object to Sub-processors. SnapLogic maintains a list of Sub-processors for the Services who process Customer-supplied Personal Data at https://www.snaplogic.com/privacy-subprocessors (“Sub-processor List”). That page includes a subscription mechanism to receive notification of new Sub-processors. SnapLogic shall provide at least thirty (30) days’ advance notification to subscribing customers of a new Sub-processor(s) before authorizing the new Sub-processor(s) to process Personal Data via the Services. If Customer has legitimate objections to the appointment of any new Sub-processor, the parties will work together in good faith to resolve the grounds for the objection for up to thirty (30) days, and failing any such resolution, Customer may terminate the part of the Service performed under the Agreement that cannot be performed by SnapLogic without use of the objectionable Sub-processor. SnapLogic shall refund any pre-paid fees to Customer prorated in respect of the terminated part of the Service.
8. Confidentiality. Any person or Sub-processor authorized to Process Personal Data must agree to maintain the confidentiality of such information or be under an appropriate ethical, statutory or contractual obligation of confidentiality.
9. Personal Data Inquiries and Requests. SnapLogic agrees to comply with all reasonable instructions from Customer related to any requests from individuals/data subjects exercising their rights in Personal Data granted to them under Applicable Data Protection Law(s) (“Privacy Request”). At Customer’s request and without undue delay, SnapLogic agrees to assist Customer in answering or complying with any Privacy Request in so far as it is possible.
10. Data Protection Impact Assessment and Prior Consultation. SnapLogic agrees to provide reasonable assistance at Customer’s expense to Customer when, in Customer’s judgment, the type of Processing performed by SnapLogic is likely to result in a high risk to the rights and freedoms of natural persons (e.g., systematic and extensive profiling, Processing sensitive Personal Data on a large scale or systematic monitoring on a large scale, or where the Processing uses new technologies) and thus requires a data protection impact assessment and/or prior consultation with the relevant data protection authorities.
11. Demonstrable Compliance. SnapLogic agrees to keep records of its Processing in compliance with Applicable Data Protection Law(s) and provide any necessary records to Customer to demonstrate compliance upon reasonable request.
12. CPRA Requirements. With respect to Personal Data to which the CPRA applies (capitalized terms used in this section having the meanings provided in CPRA) SnapLogic will NOT:
  - sell or share Customer Personal Data;
  - retain, use or disclose Customer Personal Data other than for the business purposes specified in the contract, unless specifically permitted by the CCPA;
  - retain, use, or disclose Customer Personal Data outside of the direct business relationship between the Client and SnapLogic; or
  - combine Customer Personal Data with Personal Data that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, except to perform any business purpose as defined in regulations adopted pursuant to CPRA Section 1798.185(a)(10).

Notwithstanding the foregoing, nothing in this DPA shall restrict SnapLogic’s ability to disclose Personal Data to comply with applicable laws; provided that if such disclosure is required, SnapLogic will promptly notify Customer of the request for disclosure unless such notification is prohibited by applicable law or a legally binding order, or to a Sub-Processor in connection with a business purpose and in accordance with the Sub-Processor provisions above. SnapLogic hereby certifies that it understands the obligations set forth herein and that it will comply with them.

Cross-Border Transfers of Personal Data.
1. Consent. SnapLogic may not transfer Personal Data to, or process such data in, a location outside of the European Economic Area or the UK without Customer’s prior written consent, except in compliance with Section 4(b) below (in each case a “Transfer”).
2. Compliant Transfer Mechanisms. Without prejudice to the foregoing, Customer consents to Transfers where SnapLogic has implemented a Transfer solution compliant with Applicable Data Protection Laws, which for example may include: (a) where such transfer is subject to an adequacy decision by the European Commission; (b) the Standard Contractual Clauses; (c) the Data Privacy Framework administered by the US Department of Commerce (and its successor(s), if any); (d) another appropriate safeguard pursuant to Article 46 of GDPR or equivalent safeguard under GDPR, the Swiss DPA or UK Data Protection Law; or (e) a derogation pursuant to Article 49 of GDPR or its equivalent under or the Swiss DPA or UK Data Protection Law.

Information Security Program.
1. SnapLogic agrees to implement appropriate technical and organizational measures designed to protect Personal Data as required by Applicable Data Protection Law(s) (the “Information Security Program”). Such measures shall include:
  - Pseudonymisation of Personal Data where appropriate, and encryption of Personal Data in transit and at rest;
  - The ability to ensure the ongoing confidentiality, integrity and availability of SnapLogic’s Processing and Personal Data;
  - The ability to restore the availability and access to Personal Data in the event of a physical or technical incident; and
  - A process for regularly evaluating and testing the effectiveness of SnapLogic’s Information Security Program to ensure the security of Personal Data from reasonably suspected or actual accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.
Security Incidents.
1. Security Incident Procedure. SnapLogic will follow policies and procedures to detect, respond to, and otherwise address Security Incidents including procedures to (i) identify and respond to reasonably suspected or known Security Incidents, mitigate harmful effects of Security Incidents, document Security Incidents and their outcomes, and (ii) restore the availability of or access to Personal Data in a timely manner.
2. Notice. SnapLogic agrees to provide prompt written notice without undue delay and within the time frame required under Applicable Data Protection Law(s) (but in no event longer than forty-eight (48) hours) to Customer’s Designated POC (as defined in Section 9) if it knows that a Security Incident has taken place. Such notice will include all available details required under Applicable Data Protection Law(s) for Customer to comply with its own notification obligations to regulatory authorities or individuals affected by the Security Incident.
Audits.
1. Right to Audit; Permitted Audits. In addition to any other audit rights described in the Agreement, Customer and its regulators shall have the right to an on-site audit of SnapLogic’s architecture, systems, policies and procedures relevant to the security and integrity of Personal Data, or as otherwise required by a governmental regulator:
  - Following any notice from SnapLogic to Customer of a Security Incident involving Personal Data for which SnapLogic was at fault;
  - As required by governmental regulators; and
  - Upon Customer’s request not more than once per year (or more frequently if required by applicable regulators or following a Security Incident), and subject to reasonable notice, time, place, frequency, and manner restrictions, and confidentiality requirements, SnapLogic shall make available to Customer information necessary to demonstrate compliance with SnapLogic’s obligations under the Addendum and Applicable Data Protection Laws. SnapLogic will allow for and contribute to audits, including inspections, conducted by Customer, or an independent third-party auditor appointed by Customer. To the extent Customer’s rights under this section cannot reasonably be satisfied through audit reports, documentation, or compliance information SnapLogic makes generally available to its customers, Customer shall be responsible for all costs and fees related to such audit.
2. Audit Terms. Any audits described in this Section shall be:
  - Conducted by Customer or its regulator, or through a third-party independent contractor selected by one of these parties;
  - Conducted during SnapLogic’s customary business hours;
  - Conducted upon reasonable advance notice to SnapLogic; and
  - Of reasonable duration and shall not unreasonably interfere with SnapLogic’s day-to-day operations.
3. Third Parties. In the event that Customer conducts an audit through a third-party independent auditor or a third party accompanies Customer or participates in such audit, such third party shall be required to enter into a nondisclosure agreement containing confidentiality provisions substantially similar to those set forth in the Agreement to protect SnapLogic’s and SnapLogic’s customers’ confidential and proprietary information. In any event, SnapLogic shall be entitled to a copy of any audit report. Regulators shall not be required to enter into a nondisclosure agreement.
Data Storage and Deletion.
1. Data Storage. SnapLogic does not store or persist any Personal Data except as necessary to perform the Services under the Agreement.
2. Post-Termination Data Access and Deletion. Upon expiration or termination of the Agreement, at Customer’s written request made within 30 days after such termination or expiration, SnapLogic will allow Customer to retrieve any Customer Data or transaction log data left in SnapLogic’s system.
Contact Information.
1. SnapLogic and the Customer agree to designate a point of contact for urgent privacy and security issues (a “Designated POC”). SnapLogic’s Designated POC is [email protected]. Customer’s Designated POC is identified in the Order Form.
General Terms.
1. This DPA is part of the Agreement and is governed by its terms and conditions including limitations of liability.
2. This DPA will be governed by and construed in accordance with the governing law and jurisdiction provisions in the Agreement except as otherwise described in Exhibit B.

Exhibit A

Categories of data subjects	Prospects, customers, business partners and vendors of Customer (who are natural persons) Employees or contact persons of Customer’s prospects, customers, business partners and vendors Employees, agents, advisors, freelancers of Customer (who are natural persons) Customer’s users authorized by Customer to use the Services
Categories of personal data transferred	Name, email address, location data (for example the location data function on a mobile phone); IP address; cookie ID; mobile device ID Any other categories of personal data selected by Customer to process via the services
Controller/Processor roles	Controller (Customer) to Processor (Vendor) or Processor (Customer) to subprocessor (Vendor)
Sensitive data transferred	The Service does not require sensitive personal data of Customer personnel. If Customer chooses to process sensitive personal data through its data pipeline, that data will be processed
Frequency of the transfer	Continuous
Nature of the Processing	To provide the services described in the Underlying Agreement
Purpose of the Transfer	To provide the services described in the Underlying Agreement
Duration of the Processing	During the term of the Underlying Agreement

Exhibit B

Standard Contractual Clauses

[Incorporating MODULE TWO: Transfer controller to processor and MODULE THREE: Transfer processor to processor]

By entering into this DPA, the Parties are deemed to sign the Standard Contractual Clauses and their applicable Annexes.
For cross border data transfers that are subject to Standard Contractual Clauses, the Standard Contractual Clauses will be deemed entered into, and incorporated into this DPA by this reference, and completed as follows:
1. Customer is the “exporter”, whose contact information is set forth below.
2. SnapLogic is the “importer”, whose contact information is set forth below.
3. Module Two will apply to the extent that Customer is a controller of the Personal Data, and Module Three will apply to the extent that Customer is a processor of the Personal Data on behalf of a third-party controller;
4. in Clause 7, the optional docking clause will not apply;
5. in Clause 9, Option 2 will apply, and the time period for prior notice of Subprocessor changes will be as set out in Clause 9 of this DPA;
6. in Clause 11, the optional language will not apply;
7. Annexes I – III will be deemed completed with the information set out in Annexes I – III to this DPA.

EU SCCs. Personal Data from the European Union will be governed by the SCCs in accordance with the provisions above and completed as follows:
1. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Irish law;
2. in Clause 18(b), disputes will be resolved before the courts of the Republic of Ireland.

UK SCCs. Personal Data transfers from the United Kingdom will be governed by the SCCs in accordance with the provisions above and the UK International Data Transfer Addendum (the “IDTA”), completed as follows.
1. In Part 1 of the IDTA, the information required by Tables 1 – 3 is provided in the Agreement and this DPA;
2. The IDTA’s Mandatory Clauses are incorporated by reference into this DPA in accordance with Alternative Part 2 of the template IDTA;
3. References to the EU, member states and GDPR are amended mutatis mutandis to refer to the United Kingdom and UK Data Protection Law;
4. In Clause 17 of the Standard Contractual Clauses (Governing Law), the laws of England and Wales shall govern, and in Clause 18 (Choice of forum and jurisdiction), the courts in London, England shall have jurisdiction. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts in the UK.
Swiss SCCs. Personal Data transfers from Switzerland will be governed by the SCCs in accordance with the provisions above and completed as follows:
1. references to ‘Regulation (EU) 2016/679’ in the EU SCCs will be deemed to refer to the Swiss DPA;
2. references to specific articles of ‘Regulation (EU) 2016/679’ will be deemed replaced with the equivalent article or section of the Swiss DPA;
3. references to ‘EU’, ‘Union’, and ‘Member State’ will be deemed replaced with ‘Switzerland’;
4. references to the ‘competent supervisory authority’ and ‘competent courts’ are replaced with the ‘Swiss Federal Data Protection Information Commissioner’ and ‘applicable courts of Switzerland’ (as applicable);
5. In Clause 17, the EU SCCs will be governed by the laws of Switzerland, and
6. Clause 18(b), disputes will be resolved before the competent courts of Switzerland.
If any provision of the Agreement (including this DPA) contradicts, directly or indirectly, the Standard Contractual Clauses, the Standard Contractual Clauses will prevail.

ANNEX I

A. LIST OF PARTIES

Controller(s) / Data exporter(s): Identity and contact details of the controller(s) /data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union

Name:	As provided by the Customer
Address:	As provided by the Customer
Contact person’s name, position and contact details:	As provided by the Customer
Activities relevant to the data transferred under these Clauses:	As described in the Agreement
Role (controller/processor):	Controller/processor

Processor(s) / Data importer(s):Identity and contact details of the processor(s) /data importer(s), including any contact person with responsibility for data protection

Name:	SnapLogic, Inc.
Address:	1825 S. Grant Street, 5^th Floor, San Mateo, California 94402, USA
Contact person’s name, position and contact details:	[email protected]
Activities relevant to the data transferred under these Clauses:	Provision of the Services described in the Agreement
Role (controller/processor):	Processor/Sub-processor

В. DESCRIPTION OF TRANSFER

As described on Exhibit A

C. COMPETENT SUPERVISORY AUTHORITY

As described in Exhibit B

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Data Importer maintains and enforce industry standard technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access and ensure a level of security appropriate to the risk of its processing of Personal Data processing consistent with its obligations under the Agreement and the GDPR. These measures shall include a comprehensive information security program that includes administrative, physical and technical safeguards for protection of the security, confidentiality and integrity of Personal Data that are appropriate to the type of information that Data Importer will process. Data Importer shall regularly monitor compliance with these safeguards.

Core technical and organizational security measures implemented by Data Importer as of the date of signature are described in Data Importer’s most current SOC 2 Type II audit report, which will be provided to Data Exporter upon request.

To mitigate the risk to information processing resources, unauthorized disclosure or erasure of information and interruption of support for business processes which may result from unauthorized access, security controls implemented by the Data Importer are included in the following sections:

Organizational Control – Measures which comply with the specific requests of Data Protection, regarding the internal organization such as commitment of employees to data secrecy, data backup/deletion, spatial/personal separation of data from other customers etc.
Entry Control – Measures to limit entrance of unauthorized persons to areas where personal data is used or processed such gate control, identification badges/code cards etc.
Admission Control – Measures to limit admission of unauthorized persons to systems where personal data is used or processed such as safeguarding of physical network infrastructure, firewalls etc.
Access Control – Measures to limit access of unauthorized persons to systems where personal data is used or processed such as having least privilege/selective access policy, use of encryption, audit logging, individual user ids/strong passwords, regulated procedures for granting, changing and revocation of access rights etc.
Transmission Control – Measures to ensure that personal data cannot be read, copied, modified or removed without authorization such as use of encryption both at rest and in transit, audit logging to have retrospect information which data has been retrieved by whom etc.
Availability Control – Measures to ensure that personal data is protected from accidental destruction or loss such as fail over capabilities, regular tested backups stored in multiple locations and disaster recovery plan, change management process etc.
Separation Control – Measures to ensure that data collected for different purposes can be processed separately such use of separate user roles, logical/physical separation of data etc.

ANNEX III

LIST OF SUB-PROCESSORS

Customer has authorised the use of the following sub-processors: https://www.snaplogic.com/privacy-subprocessors