Data Processing Addendum (DPA)

Effective Date: January 20, 2026

This Data Processing Addendum (“DPA”) forms part of the Terms of Use (“Agreement”) between Data Driven 9 Consulting LLC (“DD9”, “Processor”) and the customer entity using the Platform (“Customer”, “Controller”).

1. Scope and Roles

To the extent DD9 processes Personal Data on behalf of Customer through the assessment and management platform (the “Platform”), DD9 acts as a Processor and Customer acts as a Controller.

2. Nature and Purpose of Processing

DD9 processes Personal Data solely to:

• Provide the assessment and management Platform;
• Generate analytical reports and AI-assisted outputs;
• Enable authorized integrations (e.g., QuickBooks);
• Maintain system security, integrity, and performance.

3. Categories of Data Subjects

• Customer employees, contractors, and representatives;
• Invited respondents or collaborators;
• Users authorized by Customer.

4. Categories of Personal Data

• Name, email, role, and contact information;
• Organizational responses and assessment inputs;
• Platform usage metadata;
• Financial summary data accessed via authorized integrations.

5. Processor Obligations

DD9 shall:

• Process Personal Data only on documented instructions from Customer;
• Ensure personnel are subject to confidentiality obligations;
• Implement appropriate technical and organizational security measures;
• Assist Customer in responding to lawful data subject requests;
• Notify Customer without undue delay upon becoming aware of a confirmed Personal Data breach.

6. Subprocessors

DD9 may engage subprocessors (e.g., hosting providers, analytics providers, messaging providers, integration platforms). DD9 remains responsible for ensuring such subprocessors are bound by appropriate data protection obligations.

7. Data Transfers

Where Personal Data is transferred internationally, DD9 will implement legally recognized safeguards where required.

8. Data Retention and Deletion

Upon termination of the Agreement, DD9 will delete or return Personal Data, except where retention is required by law or necessary for legitimate business recordkeeping.

9. Audit Rights

Upon reasonable written request and subject to confidentiality obligations, DD9 will provide information reasonably necessary to demonstrate compliance with this DPA.