Prism Data Processing Addendum

“Applicable Data Protection Law” means privacy, security, and data-protection laws applicable to the processing of Personal Data under the Agreement. “Personal Data” means information relating to an identified or identifiable person, or otherwise constituting personal information/personal data under Applicable Data Protection Law. “Process” means any operation performed on Personal Data. “Customer Personal Data” means Personal Data contained in Customer Data that SCT processes on Customer’s behalf. “Subprocessor” means a third party engaged by SCT to process Customer Personal Data on SCT’s behalf.

As between the parties, Customer is the controller/business and SCT is the processor/service provider with respect to Customer Personal Data, unless Applicable Data Protection Law requires otherwise. SCT will process Customer Personal Data only: (a) to provide, secure, support, maintain, and improve the Services for Customer; (b) in accordance with the Agreement, this DPA, and Customer’s documented lawful instructions; (c) as required by Applicable Data Protection Law; and (d) as otherwise permitted by Applicable Data Protection Law. Customer is responsible for ensuring that its instructions and its collection, disclosure, and use of Customer Personal Data are lawful and that it has provided all required notices and obtained all required consents or other lawful bases.

SCT will not sell or share Customer Personal Data as those terms are defined under applicable U.S. privacy law. SCT will not retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in this DPA and the Agreement, including providing the Services to Customer, except as otherwise permitted by Applicable Data Protection Law. SCT will not combine Customer Personal Data with personal information received from another source except as permitted by Applicable Data Protection Law.

SCT will not use Customer Personal Data or Customer-specific Output to train, retrain, or improve a generative artificial-intelligence model for the benefit of other customers. SCT may use aggregated or deidentified information that does not reasonably identify Customer, a Data Subject, or Customer-specific portfolio, holding, watchlist, or strategy to operate, secure, analyze, support, benchmark, and improve the Services, provided SCT does not attempt to reidentify that information except as permitted by law to test its deidentification safeguards.

SCT will ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations. SCT will implement and maintain commercially reasonable administrative, technical, and organizational safeguards designed to protect Customer Personal Data against accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, or use, taking into account the nature of the Services, the sensitivity of the Customer Personal Data, and the state of the art. Customer acknowledges that no security measure is perfect or impenetrable.

SCT will notify Customer without undue delay after SCT confirms a Security Incident involving Customer Personal Data. “Security Incident” means a confirmed accidental, unlawful, or unauthorized destruction, loss, alteration, disclosure of, or access to Customer Personal Data processed by SCT, excluding unsuccessful attempts or activities that do not compromise the security of Customer Personal Data (such as pings, scans, denial-of-service attempts, or failed log-in attempts). SCT will provide information reasonably available to SCT to assist Customer in meeting its obligations under Applicable Data Protection Law and will take commercially reasonable steps to contain, investigate, and mitigate the Security Incident. Notification is not an admission of fault or liability.

Customer authorizes SCT to use the Subprocessors listed at https://www.shorect.com/subprocessors and SCT affiliates as Subprocessors. SCT will maintain a current list of material Subprocessors and will provide at least 10 days’ prior notice of a material new Subprocessor by posting an update to that list or by another reasonable electronic notice. Customer may object in writing on reasonable data-protection grounds within that notice period. The parties will work in good faith to resolve the objection. If they cannot resolve it and the objection is reasonable, Customer may terminate the affected Services on written notice; SCT will refund any prepaid fees covering the unused portion of the terminated affected Services. SCT will impose written data-protection obligations on Subprocessors that are no less protective in substance than those imposed on SCT by this DPA and remains responsible for its Subprocessors’ processing of Customer Personal Data to the extent required by law.

Taking into account the nature of processing, SCT will provide reasonable assistance to Customer, upon request and to the extent SCT is able, to respond to verifiable requests from Data Subjects to exercise rights under Applicable Data Protection Law. If SCT receives such a request directly, SCT will notify Customer unless prohibited by law and will not respond except as instructed by Customer or required by law. SCT will provide reasonable assistance, taking into account the nature of processing and information available to SCT, with Customer’s data-protection impact assessments, regulatory consultations, and other compliance obligations, where required by Applicable Data Protection Law. SCT may charge reasonable fees for assistance that is materially burdensome or outside the ordinary functionality of the Services.

During the Agreement and for 90 days after its termination or expiration, Customer may export Customer Data using the Services’ then-available export functionality. Following that 90-day period, SCT will delete Customer Personal Data in accordance with its then-current retention practices, unless continued retention is required or permitted by law, legal process, insurance, dispute-resolution, fraud-prevention, security-monitoring, backup, or archival requirements. Retained Customer Personal Data will remain protected under this DPA and will be processed only for the retention purpose. Information held in backups may be retained until deleted in the ordinary course of SCT’s backup cycle and will not be actively processed except for backup restoration, security, or legal purposes.

Upon reasonable written request no more than once annually, SCT will make available information reasonably necessary to demonstrate compliance with this DPA, including available security documentation, summaries, or third-party audit materials, subject to confidentiality and reasonable restrictions. If that information is insufficient to demonstrate compliance with a legally applicable obligation, Customer may request a remote audit by an independent auditor, at Customer’s expense, on at least 30 days’ notice, during normal business hours, no more than once annually, and subject to SCT’s reasonable security, confidentiality, and non-interference requirements. Any audit will not provide access to other customers’ information, SCT source code, or systems beyond what is reasonably necessary.

If Customer Personal Data is subject to a cross-border transfer restriction under Applicable Data Protection Law, the parties will cooperate in good faith to implement an appropriate lawful transfer mechanism reasonably required for the Services. Unless otherwise agreed in writing, SCT will process Customer Personal Data in the United States and in locations where SCT or its Subprocessors maintain facilities or operations, as identified in the Subprocessor list.

To the extent the California Consumer Privacy Act, as amended (“CCPA”), applies, SCT is a “service provider” or “contractor,” as applicable, and Customer is a “business.” SCT certifies that it understands and will comply with the restrictions and obligations applicable to service providers/contractors under the CCPA. Customer may take reasonable and appropriate steps to help ensure SCT uses Customer Personal Data consistently with Customer’s CCPA obligations, including exercising the audit/information rights in Section 9. SCT will notify Customer if SCT determines it can no longer meet its CCPA obligations and will allow Customer to take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

Subject matter and duration: SCT’s provision of the Services during the Agreement and applicable retention period. Nature and purpose: hosting, processing, securing, supporting, maintaining, and providing the Services; account administration; customer support; and lawful service analytics. Categories of Data Subjects: Customer personnel, Authorized Users, and any individuals whose Personal Data Customer elects to submit to the Services. Categories of Personal Data: account, contact, authentication, usage, and Customer-submitted information; Customer should not submit sensitive personal information or nonpublic personal information about clients/end investors unless SCT expressly agrees in writing. Processing activities: collection, recording, organization, storage, retrieval, use, transmission, deletion, and other processing necessary to provide the Services and comply with law.

This DPA supplements the Agreement. In the event of a conflict, this DPA controls solely with respect to the processing of Customer Personal Data. SCT may update this DPA to reflect changes in Applicable Data Protection Law, its Services, or its processing practices, provided no update materially diminishes Customer’s protections during a current paid subscription period without notice or as required by law. Capitalized terms not defined in this DPA have the meanings given in the Agreement.