StrikeArc Data Processing Agreement

1 Parties and scope

1.1 This Data Processing Agreement, including its completed schedules (DPA), is between StrikeArc Labs Inc. (StrikeArc) and the organization identified in Schedule A (Customer). It supplements their StrikeArc Customer Agreement and applicable Order, or controlling separately signed negotiated agreement (Agreement). It also applies directly to a prospect receiving a free Scout assessment or other agreed precontract work when its authorized representative accepts this DPA and Schedule A and StrikeArc accepts that engagement. No purchase is required for those protections to apply. Acceptance must identify the represented party, authority, document version, completed schedules and effective date; both parties may retain a copy. Website privacy choices do not constitute acceptance.

1.2 Customer Data means information Customer supplies, makes accessible or instructs StrikeArc to collect or generate for the engagement, including authorized public-source information, documents, correspondence, notes, recordings, credentials, configurations, prompts, outputs, reports and derived records. Service Personal Data is the personal-information portion processed on Customer's behalf. The confidentiality, purpose, security, supplier, AI-use and return/deletion protections in this DPA also protect nonpersonal confidential Customer Data. Statutory personal-data obligations apply only where the relevant law applies; this extension does not change ownership or grant new intellectual-property rights.

1.3 Customer is the controller or equivalent business, and StrikeArc is its processor, service provider or contractor, for Service Personal Data. If Customer acts for another controller, Schedule A must identify that controller and Customer's authority to appoint StrikeArc as subprocessor. Actual activities determine legal roles. Applicable Privacy Law means privacy and data-protection law applicable to that processing, including the EU GDPR, UK GDPR and California Consumer Privacy Act as amended (CCPA) where applicable. Statutory terms retain their applicable meanings. A Subprocessor is a person StrikeArc engages to process Service Personal Data for Customer.

1.4 StrikeArc may independently determine necessary uses of limited account, contracting, billing and security-administration records as described in its Privacy Notice. It must have its own lawful basis, observe purpose and retention limits, and may not relabel engagement content or full action payloads as business records to escape this DPA.

2 Instructions and operational authority

2.1 StrikeArc will process Customer Data only to perform the specific services and operations in Schedule A and on Customer's documented lawful instructions. Supporting purposes are authorized testing, delivery, monitoring, maintenance, support, security, rights assistance and return/deletion. The Agreement, completed schedules and recorded instructions from designated representatives form the instructions. StrikeArc will immediately inform Customer if, in its opinion, an instruction infringes Applicable Privacy Law and may pause that processing while seeking a lawful instruction.

2.2 Customer is responsible for its authority, source-data rights, lawful purposes, required customer-side notices and permissions, and the accuracy of business rules it supplies. StrikeArc remains responsible for complying with instructions and performing its own implementation and security duties. Customer review or approval does not excuse hidden defects, materially undisclosed changes or execution that differs from the approved action. Required meeting-recording notices and consents must be addressed before recording; attendance alone is insufficient where affirmative consent is required.

2.3 This DPA does not itself authorize operational actions in Customer's systems or on Customer's behalf. Such actions require the PowerPlay Authorization Schedule described in section 3.1 of the StrikeArc Customer Agreement or an equivalent expressly agreed authorization schedule. Ordinary service administration and delivery to agreed Customer contacts, such as scheduling an interview or sending a readout or draft, may instead be authorized by the Order or other recorded engagement instructions and this DPA, including completed Schedule A. That exception does not authorize new writes to Customer business systems, outreach or publication on Customer's behalf, or third-party commitments. The applicable approved systems, recipients, operations, review mode, limits and stop rules constrain processing. Technical access, broad credentials, a model response or text found in an external source cannot expand that authority. StrikeArc will retain records of material instructions and authorized changes. Customer's approval of a template does not necessarily approve each execution.

2.4 Customer will minimize supplied data. Special-category data, health information, criminal-offence information, government identifiers, payment-card details, children's information and other highly sensitive categories are excluded unless specifically identified in an agreed supplemental schedule with lawful grounds and safeguards. Unintended receipt requires prompt notice and proportionate isolation, minimization, return or deletion. This DPA does not authorize regulated decisions about individuals or other uses excluded by the Agreement.

3 Personnel and security

3.1 StrikeArc will restrict access to personnel with a delivery, support or security need, ensure enforceable confidentiality duties and appropriate training, and remove access when no longer required. It remains responsible for the performance of its personnel and contracted delivery obligations. Confidentiality continues for as long as protected Customer Data is retained.

3.2 StrikeArc will maintain the measures in Schedule B and other technical and organizational measures appropriate to processing risk. Security must address unauthorized access, disclosure, alteration, loss and destruction and support confidentiality, integrity, availability and recovery. Measures may evolve without materially reducing the agreed protection. A material reduction requires Customer's prior agreement to a lawful alternative; changing a website page does not amend this schedule. No certification, dedicated environment, geographic restriction, error-free operation or continuous human supervision is promised unless expressly agreed.

3.3 If no Agreement supplies mutual confidentiality terms, each party will protect the other's nonpublic business, technical, financial and personal information with reasonable care, use it only for this engagement and disclose it only to persons with a need to know and confidentiality duties. This excludes information demonstrably public without breach, already lawfully known without restriction, independently developed, or lawfully obtained without a confidentiality duty. Compelled disclosure must be limited, with notice where lawful. These duties survive five years after the engagement and, for trade secrets and personal data, as long as legally protected; stronger Customer Data duties in this DPA continue for their stated duration.

4 Suppliers and customer systems

4.1 Customer generally authorizes only the Subprocessors identified in the completed Authorized Register delivered with Schedule C. Each must be assessed, contractually bound to applicable protections no less protective for the delegated processing, and used within the approved scope. StrikeArc remains responsible for their performance of those duties. A candidate list, model name or API-key configuration alone is not authorization.

The supplier authorization, contractual protection, change-notice and responsibility rules in this section also apply to providers processing nonpersonal confidential Customer Data, even where they are not statutory Subprocessors. Their access must be included in the completed register and approved scope.

4.2 StrikeArc will give at least 30 days' written notice before a new or replacement Subprocessor receives Customer Data, identifying its function, data access and processing locations. Customer may object during that period on reasonable data-protection grounds. The parties will seek a reasonable alternative or restriction. StrikeArc will not send the affected data to the disputed new supplier while the objection remains unresolved. If no solution is reasonably available, either party may end the affected service; Customer receives its unused prepaid fees for that service, and required export/deletion continues. An urgent need may justify pausing processing, not bypassing required authorization.

4.3 Customer-selected source systems and recipient platforms are not automatically StrikeArc's Subprocessors. Schedule A must distinguish them from StrikeArc delivery suppliers. Their independent copies follow Customer's arrangements, but StrikeArc remains responsible for its access, configuration, transmissions and copies. Disclosure to an external recipient must fall within Customer's documented authority and approved purpose. Ownership of an account does not authorize unrestricted disclosure to every user of it.

5 International processing

5.1 StrikeArc will process Service Personal Data only in the countries and through the recipients identified in the completed schedules, including remote support access. Before a legally restricted transfer, the parties will establish the applicable valid mechanism, any required assessment and supplementary measures. Changes remain subject to the instruction and supplier-authorization procedures.

5.2 Where required, the parties will execute or validly incorporate the correct official standard contractual clauses, module and completed annexes, and the applicable UK Addendum or International Data Transfer Agreement or other required local instrument. A generic reference to those instruments does not itself execute or validly incorporate them. A restricted transfer must not begin without the required mechanism. Mandatory transfer terms prevail over conflicting caps, forum and other provisions. StrikeArc will inform Customer if it cannot comply, restrict affected processing, and cooperate on remediation, return or deletion. It will notify Customer of legally compelled disclosure unless prohibited and disclose only what law requires.

6 AI and restrictions on reuse

6.1 StrikeArc may use approved AI services only for the functions identified in Schedule A. It will minimize information supplied and cover the router and actual receiving hosts, including fallback routes, through the authorized supplier chain. It will not use Customer Data for general-purpose or shared-model training, another customer's work, advertising, unrelated outreach or datasets for sale, or permit its providers to use it for their own training or unrelated purposes. Personal or public AI accounts with incompatible terms must not receive it.

6.2 Customer-specific retrieval, evaluation, configuration or tuning requires documented instructions and use solely for that Customer. Actual model training or fine-tuning additionally requires a completed supplemental record identifying data, purpose, model and host, permitted users, isolation, retention and deletion of training data and resulting artifacts, and Customer's separate express written approval of that completed record before training or fine-tuning begins. No shared-model improvement or other-customer access is authorized. If the agreed deletion or isolation cannot be achieved, that tuning must not begin. General tool approval is not this instruction.

6.3 Reusable background software and general know-how remain governed by the Agreement. They may not incorporate or reveal Customer Data, confidential examples, identifiable outputs or customer-derived datasets for other customers. Any new purpose requires specific prior written authority and all required legal grounds, and cannot override section 6.1. Anonymization for a new purpose is itself processing and requires lawful instructions; StrikeArc will not attempt reidentification of information lawfully anonymized under them.

7 Incidents

7.1 StrikeArc will notify Customer without undue delay after becoming aware of a personal-data breach affecting Service Personal Data or an unauthorized compromise of confidential Customer Data. It will not wait for a completed investigation. The initial notice will provide available information about the incident, affected data, likely consequences, containment and a contact; material updates will follow as facts become available.

7.2 StrikeArc will investigate, contain, remediate, preserve proportionate evidence and reasonably assist Customer with required notifications and risk assessment. It will coordinate communications made on Customer's behalf and not contact individuals or regulators in Customer's name without instructions, except where law independently requires it. Unsuccessful attempts alone are not a breach, but material service disruption and unauthorized-action notifications required by the Agreement remain applicable. A contractual incident affecting only nonpersonal data does not become a statutory personal-data breach by definition.

8 Rights assistance and audits

8.1 StrikeArc will promptly pass relevant individual requests to Customer and reasonably assist fulfillment, verification, assessments and regulatory consultation in time to meet applicable deadlines, taking account of the processing and information available. It will not substantively respond for Customer without instructions unless legally required. Customer remains responsible for its decisions; routing a request does not excuse StrikeArc's own duties. Routine assistance and assistance required by StrikeArc's breach carry no additional fee. Exceptional separately scoped work may be charged only by agreement; a fee discussion will not delay legally required action.

8.2 StrikeArc will provide information reasonably needed to demonstrate compliance, including supplier and control evidence. Customer or a qualified independent auditor may conduct a proportionate review on reasonable notice, ordinarily once annually, with additional or urgent reviews following a breach, credible noncompliance or regulatory requirement. The parties will protect other customers' information, legitimate security details and service availability. Existing reports may satisfy a question but cannot bar a legally required inspection. Each party bears ordinary review costs; StrikeArc bears reasonable additional costs caused by its material noncompliance and will address material findings. No unavailable certification or audit will be implied.

9 US state processor requirements

9.1 Where applicable law treats StrikeArc as a processor, service provider or contractor, Customer discloses personal information only for Schedule A's limited, specific business purposes. StrikeArc will provide the required level of protection and will not sell or share it, use it for cross-context behavioral advertising, retain/use/disclose it outside those purposes or the direct relationship, or combine it with information from other persons or its own interactions except as expressly permitted by law and consistent with this DPA's narrower instructions.

9.2 StrikeArc certifies that it understands and will comply with these restrictions. It will notify Customer without undue delay if it can no longer comply, permit reasonable verification and, on notice, cooperate to stop and remediate unauthorized use. It will bind relevant subcontractors to required written restrictions and notice procedures, and assist applicable consumer requests, cybersecurity audits, risk assessments and automated-decision requirements. No clause designates an otherwise independent advertising recipient as a service provider by name alone.

10 Return deletion and ending access

10.1 Customer may choose return or deletion, subject to Schedule D. StrikeArc will complete agreed export and active deletion within the same applicable period; return does not add another deletion window. It will promptly stop relevant collection and new ordinary service processing on termination or a valid stop instruction, disable schedules and revoke grants within its control, and cooperate on customer-controlled revocation. It may continue only the processing necessary for authorized return/deletion, lawful required retention, incident containment, or a specifically agreed lawful transition; that exception does not authorize ordinary Run work or unrelated reuse. Disconnection alone stops future access but does not delete previously received records. It cannot recall a message or erase an independently controlled copy merely by deleting its own copy.

10.2 The duties cover manual notes, paper, local files, shared documents, recordings, credentials, source data, prompts, outputs, derived indexes, customer-specific tuning artifacts and supplier copies. Minimal separately justified business records may be retained for their lawful purpose; full engagement datasets may not be preserved under that label. Processor-held data may remain beyond deadline only where law requires storage or Customer gives a separate lawful instruction. Any legal preservation must have a recorded basis, restricted scope/access and review, with deletion when it ends. Shorter applicable law or binding prior commitments prevail.

10.3 On request StrikeArc will confirm completed deletion and identify any remaining lawful retention or backup-expiry dates. Failed steps must be tracked and remedied, not reported as complete. This DPA survives until retained data and copies have been disposed of, including continuing confidentiality, security, assistance and verification duties for that period.

11 Precedence liability and administration

11.1 This DPA controls conflicts concerning the processing and protection of Customer Data, subject to mandatory transfer instruments. It does not expand operational authority under the PowerPlay Authorization Schedule. Privacy Notice updates do not silently change these obligations. Material scope, purpose, recipient or protection changes require agreement by authorized representatives before the expanded processing begins.

11.2 Where the standard StrikeArc Customer Agreement governs, its enhanced liability category, caps, contract-year aggregation, loss exclusions and exceptions apply to this DPA in the same shared pool, without stacking or duplicate recovery. Its express recoverability of direct response, restoration and correction costs is preserved. A separately signed agreement controls liability under this DPA only to the extent it expressly specifies that allocation, subject to section 11.4 and mandatory law. Where neither the standard Customer Agreement nor an expressly specified DPA liability allocation in a separately signed agreement applies, section 11.3 governs. No DPA clause creates a new indemnity or makes Customer responsible for StrikeArc's own breach or unauthorized execution.

11.3 If there is no applicable Agreement liability provision under section 11.2, each party's aggregate liability to the other under this DPA for claims allocated to each successive twelve-month period beginning on its effective date is limited to the greater of twice the Relevant Fees and US$25,000. Relevant Fees are fees paid or payable for an affected engagement in the twelve months preceding the first event causing the claim group; for a one-time engagement they include its full agreed service fee. For claims in the first twelve months of a recurring engagement, use its first twelve months of agreed recurring fees at the then-agreed rate solely to calculate the cap, without creating a payment commitment. For allocation, the causative event is the act, omission or supply giving rise to liability under this DPA, no earlier than its effective date. Claims from the same incident or a causally connected series are one group allocated to the period of their first causative event, even if discovered later. An independent later incident is not grouped with an earlier incident merely because it involves the same product, control, defect or type of error. For each annual pool, count each affected engagement once at its highest applicable twelve-month fee value for any group allocated to that period; do not add overlapping fee windows. The monetary floor applies once to that pool. Each new period has a fresh pool for independent events first occurring in it. Indirect/consequential loss and lost profits are excluded, but otherwise recoverable reasonable direct incident-response, restoration and correction costs are not excluded merely by their description.

11.4 No limitation restricts fraud, willful misconduct, gross negligence, liability that law prohibits limiting, mandatory transfer liability, individuals' statutory rights or regulators' powers. Agreed fees and express fee refunds remain payment obligations outside damages caps. Contractual allocation does not displace statutory duties. The Agreement's law and forum apply; absent those terms, Michigan law governs without its conflict-of-laws rules, and state courts in Oakland County, Michigan, and the United States District Court for the Eastern District of Michigan, where it has jurisdiction, have exclusive jurisdiction, subject to mandatory privacy/transfer rules. Notices go to Schedule A's contacts; amendments require recorded authorized agreement. Invalidity of one provision does not invalidate the remainder.

Schedule A Processing particulars

The parties complete and agree an engagement-specific Schedule A before processing begins. The completed record is supplied directly to Customer and forms part of this DPA; it is not published on the website. Blank or incomplete fields grant no processing authority.

Schedule A identifies the parties, authorized representatives and contacts; their controller, processor or equivalent roles; the services and duration; specific purposes and operations; sources, systems, categories of individuals and data; permitted recipients, access and processing countries; action authority and relevant schedule versions; approved AI functions and any separately approved tuning record; retention and transfer instructions; and the parties' dated acceptance record. It must identify any underlying controller where Customer acts as a processor.

Schedule B Minimum security measures

StrikeArc must validate and maintain these measures for the agreed service. Processing that requires a measure must not begin until that measure is in place.

Schedule C Authorized supplier register

StrikeArc supplies Customer with a completed engagement-specific Authorized Register before any listed entity receives Customer Data. The register forms part of this DPA and is maintained and provided directly to Customer under section 4. Only completed authorized entries have contractual effect; a brand name, candidate list or general website provider list is not an appointment.

For each supplier, the register identifies its legal entity and service; data and purpose; direct or downstream role; processing, support and backup countries; binding protection terms; required transfer mechanism; retention and deletion arrangements; and AI-training restrictions. Additions and replacements follow the notice and objection process in section 4.

Customer source systems, business scheduling/CRM and website marketing vendors require role assessment; they do not automatically belong in this DPA register. Advertising and visitor-identification tools are not authorized to receive engagement Customer Data. Customer may request its current register through its engagement contact or info@strikearc.ai.

Schedule D Retention instructions

Earlier binding commitments and shorter legal deadlines continue to apply. A new policy or agreement does not itself relax a previous binding promise. Different defined periods must be explicit, lawful and agreed through the relevant contractual process.