Data Processing Addendum

This addendum applies to every Codas Labs product. It forms part of your agreement with Codas Labs, LLC automatically; you do not need to sign anything. Enterprise customers who need a countersigned copy can email legal@codaslabs.com.

This Data Processing Addendum ("DPA") forms part of the agreement for the Services (the "Agreement") between Codas Labs, LLC, a North Carolina limited liability company with its address at 1300 South Blvd, Suite 38821, Charlotte, NC 28203, USA ("Codas Labs", "Processor"), and the customer identified in the Agreement ("Customer"). It applies whenever Codas Labs processes Customer Personal Data in providing the Services.

1. Definitions

1.1 "Data Protection Laws" means all laws applicable to the processing of Customer Personal Data under the Agreement, including, as applicable: Regulation (EU) 2016/679 ("EU GDPR"); the EU GDPR as incorporated into UK law and the UK Data Protection Act 2018 ("UK GDPR"); the Swiss Federal Act on Data Protection ("FADP"); the California Consumer Privacy Act as amended by the CPRA ("CCPA"); and other U.S. state comprehensive privacy laws (e.g., Virginia, Colorado, Connecticut, Utah, Texas, Oregon) ("US State Privacy Laws").

1.2 "Customer Personal Data" means personal data (or "personal information") that Customer or its Authorized Users submit to, or that is collected through, the Services on Customer's behalf, and that Codas Labs processes as a processor or service provider. It excludes Account Data (§2.3).

1.3 "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in Codas Labs' or its Sub-processors' possession or control.

1.4 "Sub-processor" means any third party engaged by Codas Labs that processes Customer Personal Data.

1.5 "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021. "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022), as amended or replaced.

1.6 Capitalized terms not defined here ("controller", "processor", "data subject", "personal data", "processing", "supervisory authority", "business", "service provider", "sell", "share") have the meanings given in the Data Protection Laws.

2. Roles and scope

2.1 Roles. As between the parties, Customer is the controller (or, where Customer itself acts for its own clients, a processor) of Customer Personal Data, and Codas Labs is a processor (or sub-processor) and a "service provider"/"processor" under US State Privacy Laws.

2.2 Details of processing. The subject matter, duration, nature and purpose of processing, and the types of personal data and categories of data subjects, are set out in Annex I.

2.3 Account Data. Codas Labs processes the business contact, login, billing and usage-telemetry data of Customer's Authorized Users to run its own business (account administration, billing, security, product improvement in aggregated form, legal compliance). For Account Data, Codas Labs is an independent controller and processes it under the Codas Labs Privacy Policy, not this DPA.

2.4 Customer's responsibilities. Customer is responsible for the lawfulness of its instructions and of the collection of Customer Personal Data, including providing notices to and obtaining any consents from data subjects (for example, survey respondents, leads/prospects, community members, or the subjects of AI-agent tasks). Customer shall not submit special-category data (GDPR Art. 9), criminal-offence data, payment-card numbers, or government identifiers to the Services except where Annex I-B says otherwise or Codas Labs has agreed in writing.

3. Processor obligations

3.1 Instructions. Codas Labs processes Customer Personal Data only on Customer's documented instructions, which are the Agreement, this DPA, and Customer's configuration and use of the Services, unless required otherwise by law (in which case Codas Labs will inform Customer before processing unless the law prohibits it). Codas Labs will tell Customer if, in its opinion, an instruction infringes Data Protection Laws.

3.2 US State Privacy Law commitments. Codas Labs will not: (a) sell or share Customer Personal Data; (b) retain, use or disclose it for any purpose other than the business purposes in the Agreement, including any commercial purpose other than providing the Services; (c) retain, use or disclose it outside the direct business relationship between the parties; or (d) combine it with personal information it receives from other sources, except as permitted by the CCPA. Codas Labs certifies it understands and will comply with these restrictions, will notify Customer if it can no longer meet its obligations, and Customer may take reasonable steps to stop and remediate unauthorized use.

3.3 AI and model training. Codas Labs will not use Customer Personal Data, or content containing it, to train or fine-tune any generally available machine-learning model, and will configure its AI/LLM Sub-processors so that Customer Personal Data is not used for their model training.

3.4 Confidentiality. Codas Labs ensures that persons authorized to process Customer Personal Data are bound by confidentiality obligations.

3.5 Security. Codas Labs implements and maintains the technical and organizational measures in Annex II. Codas Labs may update those measures provided the update does not materially reduce the overall protection of Customer Personal Data.

3.6 Assistance. Taking into account the nature of processing, Codas Labs will provide reasonable assistance to Customer (a) by appropriate technical and organizational measures, in responding to data subject requests; and (b) with Customer's obligations regarding security, breach notification, data protection impact assessments and prior consultation with supervisory authorities. If Codas Labs receives a request directly from a data subject relating to Customer Personal Data, it will (unless legally prohibited) redirect the requester to Customer and not respond substantively without Customer's authorization.

4. Sub-processors

4.1 General authorization. Customer grants general authorization for Codas Labs to engage Sub-processors. The current Sub-processors for each product are listed at the product's public sub-processor page (URL in Annex III) and are deemed approved.

4.2 Flow-down and liability. Codas Labs will enter into a written agreement with each Sub-processor imposing data-protection obligations no less protective than this DPA, to the extent applicable to the services provided by that Sub-processor, and remains liable to Customer for each Sub-processor's performance of those obligations.

4.3 Notice of changes. Codas Labs will give at least thirty (30) days' notice before a new Sub-processor begins processing Customer Personal Data, by updating the sub-processor page and by email to Customers who have subscribed to updates via the method described on that page.

4.4 Objection. Customer may object on reasonable data-protection grounds by emailing privacy@codaslabs.com within the notice period. The parties will discuss in good faith. If Codas Labs cannot reasonably accommodate the objection, Customer may terminate the affected Services by written notice and receive a pro-rata refund of prepaid, unused fees for the terminated Services. That is Customer's sole remedy for the objection.

4.5 Emergency replacement. Where a Sub-processor must be replaced urgently for security or continuity reasons, Codas Labs may do so immediately and will notify Customer as soon as practicable; the objection right in §4.4 then applies.

5. Security Incidents

5.1 Codas Labs will notify Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Security Incident, at the email address associated with Customer's account owner.

5.2 The notice will include, to the extent then known: the nature of the incident, the categories and approximate numbers of data subjects and records concerned, likely consequences, and measures taken or proposed. Codas Labs will supplement the notice as information becomes available and take reasonable steps to contain, investigate and mitigate the incident.

5.3 Notification is not an acknowledgement of fault or liability. Unsuccessful attempts (e.g., pings, port scans, blocked login attempts) are not Security Incidents.

6. Return and deletion

6.1 During the term, Customer may export or delete Customer Personal Data using the Services' features where available, or by request to privacy@codaslabs.com.

6.2 Within thirty (30) days after termination of the Services, Codas Labs will delete Customer Personal Data from its production systems, and it will be purged from backups in the ordinary course within a further ninety (90) days. Codas Labs may retain data required by law, which remains subject to this DPA's confidentiality and security obligations. On request Codas Labs will confirm deletion in writing.

7. Audits

7.1 Codas Labs will make available, on request (no more than once per year), information reasonably necessary to demonstrate compliance with this DPA, which may include written responses to a reasonable security questionnaire and copies of Sub-processor certifications/reports.

7.2 If that information is insufficient to demonstrate compliance, or a supervisory authority requires it, or following a Security Incident, Customer may conduct an audit (by itself or an independent auditor bound by confidentiality) on at least thirty (30) days' notice, during business hours, without unreasonably disrupting operations, at Customer's cost. The parties will agree the scope in advance.

8. International transfers

8.1 Locations. Codas Labs is based in the United States, and Customer Personal Data may be processed in the United States and the other locations listed in Annex III.

8.2 EU transfers. To the extent Customer Personal Data subject to EU GDPR is transferred to Codas Labs in a country without an adequacy decision (and Codas Labs is not certified under the EU-U.S. Data Privacy Framework for that transfer), the SCCs are incorporated by reference and completed as follows: (a) Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) where Customer is a processor; (b) Clause 7 (docking) applies; (c) Clause 9 Option 2 (general written authorization) applies, with the notice period in §4.3; (d) Clause 11 optional language does not apply; (e) Clause 13: the supervisory authority is that of Customer's EU establishment or, if none, of its EU representative, or else the Irish Data Protection Commission; (f) Clause 17 Option 1: the law of Ireland; (g) Clause 18(b): the courts of Ireland; (h) Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

8.3 UK transfers. For Customer Personal Data subject to UK GDPR, the UK Addendum is incorporated and completed with the information in this DPA; in Table 4, either party may end the Addendum as set out in its Section 19.

8.4 Swiss transfers. For data subject to the FADP, the SCCs apply with these changes: references to the GDPR include the FADP; the competent authority is the Swiss Federal Data Protection and Information Commissioner; "Member State" includes Switzerland so Swiss data subjects can sue in their place of habitual residence.

8.5 Onward transfers. Codas Labs ensures that onward transfers to Sub-processors outside the EEA/UK/Switzerland are covered by a valid transfer mechanism (adequacy, DPF certification of the Sub-processor, or SCCs in the Sub-processor's terms).

8.6 Conflict. If the SCCs or UK Addendum conflict with this DPA, they prevail.

9. Government access requests

If Codas Labs receives a legally binding request from a public authority for Customer Personal Data, it will (unless legally prohibited) promptly notify Customer, review the legality of the request, challenge it where there are reasonable grounds, and disclose only the minimum required.

10. Liability, term, precedence

10.1 Each party's liability under this DPA is subject to the limitations and exclusions of the Agreement, except where Data Protection Laws or the SCCs do not permit such limitation.

10.2 This DPA lasts as long as Codas Labs processes Customer Personal Data. Sections 6, 9 and 10 survive.

10.3 Order of precedence: (1) SCCs/UK Addendum; (2) this DPA; (3) the Agreement.

10.4 Governing law and venue follow the Agreement, except as required by §8.

Annex I-A — Parties

Data exporter: Customer, as identified in the Agreement. Contact: the account owner email. Role: controller (Module 2) or processor (Module 3). Activities: use of the Services.

Data importer: Codas Labs, LLC, 1300 South Blvd, Suite 38821, Charlotte, NC 28203, USA. Contact for data protection: privacy@codaslabs.com; legal: legal@codaslabs.com. Role: processor. Activities: provision of the Services.

Signature/date: by acceptance of the Agreement, or as signed below.

Annex I-B — Description of processing

Common to all products: Duration — term of the Agreement plus the deletion period in §6. Frequency — continuous. Purpose — providing, securing, supporting and maintaining the Services for Customer. Retention — §6.

Per product:

SurveyTale (survey tool)

• Data subjects: Customer's Authorized Users; survey respondents (Customer's customers, employees, prospects, or the public).
• Personal data: user account details; respondent answers, which may contain any data the Customer chooses to ask for; respondent email/name if collected; IP address, device/browser data, approximate location; uploaded files.
• Special categories: not intended. Customer may only collect health, beliefs or other special-category data if it has a lawful basis and Codas Labs has agreed in writing.
• Nature of processing: hosting, collecting, storing, analysing and exporting survey responses; sending survey invitations and notifications; optional integrations the Customer switches on.

LeadTale (lead-finding tool)

• Data subjects: Authorized Users; business contacts in lists Customer uploads, saves, or enriches.
• Personal data: names, job titles, employer, business email and phone, LinkedIn/profile URLs, location; notes and list membership; search queries.
• Special categories: none.
• Nature of processing: storing Customer lists, enriching/validating contact data, search, exporting to Customer-chosen tools.
• Note: LeadTale's own business-contact database is processed by Codas Labs as an independent controller under the LeadTale Privacy Policy, outside this DPA.

MeshTale (AI knowledge product)

• Data subjects: Authorized Users; any people named in content Customer connects or uploads (colleagues, clients, correspondents).
• Personal data: account data; content of documents, messages and records from Customer's connected sources; embeddings derived from it; prompts and AI outputs.
• Special categories: possible incidentally inside Customer content; not intended.
• Nature of processing: ingesting, indexing, embedding, searching and summarising Customer content using AI language-model sub-processors.

Tore (AI customer-support product)

• Data subjects: Authorized Users (support agents); Customer's end users who contact Customer's support.
• Personal data: end-user name, email, phone (if telephony enabled), message and email content, attachments, conversation history, IP/device data from the chat widget; knowledge-base content.
• Special categories: possible incidentally in support messages; not intended.
• Nature of processing: receiving, storing and routing support messages; generating AI-drafted replies and classifications; sending email on Customer's behalf.

TokenUsage (AI usage dashboard)

• Data subjects: Authorized Users; Customer's staff whose AI-tool usage is tracked.
• Personal data: names, work emails, per-person usage metadata (token counts, cost, model, tool, timestamps), repository/project names. No prompt or response content.
• Special categories: none. Customer is responsible for informing its staff about usage monitoring where local law requires.
• Nature of processing: pulling usage data from Customer-authorised providers, aggregating, reporting and alerting.

TribeTale (community app)

• Data subjects: Authorized Users (community owners/staff); community members and newsletter subscribers.
• Personal data: member names, emails, profile data, posts and comments, membership/payment status, newsletter engagement (opens/clicks), mobile device identifiers and crash data.
• Special categories: possible incidentally in member posts; not intended.
• Nature of processing: hosting the community and publication, managing memberships and payments, sending newsletters, mobile app delivery.

Annex I-C — Competent supervisory authority

Per §8.2(e).

Annex II — Technical and organizational security measures

1. Encryption. Data in transit protected with TLS 1.2+. Data at rest encrypted by the hosting/database providers (AES-256 or equivalent).
2. Access control. Production access limited to authorized personnel on a need-to-know basis; multi-factor authentication on cloud, code-hosting and administrative accounts where the provider supports it; credentials kept in a password manager (1Password); no shared personal passwords.
3. Application security. Tenant isolation enforced at the application/database layer; authenticated APIs; secrets never committed to source control; dependency updates; code review on every change before merge, including automated review.
4. Logical separation. Each product runs in its own infrastructure and database; customers' data is logically separated within a product.
5. Logging and monitoring. Application error and performance monitoring; uptime monitoring; audit of administrative access where supported. Observability tooling is self-hosted where listed in Annex III.
6. Availability and backups. Managed database backups / point-in-time recovery from the hosting provider; infrastructure-as-code where used.
7. Vendor management. Sub-processors selected for security posture; their DPAs and transfer mechanisms tracked (see Annex III).
8. Incident response. Documented incident and breach response with notification per §5.
9. Data minimization and deletion. Data deleted per §6; personal data in AI prompts limited to what the task needs; LLM providers configured for no training (and zero/limited retention where available).
10. Personnel. Confidentiality obligations for staff and contractors; least-privilege access; prompt revocation on departure.

Annex III — Sub-processors

The authorized Sub-processors for each product are listed at codaslabs.com/legal/subprocessors, which is incorporated into this DPA. Hermos will be added when it becomes generally available.

Countersigned copies (optional, for enterprise customers): email legal@codaslabs.com.