This Data Processing Agreement ("DPA") forms part of the agreement between RightAsk AI, Inc. and the Customer (as Controller) for the use of the RightAsk Platform. This DPA is automatically incorporated into and subject to the RightAsk Terms of Service. By using the Platform, Customer agrees to the terms of this DPA.

1. Definitions

For the purposes of this DPA, the following definitions apply in addition to those set out in the Terms of Service:

• "Controller" means the Customer or entity that determines the purposes and means of processing Personal Data.

• "Processor" means RightAsk AI, Inc., which processes Personal Data on behalf of the Controller.

• "Data Subject" means an identified or identifiable natural person to whom Personal Data relates.

• "Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable Data Protection Laws.

• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.

• "Data Protection Laws" means all applicable privacy and data protection laws, including the GDPR, UK GDPR, CCPA/CPRA, PIPEDA, and any successor legislation.

• "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council.

• "UK GDPR" means the GDPR as retained in UK law by the European Union (Withdrawal) Act 2018.

• "CCPA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CPRA).

• "PIPEDA" means the Personal Information Protection and Electronic Documents Act (Canada).

• "Sub-Processor" means any third-party engaged by RightAsk to process Personal Data in connection with providing the Platform.

• "Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

• "Standard Contractual Clauses" or "SCCs" means the contractual clauses approved by the European Commission for the transfer of personal data to third countries, as updated from time to time.

• "Services" means the RightAsk platform and associated services as described in the Terms of Service.

2. Scope and Roles

2.1 Applicability

This DPA applies to all Processing of Personal Data carried out by RightAsk as Processor on behalf of the Customer as Controller in connection with the provision of the Services. Where RightAsk processes Personal Data for its own operational purposes (such as account management, billing, and security), RightAsk acts as an independent Controller and the Privacy Policy applies.

2.2 Controller Obligations

Customer, as Controller, represents and warrants that: (a) it has all necessary rights and consents to provide Personal Data to RightAsk for processing; (b) its instructions to RightAsk comply with applicable Data Protection Laws; and (c) it has implemented appropriate privacy notices and, where required, obtained valid consent from Data Subjects.

2.3 Processor Obligations

RightAsk, as Processor, shall process Personal Data only: (a) on documented instructions from Customer; (b) as necessary to provide the Services; or (c) as required by applicable law, in which case RightAsk shall notify Customer unless prohibited by law.

3. Details of Processing

3.1 Subject Matter

The subject matter of Processing is the provision of the RightAsk AI-powered rights management platform and associated features to Customer.

3.2 Duration

Processing continues for the duration of the Customer's active Subscription and until all Personal Data is deleted or returned in accordance with Section 10 of this DPA.

3.3 Nature and Purpose of Processing

Personal Data is processed to enable the following platform functions:

• Account creation, authentication, and access management

• Delivery of AI-powered rights management, licensing, and lead capture features

• Contract and document execution workflows

• Customer support and communications

• Billing and subscription management

• Platform analytics, security monitoring, and fraud prevention

3.4 Categories of Personal Data

Personal Data processed may include:

• Identification data: name, email address, username, profile information

• Contact data: business address, telephone number

• Technical data: IP address, browser type and version, device identifiers, session logs

• Usage data: platform interactions, clickstream data, feature usage

• Communications data: support requests, AI assistant conversation logs

• Payment metadata: subscription tier, billing history (payment card details processed solely by Stripe)

• User-uploaded content: files and documents submitted by Customer to the Platform

3.5 Categories of Data Subjects

Data Subjects may include: Customer's employees, contractors, and authorized users; end users of Customer's deployed AI assistant; prospective leads and contacts interacting with Customer's rights management workflows; and any individuals whose Personal Data is contained in content uploaded by Customer.

4. Customer Instructions

RightAsk shall process Personal Data only in accordance with Customer's documented instructions, including as set out in this DPA and the Terms of Service. Customer may issue additional written instructions at any time, provided such instructions are technically and legally feasible. RightAsk shall promptly notify Customer if it reasonably believes any instruction infringes applicable Data Protection Laws.

Customer acknowledges that RightAsk's standard platform operations constitute documented instructions for the purposes of this DPA.

5. Confidentiality of Processing

RightAsk shall ensure that all personnel authorized to process Personal Data are subject to appropriate confidentiality obligations, whether by contract or statutory duty, with respect to Personal Data they access in the course of providing the Services. Access to Personal Data is limited to personnel who require it to perform their functions in connection with the Services.

6. Technical & Organizational Security Measures

6.1 General Measures

RightAsk implements and maintains appropriate technical and organizational measures to protect Personal Data against Security Incidents, unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include, at minimum:

• Encryption of Personal Data in transit using TLS 1.2 or higher

• Encryption of Personal Data at rest using AES-256 or equivalent

• Role-based access controls and principle of least privilege

• Multi-factor authentication for internal administrative access

• Regular vulnerability assessments and penetration testing

• Logging and monitoring of system access and anomalous activity

• Business continuity and disaster recovery procedures

• Employee data protection training and awareness programs

6.2 Evolving Threats

RightAsk shall regularly review and update its security measures in response to evolving threats, industry standards, and technological developments. Customer may request a summary of RightAsk's current security measures by contacting support@rightask.ai.

7. Sub-Processors

7.1 Authorized Sub-Processors

Customer grants RightAsk general authorization to engage the sub-processors listed in Schedule 1 of this DPA. RightAsk shall ensure all Sub-Processors are bound by data protection obligations no less protective than those set out in this DPA.

7.2 New Sub-Processors

RightAsk will provide at least 30 days' prior written notice before engaging a new Sub-Processor. Customer may reasonably object to a new Sub-Processor within 14 days of notice by submitting written objection to support@rightask.ai. Where Customer objects and RightAsk cannot accommodate the objection, Customer may terminate the affected Services on written notice without penalty, subject to settlement of outstanding fees.

7.3 Liability for Sub-Processors

RightAsk remains fully liable to Customer for the performance of Sub-Processor obligations under this DPA to the same extent as if RightAsk were performing the processing directly.

8. Data Subject Rights

RightAsk shall provide Customer with commercially reasonable technical and procedural assistance to enable Customer to fulfill its obligations to respond to Data Subject requests. These include requests to access, correct, delete, restrict, or port Personal Data, and to object to processing.

Where a Data Subject submits a request directly to RightAsk, RightAsk shall promptly forward that request to Customer and shall not respond to the Data Subject directly except on Customer's documented instructions or as required by law.

Customer is responsible for responding to Data Subject requests within the timeframes required by applicable Data Protection Laws.

9. Security Incident Notification

9.1 Notification Obligation

Upon becoming aware of a confirmed Security Incident affecting Personal Data processed on Customer's behalf, RightAsk shall notify Customer without undue delay and, where feasible, within 72 hours of becoming aware of the incident. This timeline aligns with GDPR Article 33 requirements.

9.2 Content of Notification

The notification shall include, to the extent available at the time:

• A description of the nature of the Security Incident, including categories and approximate number of Data Subjects and Personal Data records affected

• The name and contact details of RightAsk's data protection contact

• A description of likely consequences of the Security Incident

• A description of measures taken or proposed to address the incident and mitigate its effects

9.3 Ongoing Cooperation

RightAsk shall cooperate with Customer and provide reasonable assistance to support Customer's obligations to notify supervisory authorities and affected Data Subjects as required by applicable Data Protection Laws. Notification by RightAsk of a Security Incident does not constitute an acknowledgment of fault or liability.

10. Data Retention & Deletion

10.1 Retention During Services

RightAsk shall retain Personal Data for the duration of the active Subscription and as otherwise specified in the Privacy Policy and Terms of Service.

10.2 Post-Termination

Following expiry or termination of the Customer's Subscription, RightAsk shall, at Customer's election within 30 days of termination: (a) return Personal Data to Customer in a commonly used machine-readable format; or (b) securely delete Personal Data from its systems, subject to any retention required by applicable law or legitimate business necessity (such as audit logs and financial records).

10.3 Confirmation

Upon Customer's written request, RightAsk shall provide written confirmation that Personal Data has been deleted or returned in accordance with this Section 10.

11. International Data Transfers

11.1 Processing Location

Personal Data processed under this DPA is stored and processed in the United States. All Sub-Processors listed in Schedule 1 are also located in the United States.

11.2 EEA and UK Transfers

For transfers of Personal Data from the EEA or UK to the United States, RightAsk relies on the following transfer mechanisms:

• Standard Contractual Clauses (SCCs): The EU SCCs (2021/914) as adopted by the European Commission, Module 2 (Controller to Processor), are hereby incorporated into this DPA by reference. In the event of conflict between this DPA and the SCCs, the SCCs shall prevail with respect to EEA transfers.

• UK International Data Transfer Agreement (IDTA): For transfers from the UK, the UK IDTA is incorporated by reference as an addendum to the EU SCCs.

11.3 Canadian Transfers

For Personal Data transferred from Canada, RightAsk maintains contractual protections consistent with PIPEDA Schedule 1 principles and ensures Sub-Processors provide comparable protection.

11.4 SCCs on Request

A fully executed copy of the applicable SCCs is available to Customer upon written request at support@rightask.ai.

12. Audit Rights

12.1 Documentation

RightAsk shall make available to Customer all information reasonably necessary to demonstrate compliance with this DPA and applicable Data Protection Laws, including relevant certifications, security documentation, and audit summaries.

12.2 Audit Process

Customer may request an audit of RightAsk's data processing practices no more than once per calendar year, or more frequently where required by a supervisory authority. Audits shall be conducted: (a) on at least 30 days' prior written notice; (b) during normal business hours; (c) in a manner that minimizes disruption to RightAsk's operations; and (d) at Customer's cost unless the audit reveals a material non-compliance.

12.3 Third-Party Audits

Customer may designate a qualified, independent third-party auditor subject to reasonable confidentiality obligations acceptable to RightAsk. RightAsk may refuse audit requests it reasonably deems to be in bad faith, unduly burdensome, or in conflict with other legal or contractual obligations.

13. CCPA / CPRA Service Provider Addendum

This section applies to Personal Data subject to the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

13.1 Service Provider Status

For the purposes of the CCPA/CPRA, RightAsk acts as a "Service Provider" when processing Personal Data on behalf of Customer. RightAsk shall not: (a) sell or share Personal Data; (b) retain, use, or disclose Personal Data for any purpose other than providing the Services; (c) retain, use, or disclose Personal Data outside the direct business relationship with Customer; or (d) combine Personal Data received from Customer with Personal Data from other sources, except as permitted under the CCPA/CPRA.

13.2 CCPA Cooperation

RightAsk shall assist Customer in responding to verifiable consumer requests submitted by California residents, including requests to know, delete, correct, and opt out of the sale or sharing of Personal Data. RightAsk confirms that it understands and shall comply with CCPA/CPRA restrictions applicable to Service Providers.

14. PIPEDA Addendum (Canada)

This section applies to Personal Data subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

RightAsk shall: (a) process Personal Data of Canadian residents only for the purposes identified in this DPA; (b) implement safeguards equivalent to the protection standards required by PIPEDA Schedule 1; (c) notify Customer promptly of any access requests, complaints, or regulatory inquiries from Canadian residents or the Office of the Privacy Commissioner of Canada relating to Customer's Personal Data; and (d) upon termination, return or securely destroy all Personal Data of Canadian residents in accordance with Section 10.

15. Liability & Indemnification

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service. Where a party is held liable for a data protection breach that was caused in whole or in part by the other party, the liable party shall be entitled to claim back from the responsible party the portion of the liability attributable to that party's acts or omissions.

Nothing in this DPA limits either party's liability to Data Subjects or supervisory authorities under applicable Data Protection Laws.

16. Term & Termination

This DPA remains in effect for the duration of the Customer's Subscription and survives termination solely with respect to obligations related to the return or deletion of Personal Data under Section 10 and confidentiality obligations, until such obligations are fully discharged.

17. General Provisions

17.1 Order of Precedence

In the event of any conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to data protection matters. In the event of conflict between this DPA and the SCCs, the SCCs shall prevail with respect to cross-border data transfer matters.

17.2 Severability

If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

17.3 Governing Law

This DPA shall be governed by the laws of the State of Delaware, except where mandatory provisions of applicable Data Protection Laws (including the GDPR) require otherwise.

17.4 Amendments

RightAsk may update this DPA to reflect changes in Data Protection Laws, Sub-Processor lists, or security practices, with 30 days' written notice to Customer. For material changes affecting Customer's compliance obligations, Customer may object in writing within 14 days.

17.5 Contact

For all data protection inquiries under this DPA:

Schedule 1 — Authorized Sub-Processors

The following Sub-Processors are authorized as of the Effective Date of this DPA. RightAsk maintains the right to update this list in accordance with Section 7.2.

RightAsk will update this Schedule with 30 days' advance notice when a new Sub-Processor is added or an existing Sub-Processor is removed or replaced. The current Schedule is always available at rightask.ai/legal or upon request at support@rightask.ai.

Schedule 2 — Standard Contractual Clauses (Cross-Reference)

For transfers of Personal Data from the EEA or UK to the United States, the following SCC modules are incorporated into this DPA by reference:

• Module 2 (Controller to Processor): Applies where Customer is an EEA/UK Controller and RightAsk is the Processor.

• Annex I (List of Parties): Customer as Data Exporter; RightAsk AI, Inc. as Data Importer.

• Annex II (Technical and Organizational Security Measures): As described in Section 6 of this DPA.

• Annex III (Sub-Processors): As listed in Schedule 1 of this DPA.

Applicable clause selections:

• Clause 7 (Docking clause): Included

• Clause 9 (Use of sub-processors): Option 2 — General written authorization with 30 days' notice

• Clause 11 (Redress): Optional language not included

• Clause 17 (Governing law): Laws of Ireland (EU member state)

• Clause 18 (Forum): Courts of Ireland

A fully executed copy of the SCCs, including all Annexes, is available to Customer upon written request at support@rightask.ai.