DATA PROTECTION AND SECURITY ADDENDUM

This Data Protection and Security Addendum (this “DPA”) is entered into between Benson Technologies LLC (“Benson”) and the customer identified above (“Customer”). Benson and Customer are each a “Party” and together the “Parties.” This DPA supplements the Benson Software-as-a-Service Customer Agreement, including each applicable Order Form and incorporated addendum (collectively, the “Customer Agreement”), and governs Benson’s Processing of Customer Personal Data in providing the Service.

This DPA is intended for Benson’s United States service offering. It does not incorporate international transfer mechanisms or data-protection terms applicable solely to services offered outside the United States.

1. DEFINITIONS

“Applicable Data Protection Law” means United States federal or state privacy, data-protection, data-security, or breach-notification law applicable to Benson’s Processing of Customer Personal Data under the Customer Agreement, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (“CCPA”), when applicable.

“Customer Personal Data” means Personal Data contained in Customer Data that Benson Processes on Customer’s behalf in connection with the Service. “Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with an identified or identifiable natural person or household, to the extent protected by Applicable Data Protection Law.

“Process” or “Processing” means any operation performed on Customer Personal Data, including collection, access, use, storage, organization, transmission, disclosure, analysis, deletion, or destruction. “Security Incident” means a confirmed breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data in Benson’s possession or control, excluding unsuccessful attempts that do not compromise Customer Personal Data.

“Subprocessor” means a third party engaged by Benson to Process Customer Personal Data on Benson’s behalf in connection with the Service. Benson’s current Subprocessors are listed in Schedule 2 and on the Subprocessor List at bensonhr.com/legal/subprocessors (the “Subprocessor Page”). The Business Associate Agreement refers to Subprocessors that handle PHI as “Subcontractors.” Terms such as “business,” “consumer,” “contractor,” “personal information,” “service provider,” “sell,” and “share” have the meanings assigned by the CCPA when the CCPA applies.

2. ROLES; SCOPE; PROCESSING INSTRUCTIONS

2.1 Roles

As between the Parties, Customer determines the purposes for which Customer Personal Data is submitted to and Processed through the Service. Benson Processes Customer Personal Data on Customer’s behalf to provide the Service. Where the CCPA applies and Customer is a “business,” the Parties intend Benson to act as a “service provider” or “contractor,” as applicable, and not as a third party with respect to Customer Personal Data Processed under this DPA.

2.2 Documented Instructions

Customer instructs Benson to Process Customer Personal Data as reasonably necessary to provide, host, secure, maintain, support, troubleshoot, administer, and improve the quality of the Service; provide functionality requested or configured by Customer; prevent, detect, and investigate security incidents, fraud, abuse, and unlawful activity; comply with law; and perform other Processing expressly authorized by the Customer Agreement or Customer’s documented instructions and permitted by Applicable Data Protection Law.

2.3 Specific Business Purposes

The specific business purposes for Processing include workforce and human-resources administration; employee and contractor record management; compliance and credential management; onboarding; document collection, review, storage, and workflow; communications and notifications; electronic-signature and document workflows; exclusion screening and related recordkeeping; reporting and auditability; account administration; customer support; security; service reliability; and functionality made available through the Service, including automated document reading when enabled.

2.4 Prohibited Processing

Benson will not retain, use, or disclose Customer Personal Data outside the direct business relationship between Benson and Customer or for purposes other than those permitted by the Customer Agreement, this DPA, Applicable Data Protection Law, or Customer’s lawful instructions. Benson will not sell Customer Personal Data or share it for cross-context behavioral advertising. Benson will not use one Customer’s identifiable Customer Personal Data to provide advertising or unrelated services for another person.

2.5 Combining Data

To the extent prohibited by Applicable Data Protection Law, Benson will not combine Customer Personal Data received from or on behalf of Customer with personal information received from or on behalf of another person, or collected from Benson’s own interaction with a consumer, except where such combination is permitted by law and reasonably necessary to provide the Service, detect or prevent security incidents or fraud, or perform another legally permitted business purpose.

3. CONFIDENTIALITY AND ACCESS

Benson will limit access to Customer Personal Data to personnel and authorized service providers who need access for permitted purposes. Benson will require persons authorized to Process Customer Personal Data to be subject to appropriate confidentiality obligations. Benson will maintain access practices designed to limit unauthorized access and will terminate or adjust access when it is no longer reasonably required.

4. SECURITY

4.1 Security Program

Benson will maintain reasonable and appropriate administrative, technical, and physical safeguards designed to protect Customer Personal Data against unauthorized access, acquisition, destruction, use, modification, or disclosure, taking into account the nature and sensitivity of the data, the nature of the Processing, reasonably foreseeable threats, and the state of the art and cost of available safeguards.

4.2 Security Measures

Benson’s current security measures are described in Schedule 3. Benson may update those measures from time to time, provided the update does not materially reduce the overall protection of Customer Personal Data. Except as stated in Schedule 3 or separately confirmed by Benson in writing, this DPA does not represent that Benson maintains any particular certification, audit report, or recovery objective.

4.3 Customer Security Responsibilities

Customer is responsible for securely administering its accounts, users, permissions, credentials, devices, integrations, recipient information, and configurations; restricting access to authorized users; and using the Service in accordance with the Customer Agreement and applicable law. Customer will promptly notify Benson at info@bensonhr.com if it becomes aware of compromised credentials or other circumstances that could materially affect the security of Customer Personal Data.

4.4 Data Location

Benson Processes Customer Personal Data, including backups, only in the United States, and engages only Subprocessors that Process Customer Personal Data in the United States.

5. SECURITY INCIDENTS

5.1 Notice

Benson will notify Customer of a Security Incident affecting Customer Personal Data without undue delay, and in any event within seventy-two (72) hours after confirming the Security Incident. Notice will be sent by email to Customer’s primary administrator and may be provided in phases as facts become available. Notice will not be construed as an admission of fault or liability.

5.2 Information and Cooperation

To the extent reasonably available and legally permitted, Benson will provide information reasonably necessary for Customer to understand the nature of the Security Incident, categories of affected data and individuals, likely consequences, and measures taken or proposed to address the incident. The Parties will reasonably cooperate regarding legally required notices. Each Party remains responsible for notices and regulatory obligations legally assigned to it.

5.3 HIPAA Matters

If a Security Incident involves Protected Health Information subject to a Business Associate Agreement between the Parties, the Business Associate Agreement controls with respect to HIPAA-specific incident and breach obligations.

6. SUBPROCESSORS

6.1 Authorization

Customer authorizes Benson to engage the Subprocessors listed in Schedule 2 and to engage and replace Subprocessors as reasonably necessary to provide and operate the Service, subject to Section 6.3. Benson is not required to obtain Customer’s individual approval for each Subprocessor appointment or change.

6.2 Protections

Benson will impose written data-protection obligations on Subprocessors that Process Customer Personal Data that are appropriate to the nature of the Processing and consistent with Benson’s applicable obligations under this DPA. Benson remains responsible for its Subprocessors to the extent required by Applicable Data Protection Law.

6.3 Subprocessor Information and Changes

Benson maintains the current list of Subprocessors on the Subprocessor Page. Before a new Subprocessor Processes Customer Personal Data, Benson will post the change on the Subprocessor Page and email Customer’s primary administrator at least fifteen (15) days before the change takes effect. Customer may raise a reasonable, documented data-protection objection within that notice period, and the Parties will work in good faith toward a commercially reasonable resolution. If no resolution is reached before the change takes effect, Customer may cancel the affected subscription by written notice before that date and Benson will refund prepaid fees allocable to the period after cancellation. An objection does not otherwise give Customer a right to control Benson’s vendor selection except where required by law.

7. AI-ASSISTED PROCESSING

7.1 Permitted AI Use

Benson may use artificial intelligence, machine learning, optical character recognition, or similar technologies, including the Subprocessor identified for that purpose in Schedule 2, to provide features requested or enabled through the Service, such as document reading, extraction, classification, and review assistance. Such Processing is subject to this DPA and the applicable terms governing Subprocessors.

7.2 No Model Training

Benson will not use Customer Personal Data to train artificial-intelligence models, and Benson’s AI Subprocessor is contractually prohibited from using content Benson submits through its application programming interface to train its models. This restriction does not prohibit transient Processing necessary to provide an AI-enabled feature or Processing for security and abuse prevention that is otherwise permitted by Applicable Data Protection Law.

7.3 Automated Outputs

AI-assisted outputs may be probabilistic and are intended to assist, not replace, appropriate human review where the context requires judgment. Where Customer enables automatic document reading, the Service may accept an upload or return it to the person who uploaded it according to settings Customer controls; those are document-intake steps, not decisions about an individual, and Customer may review and override each of them in the Service. Customer remains responsible for decisions it makes using outputs from the Service. Nothing in this Section authorizes Benson to make legally significant employment, healthcare, or other decisions about individuals on Customer’s behalf.

8. CONSUMER AND DATA-SUBJECT REQUESTS

8.1 Assistance

Taking into account the nature of the Processing and functionality of the Service, Benson will provide reasonable assistance to Customer in responding to verified requests to exercise rights under Applicable Data Protection Law to the extent Customer cannot reasonably fulfill the request using available Service functionality.

8.2 Direct Requests

If Benson receives a request from an individual concerning Customer Personal Data Processed on Customer’s behalf, Benson may direct the individual to Customer or notify Customer, unless Benson is legally required to respond directly. Customer is responsible for determining whether and how to honor a request.

8.3 CCPA Compliance Support

Where the CCPA applies, Benson will provide the level of privacy protection required of service providers or contractors, will cooperate with Customer in responding to applicable consumer requests, and will notify Customer if Benson determines that it can no longer meet its applicable CCPA obligations. Customer may take reasonable and appropriate steps, consistent with Applicable Data Protection Law, to help ensure that Benson uses Customer Personal Data consistently with Customer’s CCPA obligations and to stop and remediate unauthorized use.

9. COMPLIANCE INFORMATION AND REVIEW

Upon reasonable written request, Benson will provide information reasonably necessary to demonstrate compliance with this DPA and Applicable Data Protection Law, subject to confidentiality, security, legal privilege, third-party restrictions, and protection of other customers’ information. Where Applicable Data Protection Law requires Customer to conduct a review, assessment, or audit of Benson’s Processing, the Parties will first use available documentation, questionnaires, summaries, or independent assessments. Any additional inspection will be limited to what applicable law requires, conducted on reasonable notice during normal business hours, designed to avoid unreasonable disruption or security risk, and subject to appropriate confidentiality protections. Customer will bear its own costs unless applicable law requires otherwise.

10. RETURN, DELETION, RETENTION, AND LEGAL HOLDS

10.1 End of Services

Following termination or expiration of the Customer Agreement, Benson will make Customer Data available for retrieval during the export window provided in the Customer Agreement and will thereafter delete Customer Personal Data from active systems within thirty (30) days, except where retention is required or permitted by law or reasonably necessary for security, fraud prevention, dispute resolution, or legal claims. Customer Personal Data held in encrypted backups is deleted through ordinary backup rotation not exceeding thirty (30) days after deletion from active systems.

10.2 Restricted Retention

Customer Personal Data retained after termination will remain subject to applicable confidentiality, security, and use limitations for so long as Benson retains it. Benson will not retain Customer Personal Data merely to create an unrelated commercial dataset.

10.3 PHI

Protected Health Information is governed by the Parties’ Business Associate Agreement, and that agreement controls over this Section to the extent of any conflict concerning return, destruction, retention, or continued protection of PHI.

11. DE-IDENTIFIED AND AGGREGATED INFORMATION

To the extent permitted by Applicable Data Protection Law and the Customer Agreement, Benson may create and use information that has been de-identified or aggregated so that it cannot reasonably be linked to Customer or an identifiable individual for security, analytics, benchmarking, service reliability, product improvement, and business operations. Benson will not attempt to re-identify data that Applicable Data Protection Law requires to remain de-identified, except as permitted by law to test whether de-identification processes satisfy applicable requirements.

12. GOVERNMENT AND LEGAL REQUESTS

If Benson receives a legally binding request from a governmental authority for Customer Personal Data, Benson may disclose only the information it is legally required to disclose. Unless prohibited by law or impracticable in an emergency, Benson will use reasonable efforts to notify Customer before disclosure when the request is directed to Customer Personal Data and Customer is legally entitled to notice. Benson may challenge or seek to narrow a request where Benson reasonably determines that doing so is appropriate, but is not required to pursue litigation on Customer’s behalf.

13. CUSTOMER OBLIGATIONS

Customer is responsible for the lawfulness, accuracy, and appropriateness of Customer Personal Data and its Processing instructions; providing legally required notices; obtaining required consents or authorizations; establishing lawful bases for Processing; configuring user access and permissions; and determining which data is appropriate to place in the Service. Customer will not instruct Benson to Process Customer Personal Data in violation of Applicable Data Protection Law.

14. GENERAL

14.1 Order of Precedence

This DPA is incorporated into and forms part of the Customer Agreement. If this DPA conflicts with the Customer Agreement regarding the protection or Processing of Customer Personal Data, this DPA controls solely to the extent of that conflict. If the Parties have a Business Associate Agreement and a conflict concerns PHI or HIPAA obligations, the Business Associate Agreement controls. Otherwise, the Customer Agreement remains unchanged.

14.2 Commercial Terms

The limitations of liability, exclusions of damages, indemnification provisions, dispute-resolution provisions, governing-law provisions, and other generally applicable commercial terms of the Customer Agreement apply to this DPA to the maximum extent permitted by law unless this DPA expressly states otherwise.

14.3 Changes in Law

References to Applicable Data Protection Law include amendments and successor requirements. The Parties will cooperate in good faith to make amendments reasonably necessary for material changes in applicable law. Benson may update operational privacy and security procedures so long as the update does not materially reduce the protections required by this DPA.

14.4 Notices

Privacy, data-protection, and security notices to Benson will be sent to info@bensonhr.com. Notices to Customer may be sent to the administrative, privacy, or legal contact maintained in Customer’s Benson account or stated in the applicable Order Form.

14.5 Acceptance; Electronic Execution

Customer accepts this DPA by accepting the Customer Agreement, by signing this DPA, or by submitting Customer Personal Data to the Service; each of those acts is acceptance of this DPA without further signature. This DPA may also be executed in counterparts. Electronic signatures and copies will have the same effect as originals to the extent permitted by applicable law.

SCHEDULE 1 — PROCESSING DETAILS

SCHEDULE 2 — SUBPROCESSORS

The following Subprocessors Process Customer Personal Data as of the Effective Date. Each is located in, and Processes Customer Personal Data only within, the United States. The current list is maintained on the Subprocessor Page.

A mailbox that Customer connects to the Service (Microsoft 365) is Customer’s own service provider, selected and controlled by Customer, and is not a Subprocessor. Benson uses the connection only to send email on Customer’s behalf.

SCHEDULE 3 — SECURITY MEASURES

Benson maintains the following measures for the Service as of the Effective Date.