U.S. Data Protection Addendum

Last Modified: July 29, 2025

Overview

This U.S. Data-Protection Addendum ("DPA") is incorporated into and forms part of the agreement (the "Agreement") between Isomer AI, Inc. ("Provider") and the entity identified therein ("Customer"), including any applicable Order Form or Master Services Agreement, under which Provider supplies its platform and related services (collectively, the "Services"). This DPA takes effect on the same date the Customer first accepted or executed the Agreement (the "Effective Date").

Provider may revise and update this DPA from time to time in its sole discretion. All changes are effective immediately when uploaded, submitted, published and/or posted to Provider's website located at https://isomer.ai/dpa-us ("Site"). Material changes will be announced by email or in-app notice at least thirty (30) days before they take effect. Customer can determine when the DPA was last revised by referring to the "Last Modified" date at the top of this DPA. Customer is expected to check this DPA on the Site from time to time to take notice of any changes. Customer understands and agrees that Customer's continued access to or use of the platform and/or receipt of the services after any posted modification to this DPA indicates Customer's consent to any such modifications. If Customer does not agree with the new DPA, Customer should not use the platform and/or receive the services, information, materials and/or content made available through the platform.

A. California

1. As used in this Section A, capitalized terms used herein and not otherwise defined shall have the meaning ascribed to them by the California Consumer Privacy Act of 2018, as amended and/or superseded (the "CCPA") and its implementing Regulations ("Regulations"). Customer is a Business and Company is a Service Provider with respect to the Processing of Personal Information (herein referred to as "Personal Data") as defined under the CCPA.

2. To the extent that Company is processing any Customer Personal Data on behalf of Customer pursuant to the CCPA:

a. Company shall not Sell or Share Personal Data it Collects pursuant to the Agreement.

b. Company shall Process Personal Data pursuant to this Agreement and Company will disclose the Personal Data to Customer hereunder only for such limited and specific Business Purpose(s) specified in the Agreement or as otherwise permitted by the CCPA.

c. Company shall not retain, use, or disclose Personal Data it Collects pursuant to the Agreement for any Commercial Purpose other than the business purposes specified in the Agreement, unless expressly permitted by the CCPA.

d. Company shall not combine or update Personal Data that Company Collects pursuant to this Agreement with Personal Data that Company receives from another source. Notwithstanding the foregoing, Company may combine Personal Data to perform any Business Purpose.

e. Company shall comply with all applicable sections of the CCPA and the Regulations, including with respect to the Personal Data that Company Collects pursuant to this Agreement, providing the same level of privacy protection as required of Company by the CCPA and the Regulations.

f. Company will notify Customer after it makes a determination that it can no longer meet its obligations under the CCPA.

g. Company grants Customer the right, upon notice, to take reasonable and appropriate steps to stop and remediate Customer's unauthorized use of Personal Data.

h. Company shall implement reasonable security procedures and practices appropriate to the nature of the Personal Data Collected by Company pursuant to this Agreement to protect such Personal Data from unauthorized or illegal access, destruction, use, modification or disclosure in accordance with the CCPA and the Regulations.

i. Company shall cooperate with and provide reasonable assistance to Customer with respect to Customer's response to and compliance with any Consumer request, including but not limited to, by providing to Customer the Consumer's Personal Data in Company's possession, which Company Collected pursuant to this Agreement, and by deleting information and/or correcting inaccurate information (as and to the extent required by the CCPA and the Regulations) or enabling Customer to do the same.

j. In the event Company engages a third-party to assist it in Processing Personal Data for a Business Purpose on behalf of Customer ("Subcontractor"), such engagement shall be pursuant to a written contract to observe all the requirements set forth herein and in compliance with the CCPA and the Regulations. Company shall be fully liable for any breach of such obligations, and for any breach of the CCPA or the Regulations, by its Subcontractor.

B. Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah and Virginia

1. As used in this Section B, capitalized terms used herein and not otherwise defined shall have the meaning ascribed to them by the Colorado Privacy Act, Connecticut Data Privacy Act, Delaware Personal Data Privacy Act, Iowa Consumer Data Protection Act, Minnesota Consumer Data Privacy Act, Montana Consumer Data Privacy Act, Nebraska Data Privacy Act, New Hampshire Data Privacy Act, New Jersey Data Privacy Act, Oregon Consumer Privacy Act, Tennessee Information Protection Act, Texas Data Privacy and Security Act, Utah Consumer Privacy Act and/or Virginia Consumer Data Protection Act (the "Applicable U.S. Laws"). Customer is a Controller and Company is a Processor with respect to the Processing of Personal Data under the Applicable US Laws.

2. To the extent that Company is processing any Customer Personal Data on behalf of Customer pursuant to the Applicable U.S. Laws:

a. Ensure that each person Processing Personal Data is subject to a duty of confidentiality with respect to the data.

b. At Customer's direction, delete or return all Personal Data to Customer as requested at the end of the provision of the Services, unless retention of the personal data is required by law.

c. Taking into account the context of Processing, Company shall maintain appropriate technical and organizational measures with regard to Customer's Personal Data to ensure a level of security appropriate to the risk in accordance with the Applicable U.S. Laws and as otherwise expressly stated in the Agreement.

d. Upon the reasonable request of Customer, make available to Customer all information in its possession necessary to demonstrate its compliance with the obligations under the foregoing laws.

e. Company will allow for and reasonably contribute to inspections and audits no more than once annually during the term of this DPA by a mutually agreed upon third-party independent auditor.

f. To the extent that Company engages any Subprocessor to Process the Personal Data, it shall do so pursuant to a written contract in accordance with the Applicable U.S. Laws that require the Subprocessor to meet the obligations of Customer with respect to the Personal Data. Customer shall remain liable to Company where the Subcontractor fails to fulfill its obligations under the Applicable U.S. Laws.