Data Processing Addendum

Version 1. Effective October 25, 2026.

This Data Processing Addendum ("DPA") is between Sondola Inc., a Delaware corporation ("Sondola", "we", "us"), and the customer that has accepted the Sondola Terms of Service at https://sondola.com/legal/terms ("Customer", "you"). It forms part of the agreement under the Terms.

About the "In short" summaries. Sections marked In short are plain-English summaries. They are not part of this DPA and they do not change it.

In short. For the business data we read from your tools, you are in charge and we act only on your instructions. This DPA sets out the rules data protection law requires: what we may do with the data, how we keep it safe, who helps us, what happens if something goes wrong, and how data leaves Europe lawfully. You accept it when you accept the Terms. No signature is needed.

1. Acceptance and scope

1.1 No signature needed. You accept this DPA when you accept the Terms. It applies without a signature, from the date you accept the Terms, for as long as we process Customer Personal Data.

1.2 Scope. This DPA applies to personal data contained in Customer Data that we process on your behalf in providing the Service ("Customer Personal Data"). It does not apply to Account Data or website data, for which Sondola is the controller and which the Privacy Policy describes.

1.3 Definitions. Words defined in the Terms have the same meaning here. "Data Protection Law" means all laws on privacy and the processing of personal data that apply to a party's processing of Customer Personal Data, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of the law of the United Kingdom ("UK GDPR") and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and the California Consumer Privacy Act as amended ("CCPA") and other US state privacy laws. "Controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in the GDPR, and the equivalent terms in other Data Protection Law have the corresponding meanings. "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data in our systems or our subprocessors' systems. "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.

1.4 Order of precedence. If there is a conflict, the SCCs (where they apply) prevail over this DPA, and this DPA prevails over the Terms, as to the processing of Customer Personal Data.

2. Roles

2.1 You are the controller and we are your processor. For Customer Personal Data, you are the controller and Sondola is your processor. Where you process Customer Personal Data as a processor for your own clients, Sondola is your subprocessor, and you confirm that your instructions are authorised by your controller.

2.2 Service provider. For the purposes of the CCPA, Sondola is your service provider and you are the business.

2.3 Your responsibilities. You are responsible for having a lawful basis for the processing you instruct, for giving any notices and obtaining any consents that Data Protection Law requires, and for the accuracy of Customer Personal Data. This includes the people whose data may appear in your Customer Data, such as payees named in your spending lines, people named in notes you type in, and the recipients of investor updates you send. You will not instruct us to process special categories of personal data, and §6 of the Terms limits what you may send us.

3. Instructions

3.1 Documented instructions. We process Customer Personal Data only on your documented instructions, unless the law requires otherwise, in which case we will tell you before processing unless the law forbids it. Your instructions are the Terms, this DPA and the settings, connections and features you choose in the Service, including when you connect a Connected Source, send an investor update, create a share link, connect Slack or issue an MCP token.

3.2 Unlawful instructions. We will tell you promptly if, in our opinion, an instruction breaches Data Protection Law. We may suspend acting on that instruction until you confirm or change it.

3.3 Purpose. We process Customer Personal Data to provide, secure and support the Service for you, as the Terms describe. Annex I sets out the details of the processing.

4. CCPA service provider terms

4.1 Business purposes. We process Customer Personal Data only for the business purposes of providing, securing and supporting the Service for you, as the Terms and Annex I describe.

4.2 What we will not do. We will not:

(a) sell or share Customer Personal Data, as "sell" and "share" are defined in the CCPA

(b) retain, use or disclose it for any purpose other than the business purposes in §4.1, including for any commercial purpose other than providing the Service, or as the CCPA otherwise permits a service provider to

(c) retain, use or disclose it outside the direct business relationship between you and us

(d) combine it with personal data we receive from or on behalf of anyone else, or collect from our own interactions with a person, except as the CCPA regulations permit a service provider to

4.3 Compliance. We will comply with the obligations that apply to us as a service provider under the CCPA and give Customer Personal Data the level of privacy protection the CCPA requires. We will tell you if we determine that we can no longer meet those obligations.

4.4 Your rights to act. You may take reasonable and appropriate steps to ensure we use Customer Personal Data in a manner consistent with your obligations under the CCPA, and, on notice, to stop and remedy any unauthorised use. The audit process in §10 is the means for doing so.

4.5 Certification. We certify that we understand the restrictions in this §4 and will comply with them.

5. Confidentiality of personnel

We will ensure that every person we authorise to process Customer Personal Data is bound by an obligation of confidentiality, by contract or by law, and has access only as §10 of the Terms allows.

6. Security

6.1 Measures. We will implement and maintain the technical and organisational measures in Annex II, which are designed to protect Customer Personal Data against Security Incidents.

6.2 Changes. We may update those measures as technology and risks change, provided the update does not materially reduce the overall security of the Service.

6.3 Your part. You are responsible for the security of your own systems, your users' credentials, the credentials you create at your Connected Sources, and the share links and tokens you create, and for using the security features the Service offers.

7. Subprocessors

7.1 General authorisation. You give us general authorisation to engage subprocessors. The subprocessors we use today are listed at https://sondola.com/legal/subprocessors, and you authorise them.

7.2 Flow-down. We will engage each subprocessor under a written contract that imposes data protection obligations no less protective of Customer Personal Data than this DPA, to the extent appropriate to the service it provides. We remain responsible to you for each subprocessor's performance of those obligations.

7.3 Notice of new subprocessors. We will post any new subprocessor on that page, and email the account owner, at least 30 days before it starts processing Customer Personal Data.

7.4 Objection. You may object to a new subprocessor on reasonable data protection grounds by emailing legal@sondola.com before it takes effect. We will discuss your objection in good faith. If we cannot resolve it, you may terminate the affected Service before the change takes effect, without penalty, and we will refund prepaid fees for the unused part of your term. This is your sole remedy for an objection.

7.5 Not subprocessors. Connected Sources, AI providers whose key you add, AI assistants you connect, Slack workspaces and the recipients of anything you send through the Service are chosen by you. They are not our subprocessors.

8. Assistance

8.1 Data subject requests. Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, so far as possible, in responding to requests from data subjects to exercise their rights. The Service lets you export, correct and delete Customer Data yourself. If we receive a request about Customer Personal Data, we will pass it to you promptly and will not respond to it ourselves, except to tell the requester to contact you.

8.2 Impact assessments and regulators. Taking into account the nature of the processing and the information available to us, we will give you reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities that relate to the Service, mainly by providing this DPA, the Security page and the Subprocessors page.

8.3 Costs. We may charge reasonable costs for assistance beyond what the Service and our published documents provide, except where the assistance is needed because of our breach of this DPA.

9. Security Incidents

9.1 Notice. If we determine that a Security Incident has affected Customer Personal Data, we will notify you without undue delay and in any case within 72 hours of that determination, by email to your workspace administrators.

9.2 What we will tell you. So far as we know it at the time, and in phases where we cannot provide everything at once, we will describe the nature of the Security Incident, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures we have taken or propose to take, and a contact for more information.

9.3 Our response. We will take reasonable steps to contain and investigate the Security Incident and to reduce its effects, and will give you reasonable cooperation with any notice you must make.

9.4 No admission. Our notice of a Security Incident is not an admission of fault or liability.

10. Audits

10.1 Information first. We will make available to you the information reasonably necessary to demonstrate our compliance with this DPA. We will do so first by answering, once a year, a reasonable written security questionnaire, and by providing our published Security page, Subprocessors page and relevant documentation.

10.2 On-site audits. You may carry out an on-site audit, or have an independent auditor bound by confidentiality do so, only if (a) a Security Incident has affected your Customer Personal Data, or (b) a supervisory authority or other regulator requires it. Any on-site audit is limited to once in any 12 months, unless a regulator requires more, requires at least 30 days' written notice, takes place during business hours, is limited to the processing of your Customer Personal Data, and must not compromise the security or confidentiality of other customers' data.

10.3 Costs. Audits are at your cost, including any reasonable cost we incur in supporting them, unless the audit shows that we materially breached this DPA.

10.4 Results. Audit information and results are our confidential information.

10.5 SCC audits. The parties agree that audits under the SCCs will be carried out as this §10 describes.

11. Deletion and return

11.1 Return. You can export your Customer Data at any time while your workspace is open, and for 30 days after termination or closure, using Open Books in the Service. This is how we return Customer Personal Data.

11.2 Deletion. After that export window closes, we will delete Customer Personal Data from live systems within 30 days, and from backups within a further 60 days as backups rotate, as §14.5 of the Terms describes.

11.3 Retention required by law. We may keep Customer Personal Data where the law requires it. This DPA continues to apply to it, and we will process it only as the law requires.

11.4 Certification. On written request we will confirm deletion in writing.

12. International transfers

12.1 Location. Customer Personal Data is stored at rest in the United States, in Amazon Web Services region us-west-1 through Supabase. Requests may pass through edge servers of our hosting and network providers in other countries.

12.2 EU SCCs. Where processing of Customer Personal Data involves a transfer from the European Economic Area to Sondola in a country without an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows:

(a) Module 2 (controller to processor) applies where you are a controller, and Module 3 (processor to processor) applies where you are a processor

(b) you are the data exporter and Sondola is the data importer

(c) Clause 7 (docking clause) does not apply

(d) in Clause 9, Option 2 (general written authorisation) applies, with the notice period in §7.3 of this DPA

(e) in Clause 11, the optional language does not apply

(f) in Clause 13, the competent supervisory authority is the one determined under Clause 13(a)

(g) in Clause 17, Option 1 applies and the governing law is the law of Ireland

(h) in Clause 18, disputes are resolved by the courts of Ireland

(i) Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA

12.3 UK. Where processing involves a transfer from the United Kingdom, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force from March 21, 2022), including its Mandatory Clauses, is incorporated into this DPA by reference. Table 1 is completed with the details in Annex I. Table 2 selects the modules and options in §12.2. Table 3 is completed by Annexes I, II and III of this DPA. For Table 4, either party may end the Addendum as its Section 19 allows.

12.4 Switzerland. Where processing involves a transfer from Switzerland, the SCCs apply as described in §12.2 with these changes: references to the GDPR include the FADP, the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the FADP, the term "Member State" in Clause 18(c) does not prevent data subjects in Switzerland from bringing claims where they habitually reside, and the SCCs also protect the data of legal entities where the FADP requires it.

12.5 Onward transfers. Where our subprocessors receive Customer Personal Data in a country without an adequacy decision, we rely on their data processing terms, which include the SCCs and the UK Addendum where required.

12.6 Requests from public authorities. If a public authority asks us for Customer Personal Data, we will tell it to request the data from you, notify you promptly unless the law forbids it, and disclose only what the law requires after assessing the request, as Clause 15 of the SCCs describes.

13. Liability

Each party's liability arising out of or relating to this DPA and the SCCs, on any theory, is subject to the limitations and exclusions in §18 of the Terms. This does not limit a party's liability to data subjects under the third-party beneficiary rights in the SCCs, or any liability that the SCCs or Data Protection Law do not allow to be limited.

14. Platform terms

Some Connected Source providers require additional commitments from anyone reading their data on your behalf. Those commitments are in §4.6 of the Terms, including Apple, Meta, Google API Limited Use and Slack, and they apply to Customer Personal Data in addition to this DPA.

15. Changes and term

15.1 Changes. We may update this DPA where Data Protection Law, a supervisory authority or a change to the Service requires it, or to add protections. For a material change that reduces your protections we will give at least 30 days' notice by email, as §21 of the Terms describes. We will not change the SCCs themselves except to adopt a revised version approved by the competent authority.

15.2 Term. This DPA lasts for as long as we process Customer Personal Data, and ends automatically once we have deleted it under §11.

Annex I. Details of the processing

A. Parties

• Data exporter: the Customer, as identified in its Sondola workspace. Contact: the workspace administrator email address. Role: controller, or processor for its own clients. Activities: use of the Service.
• Data importer: Sondola Inc., a Delaware corporation. Contact: legal@sondola.com for legal matters and privacy@sondola.com for data protection matters. Role: processor, or subprocessor. Activities: providing the Service.
• Signature and date: each party is treated as having signed this Annex on the date the Customer accepts the Terms.

B. Description of the processing

C. Competent supervisory authority

The supervisory authority determined under Clause 13(a) of the SCCs. For transfers governed by the UK GDPR, the UK Information Commissioner. For transfers governed by the FADP, the Swiss Federal Data Protection and Information Commissioner.

Annex II. Technical and organisational security measures

These measures describe how the Service works today. They are designed to protect Customer Personal Data, but no system is perfectly secure.

1. Encryption. Data is encrypted in transit and at rest.
2. Hosting. Customer Data is stored in managed Postgres on Supabase, in AWS region us-west-1.
3. Workspace isolation. Tables in Sondola's own schemas carry row-level security, designed so that one workspace cannot read another workspace's data, and checked by automated tests. Tables in private schemas, including spending lines, are configured so that signed-in and anonymous roles cannot read them directly. Views are configured to run with the rights of the person reading, so that a view does not bypass a policy.
4. Privileged functions. Database functions that run with elevated rights have execute permission revoked from anonymous and signed-in roles, and a test in our build is designed to fail if a new one is exposed.
5. Credentials. Credentials for Connected Sources are held server-side and are designed never to be sent to the browser. The key the browser receives is a publishable key that, on its own, is designed not to give access to workspace data.
6. Read-only access. We ask for read-only access to Connected Sources wherever the provider offers it, and use other keys only to read, with the two exceptions in §4.2 of the Terms.
7. Change records. When the Service changes a stored value, it records the old value, the new value and the reason in a restatement ledger instead of overwriting it.
8. Export. The Open Books export includes the source, collection time and run for every reading and a SHA-256 checksum for every file. It is designed to exclude keys and tokens, and each download is logged in the workspace.
9. Logging. Errors in the Service are recorded by Sondola in its own database, with no field values and with tokens and email addresses removed, and are not sent to an outside error-monitoring service. Collector run logs are visible to Sondola and are not visible to any customer workspace.
10. Personnel access. Access by our staff to Customer Data is limited to the purposes in §10 of the Terms.
11. What we do not have. Sondola does not hold SOC 2 or ISO 27001 certification and has not completed a third-party penetration test.

Annex III. Subprocessors

The subprocessors listed at https://sondola.com/legal/subprocessors, as updated under §7. On the effective date of this DPA they are Supabase, Cloudflare, Lovable, Resend, Mailgun, Google Workspace, Anthropic or OpenAI, and PostHog. PostHog does not receive Customer Data.