Data Processing Addendum

Governs Cyber Alliance's processing of personal information on behalf of a business customer using Sally. It forms part of, and is subject to, the Terms of Service.

01Definitions

Capitalized terms not defined here have the meaning given in the Terms of Service (the "Agreement"). In this Addendum ("DPA"):

• Applicable Data Protection Law means all privacy and data-protection laws that apply to the processing, including South Africa's Protection of Personal Information Act, 2013 ("POPIA"), applicable US state privacy laws, and, where relevant, the EU/UK GDPR.
• Personal Data (or Personal Information) means information relating to an identified or identifiable person that Cyber Alliance processes on the Customer's behalf as part of Customer Content.
• Controller / Responsible Party, Processor / Operator, Data Subject, Processing, and Personal-Data Breach / compromise have the meanings given in Applicable Data Protection Law.
• Subprocessor means a third party engaged by Cyber Alliance to process Personal Data.
• SCCs means the Standard Contractual Clauses approved for restricted international transfers under EU/UK law.

02Roles & scope

For Personal Data contained in Customer Content, the Customer is the Controller / Responsible Party and Cyber Alliance is the Processor / Operator. Each party will comply with its obligations under Applicable Data Protection Law. This DPA applies to Cyber Alliance's processing of Personal Data on the Customer's behalf in providing the Services and prevails over any conflicting term of the Agreement with respect to such processing. The subject-matter, duration, nature, and purpose of the processing, and the categories of Personal Data and Data Subjects, are set out in Annex I.

03Processing instructions

Cyber Alliance will process Personal Data only on the Customer's documented instructions, including as set out in the Agreement and this DPA and as given through the Services, and as required by law, in which case Cyber Alliance will (where legally permitted) inform the Customer first. The Customer's instructions must comply with Applicable Data Protection Law, and the Customer is responsible for the accuracy and lawfulness of the Personal Data and for having the necessary rights and lawful bases to provide it. Cyber Alliance will inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

04Confidentiality

Cyber Alliance will ensure that personnel authorized to process Personal Data are bound by appropriate obligations of confidentiality and are subject to access on a need-to-know, least-privilege basis.

05Security

Cyber Alliance will implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. A description of these measures is set out in Annex II. Cyber Alliance may update its measures provided they do not materially reduce the overall level of security.

06Subprocessors

The Customer provides a general authorization for Cyber Alliance to engage Subprocessors to process Personal Data. Current Subprocessors are listed in Annex III. Cyber Alliance will: (a) impose data-protection obligations on each Subprocessor that are no less protective than those in this DPA; (b) remain responsible for its Subprocessors' performance; and (c) give the Customer at least thirty (30) days' notice of any intended addition or replacement of a Subprocessor, by email to the Customer's account administrator or by updating a subprocessor list that the Customer can subscribe to, during which the Customer may object on reasonable data-protection grounds. Where a replacement is urgently needed for security or service continuity, Cyber Alliance will give notice as soon as reasonably practicable. If the parties cannot resolve a documented objection, the Customer may terminate the affected part of the Services as its sole remedy.

07Data-subject requests

Taking into account the nature of the processing, Cyber Alliance will assist the Customer by appropriate technical and organizational measures, insofar as reasonably possible, to respond to requests from Data Subjects to exercise their rights. If Cyber Alliance receives such a request directly, it will, where legally permitted, refer the Data Subject to the Customer and not respond except on the Customer's instruction.

08Personal-data breaches

Cyber Alliance will notify the Customer without undue delay, and in any event within seventy-two (72) hours, after confirming a Personal-Data Breach / compromise affecting the Customer's Personal Data, and will provide information reasonably available to it to help the Customer meet its own notification obligations (including, under POPIA, to the Information Regulator and affected Data Subjects). Cyber Alliance will take reasonable steps to mitigate and remediate the breach.

Where the Customer is a US banking organization subject to the federal Computer-Security Incident Notification Rule, Cyber Alliance will also notify the Customer as soon as possible after determining that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the Services provided to the Customer for four (4) or more hours.

09DPIAs & prior consultation

Taking into account the nature of processing and the information available to it, Cyber Alliance will provide reasonable assistance to the Customer with data-protection impact assessments and any prior consultation with a supervisory authority or the Information Regulator that Applicable Data Protection Law requires.

10International transfers

The Services are hosted in the United States, and Personal Data may be processed in the United States and other countries. The parties will ensure that any restricted international transfer is made on a lawful basis:

• POPIA (South Africa): transfers out of South Africa are made in accordance with section 72 of POPIA, for example on the basis of the Data Subject's consent, because the transfer is necessary to perform the Agreement, or because the recipient is subject to adequate protections.
• EU/UK (if applicable): where the EU/UK GDPR applies to a transfer, the parties agree the applicable SCCs (with the UK Addendum where relevant) are incorporated by reference and completed using the information in Annexes I–III. Module Two (controller to processor) applies where the Customer is a controller and Module Three (processor to processor) applies where the Customer is a processor; Clause 7 (docking) does not apply; the optional language in Clause 11 does not apply; Option 2 (general written authorization) applies under Clause 9 with the notice period in §6; and the SCCs are governed by the laws of, and disputes are resolved in the courts of, Ireland. For UK transfers, the UK International Data Transfer Addendum applies, and its tables are completed with the information in this DPA and its Annexes.

11Deletion & return

On termination or expiry of the Agreement, Cyber Alliance will make Customer Content available for export for thirty (30) days. Cyber Alliance will then delete the Personal Data it processes on the Customer's behalf within ninety (90) days after termination or expiry, unless the Customer asks in writing during the export period for return of the Personal Data in a commonly used format. Cyber Alliance may keep Personal Data to the extent required by law, and copies in routine backups will be overwritten in the ordinary course and remain protected under this DPA until then. On written request, Cyber Alliance will confirm deletion in writing.

12Audits

Cyber Alliance will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor it mandates. To minimize disruption, audits will take place on reasonable prior notice, no more than once a year (unless required by a supervisory authority or following a breach), during business hours, subject to confidentiality, and Cyber Alliance may satisfy audit requests by providing current third-party certifications or reports where available. The Customer will first seek to verify compliance through Cyber Alliance's written security documentation and responses to a reasonable security questionnaire. An on-site inspection may be requested only where that information is reasonably insufficient, where required by a supervisory authority or the Customer's regulator, or following a Personal-Data Breach, and any inspection is at the Customer's expense. Nothing in this section limits access by a regulator with authority over the Customer.

13POPIA operator terms

Where Cyber Alliance acts as an Operator under POPIA, it will: process Personal Information only with the knowledge or authorization of the Customer as Responsible Party; treat Personal Information as confidential and not disclose it unless required by law or in the course of performing the Services; secure the integrity and confidentiality of Personal Information by taking appropriate, reasonable technical and organizational measures under sections 19–21 of POPIA; and notify the Customer where there are reasonable grounds to believe Personal Information has been accessed or acquired by an unauthorized person, to enable the Customer to meet its obligations to the Information Regulator and Data Subjects.

14US service-provider terms

Where US state privacy law applies and Cyber Alliance is a "service provider" or "processor," Cyber Alliance will process Personal Data only to provide the Services (a business purpose) and will not: sell or share it; retain, use, or disclose it outside the direct business relationship or for any purpose other than providing the Services; or combine it with data from other sources except as permitted by law. Cyber Alliance certifies it understands and will comply with these restrictions.

15Liability, precedence & term

This DPA is subject to the limitations and exclusions of liability set out in the Agreement. In the event of a conflict, this DPA prevails over the rest of the Agreement with respect to the processing of Personal Data. This DPA takes effect when incorporated into the Agreement and continues for as long as Cyber Alliance processes Personal Data on the Customer's behalf. The governing law and forum are those of the Agreement, without prejudice to mandatory provisions of Applicable Data Protection Law.

16Acceptance & signatures

This DPA is part of the Agreement and binds the Customer when the Customer accepts the Terms of Service. Where a Customer requires a signed copy, the parties sign below.

Customer: ______________________ · By: ______________________ · Name: ______________________ · Title: ______________________ · Date: ____________

Cyber Alliance Consortium, LLC · By: ______________________ · Name: Kendrall Felder · Title: Chief Executive Officer · Date: ____________

IDetails of processing

IITechnical & organizational security measures

The following describes the measures in place.

• Access control: authentication via a managed identity provider (Auth0) with email verification; role-based, least-privilege access to production; restricted administrative access.
• Encryption: encryption of Personal Data in transit (TLS); encryption at rest for databases and object storage; secrets held in a managed secrets store with managed keys.
• Network security: segregated cloud network with private subnets, security groups, and controlled ingress/egress; services isolated behind load balancers.
• Segregation: logical separation of customer/organization data within the platform.
• Logging & monitoring: centralized application and infrastructure logging, health monitoring, and alerting.
• Resilience: managed database backups and recovery processes; infrastructure managed as code.
• Vulnerability management: dependency and platform maintenance; internal review of changes before release.
• Personnel: confidentiality obligations and need-to-know access for staff and contractors.
• Vendor management: use of reputable subprocessors under contract (Annex III).

AI and data minimization: automated filtering designed to remove secrets and credentials from content before it is sent to the AI Subprocessor; per-user and per-Organization authorization checks on access to Customer Content.

IIISubprocessors

Current Subprocessors used to provide the Services.

Cyber Alliance will keep this list current and give notice of changes under §6.