Data Processing Addendum

Last updated: July 20, 2026

This Data Processing Addendum (the “Addendum”) is entered into by and between Superset Labs PBC with its principal place of business at 431 E 20th St., New York, NY 10010 (“Superset”) and you, whether personally or on behalf of an entity (“You”) (each individually a “Party” and collectively the “Parties”) and forms part of the Terms of Service, or such other agreement governing the direct relationship between the Parties hereto (collectively, the “Agreement”). This Addendum is effective as of the Effective Date of the Agreement (the “Effective Date”).

1. Definitions. In addition to capitalized terms defined elsewhere in this Addendum, the following terms shall have the meanings ascribed to them herein.

   1. “adequacy decision,” “data exporter,” “process,” “processing,” and “sub-processor,” shall each have the meaning ascribed to it under Data Protection Law.

   2. “Business” and “Controller” shall have the meanings ascribed to in Data Protection Law and shall be used interchangeably herein.

   3. “Consumer” and “Data Subject” shall have the meanings ascribed to in Data Protection Law and shall be used interchangeably herein.

   4. “Covered Data” means the Personal Data processed as detailed in the Agreement and for the purposes described in the Agreement.

   5. “Data Protection Law” means all applicable laws, rules, and regulations, including but not limited to, as applicable, the laws, rules, and regulations of Canada including but not limited to the Personal Information Protection and Electronic Documents Act (“PIPEDA”), as well as the laws, rules, and regulations of the European Union (“EU”), the European Economic Area (“EEA”) and their member states, Switzerland and the United Kingdom (“UK”), including without limitation, Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data (“General Data Protection Regulation” or “GDPR”) and EU Directive 2002/58/EC on Privacy and Electronic Communications (“e-Privacy Directive”) or, the superseding e-Privacy Regulation once effective, and the United Kingdom’s General Data Protection Regulation (“UK GDPR”), and as applicable, the laws, rules, and regulations of the United States, including without limitation, the California Consumer Privacy Act of 2018 and its amendments including the California Privacy Rights Act (collectively, the “CCPA”), the Virginia’s Consumer Data Protection Act (“VCDPA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), the Oregon Consumer Privacy Act (“OCPA”), the Texas Data Privacy and Security Act (“TXDPSA”), the Montana Consumer Data Privacy Act (“MTCDPA”), the Iowa Consumer Data Protection Act (“IADPA”), the Delaware Personal Data Privacy Act (“DEPDPA”), the Nebraska Data Privacy Act (“NEDPA”), the New Hampshire Privacy Act (“NHPA”), the New Jersey Data Privacy Act (“NJDPA”), the Tennessee Information Privacy Act (“TIPA”), the Minnesota Consumer Data Privacy Act (“MNCDPA”), and the Maryland Online Data Privacy Act (“MDODPA”), and the Indiana Consumer Data Protection Act (“INCDPA”), the Kentucky Consumer Data Protection Act (“KYCDPA”), the Rhode Island Data Transparency and Privacy Protection Act (“RIDTPPA”), the Oklahoma Consumer Data Privacy Act (“OCDPA”), the Louisiana Data Privacy Act (“LDPA”), the Alabama Personal Data Protection Act (“APDPA”), and the Vermont Data Privacy and Online Surveillance Act (“VDPOSA”).

   6. “Data Subject Request” means any right afforded to a Data Subject under Data Protection Law, including, but not limited to, the rights of access, correction, deletion, portability, and to opt-out of certain processing activities such as cross-context behavioral or targeted advertising.

   7. “Member States” means a member of the EU.

   8. “Personal Data” and “Personal Information” shall have the meanings ascribed in Data Protection Law and shall be used interchangeably herein.

   9. “Processor” and “Service Provider” shall have the meanings ascribed to it in Data Protection Law and shall be used interchangeably herein.

   10. “Services” shall have the meaning ascribed to it in the Agreement.

2. Designation. The Parties acknowledge and agree that with respect to the Covered Data, You are a ‘Controller’ (and ‘Business’ under CCPA), and that Superset is a ‘Processor’ (and ‘Service Provider’ under CCPA) under Data Protection Law.

3. Obligations.

   1. Compliance with Law. With respect to the Covered Data, the Parties shall comply with Data Protection Law. Each Party shall promptly inform the other if it is unable to comply with this Addendum or Data Protection Law in performing its obligations under the Agreement. If the non-complying Party cannot comply within a reasonable period of time, or is in substantial or persistent breach of this Addendum or Data Protection Law, the complying Party shall be entitled to remediate the non-compliant action and/or terminate the Addendum and the Agreement insofar as it concerns processing of Covered Data.

   2. Limitations on Processing. Processor shall at all times comply with Controller’s written instructions pursuant to the Agreement and this Addendum. Processor shall only process the Covered Data for the limited purposes specified in the Agreement. If Processor determines that an instruction from Controller infringes applicable Data Protection Law, Processor shall promptly notify Controller of the conflict, unless applicable law prohibits such notification. Processor shall not be required to comply with any instruction to the extent Processor reasonably determines that doing so would cause Processor to violate applicable law.

   3. CCPA.

      1. To the extent any Covered Data is deemed Personal Information (as such term is defined under the CCPA) and Processor is deemed to be a Service Provider subject to the CCPA, Service Provider agrees not to: (i) “sell” or “share” the Covered Data as such terms are defined under the CCPA; (ii) retain, use, or disclose Covered Data for any purpose other than for the specific purpose of performing the Services or as otherwise expressly permitted under the Agreement including retaining, using or disclosing the Covered Data for a commercial purpose other than the business purposes specified in this Addendum or the Agreement, or as otherwise permitted by the CCPA; (iii) retain, use or disclose the Covered Data outside of the direct business relationship with Controller; (iv) combine Covered Data it receives from Controller with Covered Data it receives from or on behalf of another person or collects from its own interactions with consumers, except where required to provide the Services provided it is permitted under the CCPA.

      2. For the avoidance of doubt, any Personal Information that: (i) Controller uploads directly to the Services; (ii) is received to the Services directly through Controller’s implementation and/or configuration; or (iii) Controller directs or instructs its partner(s) (e.g., through configuration of the Services) to send to or share with Service Provider for processing on Controller’s behalf for the purpose of providing the Services under the Agreement, shall be deemed Covered Data received from Controller.

      3. Business Purposes. In accordance with the CCPA, Service Provider may engage in the following business purposes:

         1. Helping to ensure security and integrity to the extent the use of the Covered Data is reasonably necessary and proportionate for these purposes.

         2. Debugging to identify and repair errors that impair existing intended functionality.

         3. Short-term, transient use, provided that the Covered Data is not disclosed to another third party and is not used to build a profile about a consumer.

         4. Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.

         5. Undertaking internal research for technological development and demonstration.

         6. Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

   4. Data Subject Requests. Processor shall promptly notify Controller if Processor receives a Data Subject Request concerning Covered Data. Upon Controller’s request, Processor shall provide reasonable assistance to Controller in responding to such Data Subject Requests.

   5. Security.

      1. Security Measures. Processor shall maintain appropriate technical and organizational measures for protection of the: (i) security of Covered Data, including but not limited to, the unauthorized or unlawful access, use, disclosure, modification, destruction, and loss of Covered Data (a “Security Incident”); (ii) confidentiality of Covered Data; (iii) integrity of Covered Data; and (iv) as otherwise set forth in the Agreement, including but not limited to the safeguards set out in Annex II.

      2. Access Control. The Parties shall take reasonable steps to ensure that access to the Covered Data is limited on a need to know/access basis and that all personnel receiving such access are subject to confidentiality undertakings or professional or statutory obligations of confidentiality in connection with their access/use of Covered Data.

      3. Security Incident or other Non-Compliance. Processor shall notify Controller without undue delay (and, in any event, within seventy-two (72) hours) upon Processor becoming aware of a Security Incident. Such notice to Controller shall include, where feasible:

         1. a description of the Security Incident, including the location, date, and time the Security Incident occurred, and the location, date, and time the Security Incident was discovered;

         2. a description of the steps Processor has taken, or plans to take, to investigate the Security Incident;

         3. an overview of the affected Personal Data, including the types of Covered Data and whether the Covered Data was encrypted or redacted;

         4. the number of affected Data Subjects of Covered Data and the city, state (if applicable), and country of such Data Subjects;

         5. the expected consequences of the Security Incident; and

         6. a description of the measures Processor has taken, or plans to take, to mitigate such consequences.

      4. Breach Notification. If Data Protection Law requires notice of the Security Incident to any regulator, Data Subject, or other third party: (i) Processor shall assist Controller to provide such notifications if requested by Controller; (ii) Controller shall have sole control over the content, timing, and method of distribution of any needed notice, unless otherwise required by Data Protection Law; and (iii) Processor may notify the affected parties only upon Controller’s prior written approval and instructions, unless otherwise required by Data Protection Law (in which case Processor shall provide Controller with a copy of such notice as soon as possible and in all events prior to providing such notice to any regulator, Data Subject, or other third party, unless otherwise required by law).

4. Government Requests. Unless legally prohibited, each Party shall promptly inform the other Party if it receives a request or demand from a governmental or regulatory body relating to Processor’s processing of Covered Data and shall fully cooperate with the other Party in connection with any response to such request or demand.

5. Sub-Processors.

   1. Sub-Processor Obligations. Processor will not permit any sub-processor to process Covered Data, unless Processor and the sub-processor have entered into an agreement that imposes obligations on the sub-processor that are no less restrictive and at least equally protective of Covered Data than those imposed on Processor under this Addendum.

   2. Authorized Sub-Processors. Controller specifically authorizes Processor to engage the sub-processors detailed in the Sub-Processors List in Annex III. Where required by law, Processor will notify Controller of any changes to sub-processors on the Sub-Processor List by email at least ten (10) days before the changes take effect. Controller may reasonably object to a change on legitimate grounds relating to data protection within such ten (10) days. If Controller objects to the Processor’s use of a sub-processor and Processor cannot find a suitable replacement that would allow Processor to continue providing the Services in accordance with the Agreement and this Addendum, then notwithstanding anything to the contrary in the Agreement (including this Addendum), Controller may in its sole discretion terminate the Agreement solely as it relates to the processing of Covered Data by providing written notice to Processor.

6. Cross Border Transfers.

   1. Ex-EEA Transfers. If the Services involves the transfer of Covered Data of Data Subjects in the EEA to a country or territory outside the EEA which has not received an applicable adequacy decision, the Parties hereby incorporate, and agree to comply with, the Standard Contractual Clauses set out by the European Commission Decision 2021/914/EU located at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en#ntc12-L_2021199EN.01003701-E0012 (the “SCCs”). The SCCs will be incorporated by reference and apply as follows:

      1. Module 2 shall apply;

      2. The optional docking clause in Clause 7 does not apply;

      3. In Clause 9, Option 2 (general written authorization) applies, and the minimum time period for prior notice of sub-processor changes shall be ten (10) days;

      4. In Clause 11, the optional language does not apply;

      5. All square brackets in Clause 13 are hereby removed;

      6. In Clause 17 (Option 1) applies, the EU SCCs will be governed by the laws of France;

      7. In Clause 18(b), disputes will be resolved before the courts of France; and

      8. Annexes IA, IB, IC, II, and III of the EU SCCs shall be deemed completed with the information set out in the annexes attached hereto.

   2. Ex-UK Transfers. If the Services involves the transfer of Covered Data of Data Subjects in the UK to a country or territory outside the UK which has not received an applicable adequacy decision, the Parties hereby incorporate, and agree to comply with, the SCCs, which have been approved for use in data transfers under the UK GDPR, as modified in 6.1 above as well as the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses for International Data Transfers issued by the UK Information Commissioner, Version B1.0, in force 21 March 2022 and as amended or replaced thereafter (the “IDTA”). The IDTA will be incorporated by reference and apply as follows:

      1. Table 1 of the IDTA will be deemed completed with the information set out in the Agreement.

      2. Table 2 of the IDTA will be deemed completed with the information set out in section 6.1 above. Any conflict between the terms of the SCCs and the IDTA will be resolved in accordance with Section 10 and Section 11 of the IDTA.

      3. Table 4 will be deemed completed by selecting “either party.”

7. Data Protection Impact Assessment and Prior Consultation. Processor shall provide reasonable assistance to Controller with any data protection impact assessments, audits, certifications, or prior consultations with legal or regulatory authorities or other competent data protection authorities, which Controller reasonably considers to be appropriate or required under any Data Protection Law, in relation to processing of Covered Data by Processor.

8. Return or Deletion of Covered Data. Upon the expiration or termination of the Agreement and upon Controller’s request, Processor shall securely return to Controller or securely destroy (at Controller’s election), all Covered Data obtained by Processor in connection with the Agreement. This requirement shall not apply to the extent that Processor is required by any applicable law to retain some or all of the Covered Data, in which event Processor shall isolate and protect the Covered Data from any further processing except to the extent required by such law until deletion is possible. Processor will provide written confirmation to Controller of its compliance with this provision.

9. Audit. Upon thirty (30) days notice by the Controller and no more than once per calendar year, Processor shall make available to Controller all information in its possession reasonably necessary to demonstrate Processor’s compliance with the obligations described in this Addendum and shall allow for, and cooperate with, reasonable assessments by Controller or Controller’s designated assessor.

10. Indemnification. Indemnification under this Addendum shall be governed by and is subject to the terms set forth in section 11 (Indemnification) of the Agreement.

11. Limitation of Liability. EACH PARTY’S AND ALL OF ITS AFFILIATES’ LIABILITY, TAKEN TOGETHER IN THE AGGREGATE, ARISING OUT OF OR RELATED TO THIS ADDENDUM, WHETHER IN CONTRACT, TORT, OR UNDER ANY OTHER THEORY OF LIABILITY, IS SUBJECT TO SECTION 12 (LIMITATION OF LIABILITY) OF THE AGREEMENT.

12. General Terms.

    1. Termination and Survival. This Addendum shall remain in effect for the duration of the Agreement and shall survive termination to the extent required to enforce post-termination obligations.

    2. Counterparts. This Addendum may be executed in any number of counterparts and any Party (including any duly authorized representative of a Party) may enter into this Addendum by executing a counterpart.

    3. Ineffective Clause. If individual provisions of this Addendum are or become ineffective, the effectiveness of the remaining provisions shall not be affected. The Parties shall replace the ineffective clause with a legally allowed clause, which will accomplish the intended commercial intention as closely as possible.

    4. Conflicts. In case of contradictions between this Addendum and the provisions of the Agreement, the provisions of this Addendum shall prevail.

    5. Applicable Law and Jurisdiction. The applicable law and jurisdiction as set forth in the Agreement apply to this Addendum.

Contact

Questions about this Addendum or about Superset’s data processing practices: