Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into by and between Benevolve Inc., a corporation incorporated under the laws of the State of Washington, USA, with its principal place of business at 2650 W Bertona St, Seattle, WA 98199, USA, together with its subsidiary Benevolve Pte. Ltd and any Benevolve affiliate that provides the Services (collectively, "Benevolve," "we," "us," or "our"), and you, the entity or individual that has accepted Benevolve's Terms of Service, available at https://benevolve.com/terms-and-conditions, (the "Agreement") in order to access the Benevolve platform or avail the Services ("Customer," "you," or "your").

1. Incorporation by Reference. This DPA is incorporated by reference into, and forms an integral part of, the Agreement and governs the Processing of Personal Data by Benevolve on Customer's behalf in connection with the provision of the Benevolve platform and related services (the "Services"). The Customer hereby accepts and agrees to be bound by this DPA by accepting the Agreement, creating an account, or accessing or using the Services. If the Customer is accepting the Agreement on behalf of an entity, the individual accepting the Agreement represents and warrants that they have the authority to bind that entity to this DPA. This DPA applies automatically, without the need for any further execution, signature, or other act by either party, whenever Benevolve Processes Personal Data on Customer's behalf under or in connection with the Agreement.

2. Effective Date and Acceptance. This DPA takes effect on earlier of (a) the date Customer first accepts the Agreement, (b) first accesses or uses the Services, (c) executes an Order (if applicable), or (d) the date Benevolve first Processes Personal Data on Customer's behalf, and remains in effect for as long as Benevolve Processes Personal Data on Customer's behalf.

3. Precedence. This DPA also supplements and forms part of the Agreement and governs the Processing of Personal Data by Benevolve on Customer's behalf in connection with the Services. This DPA supplements, and does not replace, the data protection commitments in Benevolve's Privacy Policy, available at https://benevolve.com/privacy. ("Privacy Policy"). In the event of any conflict between this DPA and the Agreement with respect to the Processing of Personal Data, this DPA will prevail to the extent of such conflict. In the event of any conflict or inconsistency between this DPA and any applicable Standard Contractual Clauses, or other clauses incorporated into this DPA, such clauses shall prevail to the extent required by applicable Data Protection Laws. Any term not defined in this DPA has the meaning given to it in the Agreement or, if not defined therein, the meaning given under applicable Data Protection Laws.

This DPA also supplements the Benevolve Customer Agreement, or other agreement in place between Customer and Benevolve covering Customer's use of Benevolve's Products and related Support and Services. Customer enters into this DPA on behalf of itself and in the name and on behalf of its Authorised Affiliates permitted to use the Products and related Support and Advisory Services under the Agreement. For the purposes of this DPA only, the term "Customer" includes Customer and such Authorised Affiliates.

4. Publication. Benevolve publishes the current version of this DPA at https://benevolve.com/dpa as a standalone document, separate from the Privacy Policy.

1. Definitions

The definitions in this Section apply throughout this DPA. References to the defined terms shall be interpreted to include their equivalent or analogous terms under applicable Data Protection Laws, including where different terminology is used in a particular jurisdiction. Where relevant, jurisdiction-specific equivalents and supplemental provisions are set out in Schedule 4.

2. Roles of the Parties and Scope of Processing

2.1 Roles. The parties acknowledge and agree that, in relation to the Processing of Customer Personal Data under this DPA, Customer acts as the Controller and Benevolve acts as the Processor (each as those terms (and their equivalent statutory roles) are defined under the applicable Data Protection Laws).

• Where Customer acts as a Processor on behalf of another third party Controller, Customer represents and warrants that it is authorised to appoint Benevolve as a sub-processor (or equivalent) and to provide the instructions for Processing set out in this DPA on behalf of such Controller.
• Benevolve will Process Personal Data only as a processor on Customer's behalf and not for its own independent commercial purposes, except as expressly permitted in this DPA or the Privacy Policy.

2.2 Details of Processing. The subject matter, duration, nature and purpose of Processing, and categories of Personal Data and Data Subjects, are described in Schedule 1 (Details of Processing). Because the Services are provided on a standardised, self-serve basis, Schedule 1 describes Processing activities generally for all Customers rather than being negotiated per account; Customer determines which categories of Customer Personal Data it actually submits or otherwise makes available through its use of the Services.

2.3 Customer Responsibilities. Customer is responsible for complying with its obligations under the applicable Data Protection Laws in connection with its Processing of Customer Personal Data and its use of the Services. Without limiting the foregoing, Customer is responsible for: (a) the accuracy, quality, and legality of Personal Data it submits and the means by which it acquired that data; (b) establishing a valid legal basis for Processing and providing all required notices to Data Subjects (including employees, job applicants, and other individuals whose data is uploaded); and (c) ensuring its use of the Services complies with applicable Data Protection Laws, consistent with Sections 5 and 7 of the Terms of Service. The Customer confirms it has established one or more lawful bases under the Data Protection Laws for each Processing activity. We will Process Customer Personal Data only on the Customer's documented legal basis.

2.4 Prohibition on Special/Sensitive Categories. Consistent with the Privacy Policy, Customer shall not submit Special Categories of Personal Data (e.g. health, biometric, genetic, racial or ethnic origin, religious belief, trade union membership, or sexual orientation data) to the Services, except for certain functionality of the Services, which Benevolve shall treat as 'Sensitive Personal Information' and protect with heightened safeguards as described in Schedule 1.

3. Processing on Customer's Instructions

3.1 When Benevolve Processes Customer Personal Data on behalf of Customer, Benevolve shall Process Personal Data only: (a) to provide, maintain, secure, and support the Services in accordance with the Agreement; (b) in accordance with Customer's documented instructions communicated through the Services' configuration, (as described in Section 3.2); and (c) as required by applicable law, in which case Benevolve will inform Customer of that legal requirement before Processing, unless the law prohibits such notice.

3.2 Because the Services are standardized and self-configured, Customer's use of the administrative settings, data fields, and integrations made available within the Services constitutes Customer's instructions for the purposes of this clause.

3.3 If Benevolve reasonably believes an instruction infringes applicable Data Protection Laws, it will promptly inform Customer, and may suspend performance of that instruction. Benevolve shall not be required to comply with any such instruction and shall not be obligated to undertake any independent assessment or investigation of the lawfulness of Customer's instructions beyond notifying Customer where it reasonably believes an infringement exists or until the parties agree on a resolution.

4. Confidentiality of Personnel

4.1 Benevolve ensures that persons authorised to Process Customer Personal Data (including employees, contractors, and approved service providers) are subject to a binding written confidentiality obligation, and Process Personal Data only on a need-to-know basis for the purposes of providing the Services.

5. Security of Processing

5.1 Benevolve implements and maintains appropriate technical and organisational measures designed to protect Customer Personal Data against unauthorised or unlawful Processing and against accidental loss, destruction, or damage, as summarised in Schedule 2 (Technical and Organisational Measures) and further described in Benevolve's security documentation at https://trust.benevolve.com/. Customer acknowledges that the Security Measures are subject to technical progress and development and that Benevolve may update or modify the Security Measures from time to time, provided that such updates and modifications do not materially decrease the overall security of the Services during the term of the Agreement.

5.2 Benevolve maintains SOC 2 Type II and ISO 27001 certifications (or equivalent) for the Services and will make current audit summaries or certificates available to Customer on request, subject to confidentiality restrictions.

5.3 Benevolve will notify Customer of any material adverse change to the measures in Schedule 2 that reduces the overall level of protection for Customer Personal Data.

5.4 Customer acknowledges that it is responsible for determining whether the technical and organisational measures implemented by Benevolve adequately satisfy Customer's obligations under the applicable Data Protection Laws, taking into account the nature of the Customer Personal Data and Customer's intended use of the Services. Customer is also responsible for its secure use of the Services, including maintaining the confidentiality of user credentials, managing user access permissions, protecting Customer Personal Data transmitted to and from the Services, and implementing appropriate backup, encryption, and other security measures within Customer's own systems and environment.

6. Sub-processors

6.1 General Authorisation. Customer provides Benevolve a general authorisation to engage Sub-processors to Process Personal Data in connection with providing the Services.

6.2 Current List. Benevolve maintains a current list of Sub-processors at https://trust.benevolve.com/ (the "Sub-processor List"), identifying each Sub-processor's name, purpose, and location of Processing. This List is published online and updated directly, rather than fixed as a static annex to this DPA, so that it remains accurate as Benevolve's vendor relationships evolve.

6.3 Notice and Objection. Benevolve will give Customer at least thirty (30) days' notice before engaging a new Sub-processor that will Process Customer's Personal Data, by updating the Sub-processor List and, where Customer has subscribed to notifications, by email. Customer may object on reasonable data-protection grounds by writing to [email protected] within that notice period. If the parties cannot resolve the objection in good faith within a further thirty (30) days, Customer's sole remedy is to terminate the Services to the extent they cannot be provided without the objected-to Sub-processor, without penalty.

7. International Data Transfers

7.1 Data Residency. Consistent with Section 7.4 of the Terms of Service, Customer Personal Data is stored in the AWS region corresponding to Customer's designated deployment region (India, Singapore (ap-southeast-1), or the United States). Benevolve does not relocate the primary storage location of Customer Personal Data without providing at least thirty (30) days' notice.

7.2 Cross-Border Access. Customer acknowledges that, in connection with providing the Services, Benevolve, its Affiliates, and its Sub-processors may Process Customer Personal Data in countries other than the country in which the Customer Personal Data was originally collected or is stored, including by permitting remote access to Customer Personal Data where necessary to provide, maintain, secure, or support the Services. Benevolve shall ensure that any such Processing is carried out in accordance with the applicable Data Protection Laws and subject to the transfer mechanisms described in this Section 7, where required.

7.3 Transfer Mechanism. Where the transfer of Customer Personal Data under this DPA requires a transfer mechanism under the applicable Data Protection Laws, the parties agree that such transfers shall be governed by the applicable transfer mechanism, including, where applicable, the Standard Contractual Clauses or any replacement or successor mechanism approved by the relevant competent authority. The applicable transfer mechanism is incorporated into, and forms part of, this DPA by reference. Where the Standard Contractual Clauses apply, they shall be deemed completed as necessary to reflect the parties' respective roles and the Processing activities contemplated by this DPA. For Customer Personal Data subject to the DPDP Act, Benevolve shall ensure that any cross-border transfer is carried out in accordance with the DPDP Act, including any restrictions, conditions, or requirements prescribed or notified by the Government of India from time to time.

7.4 Where a jurisdiction's Data Protection Laws require a specific transfer mechanism not otherwise addressed above, Benevolve will use the mechanism required by that law.

8. Assistance with Data Subject Rights

8.1 Taking into account the nature of Processing, Benevolve will provide reasonable technical and organisational assistance to help Customer respond to requests from Data Subjects exercising their rights (such as access, correction, erasure, restriction, objection and data portability) under applicable Data Protection Laws, including through self-service tools built into the Services where available.

8.2 If Benevolve receives a request directly from a Data Subject relating to Personal Data it Processes on Customer's behalf, Benevolve will not respond directly (other than to acknowledge receipt and direct the individual to Customer) unless legally required to do so, and will promptly notify or forward the request to Customer, to the extent permitted under applicable Data Protection Laws.

8.3 Benevolve may charge a reasonable fee for assistance requests that are manifestly unfounded, excessive, or repetitive, or that require material engineering effort outside the ordinary functionality of the Services.

8.4 Customer acknowledges that the Customer shall be responsible for responding to requests from Data Subjects relating to Customer Personal Data. Benevolve shall not respond to any such request except on Customer's documented instructions or as required by the applicable Data Protection Laws.

9. Return or Deletion of Personal Data

9.1 During the term of the Agreement, Benevolve will not retain Personal Data for any purpose other than providing the Services. Customer and its users may, through the features of the Services, access, retrieve or delete Personal Data.

9.2 Upon termination or expiry of the Agreement, Customer may export its Personal Data using the Services' self-service export tools for thirty (30) days following termination, consistent with Section 14.4 of the Terms of Service.

9.3 Following that thirty (30)-day export window, Benevolve will securely delete or anonymise remaining Customer Personal Data within ninety (90) days, unless retention is required by applicable Data Protection Laws or other applicable law, for legitimate backup/disaster-recovery purposes, or for the establishment, exercise, or defence of legal claims. Any Customer Personal Data retained pursuant to this Section shall remain subject to the confidentiality, security, and other applicable provisions of this DPA and shall be Processed only to the extent and for the duration required for the relevant retention purpose.

10. Personal Data Breach Notification

10.1 Benevolve will notify Customer without undue delay, and in any event within seventy-two (72) hours of becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data. Notification under this Section shall not be construed as an acknowledgement by Benevolve of any fault or liability with respect to the Personal Data Breach.

10.2 The notification will include, to the extent reasonably available to Benevolve at the time of notification: (a) the nature of the Personal Data Breach; (b) categories and approximate number of affected Data Subjects and Personal Data records; (c) likely consequences; and (d) measures taken or proposed to address the breach and mitigate its effects. Where full information is not available at the initial time of notification, Benevolve will provide it in phases without further undue delay.

10.3 Benevolve will take reasonable steps to contain, investigate, and remediate the Personal Data Breach, and, taking into account the nature of the Processing and the information available to Benevolve, will cooperate with Customer to provide reasonable assistance to enable Customer to comply with its obligations under the applicable Data Protection Laws in relation to the Personal Data Breach. Benevolve will not make public statements characterising the breach as attributable to Customer without Customer's prior review.

10.4 Where the Personal Data Breach is not attributable to Benevolve or its Sub-processors, the reasonable costs of any assistance requested by Customer under this Section may be charged to Customer.

10.5 Customer is solely responsible for determining whether to notify any supervisory authority, regulator, governmental authority, Data Subject, or other third party of a Personal Data Breach and for making any such notification, except where Benevolve is independently required to do so under the applicable Data Protection Laws.

11. AI and Automated Processing

11.1 The Services incorporate artificial intelligence and machine learning features ("AI Features") that process Customer Personal Data to generate skills, career, and other insights, as a part of the Services (as also described in Section 9 of the Terms of Service and Section 5 of the Privacy Policy). Benevolve does not use the AI Features to make solely automated decisions producing legal or similarly significant effects concerning Data Subjects and the Customer remains solely responsible for all decisions made in reliance on outputs generated by the AI Features, including ensuring appropriate human review where required under the applicable Data Protection Laws.

11.2 Benevolve will not use Customer Personal Data to train or improve underlying AI/ML models without Customer's authorisation. Benevolve may use de-identified and aggregated data derived from Customer Personal Data for model training, benchmarking, and Service improvement, subject to the restrictions in the Privacy Policy and this DPA.

11.3 On request, Benevolve will provide Customer with documentation describing the general logic, scope, and intended purpose of the AI Features that Process Personal Data, sufficient to allow Customer to meet its own transparency obligations to Data Subjects.

12. Audit Rights

12.1 Self-Serve Default. Given the standardised, multi-tenant nature of the Services, Benevolve satisfies audit obligations by making available, on request, its current SOC 2 Type II report, ISO 27001 certificate.

12.2 On-Site / Enhanced Audit. Only to the extent Customer cannot reasonably verify Benevolve's compliance with this DPA through the reports and certifications Benevolve makes available under the preceding sub-clause, or where Customer's Data Protection Laws require a further audit right, Customer may request a more detailed audit no more than once per twelve (12) months, on at least thirty (30) days' notice, conducted during business hours, subject to reasonable confidentiality restrictions, wherein Benevolve shall make available information reasonably necessary to demonstrate its compliance with this DPA and the applicable Data Protection Laws. Such information shall be limited to Benevolve's Processing of Customer Personal Data in its capacity as a Processor under this DPA and shall not extend to Benevolve's other business operations, systems, or confidential information unrelated to the Processing of Customer Personal Data. Benevolve may require Customer to reimburse reasonable costs of an on-site audit beyond the standard reporting described in 12.1.

12.3 Any information provided by Benevolve pursuant to this Section 12 constitutes Benevolve's Confidential Information and shall be used solely for the purpose of verifying Benevolve's compliance with this DPA. Customer shall not disclose such information to any third party except to its professional advisers or independent auditors who are bound by confidentiality obligations no less protective than those contained in the Agreement.

13. Liability

13.1 Each party's liability arising out of or in connection with this DPA, whether in contract, tort, or otherwise, shall be subject to the limitations and exclusions of liability set out in Section 12 of the Terms of Service, which are incorporated into this DPA by reference. For the avoidance of doubt, nothing in this DPA limits, expands, or otherwise modifies the allocation of liability set out in Section 12 of the Terms of Service, including Section 12.3 relating to data protection violations, breaches of Personal Data, and the unauthorised Processing or disclosure of Personal Data.

13.2 Nothing in this DPA limits either party's liability to the extent such liability cannot be limited or excluded as a matter of applicable Data Protection Laws.

14. Term and Termination

14.1 This DPA takes effect as described in the Preamble and remains in force for as long as Benevolve Processes Personal Data on Customer's behalf under the Agreement. It terminates automatically upon termination or expiry of the Agreement, subject to Section 12 (Return or Deletion) surviving termination.

14.2 Sections 4 (Confidentiality), 9 (Return or Deletion), 10 (Breach Notification, to the extent a breach occurred during the term), and 13 (Liability) survive termination of this DPA.

15. Governing Law and Dispute Resolution

15.1 This DPA is governed by the laws of the State of Washington, USA, and disputes are resolved in accordance with Section 15 of the Terms of Service (binding AAA arbitration in Seattle, Washington, subject to the injunctive-relief carve-out), except that where applicable Data Protection Laws mandate a different governing law or forum for data protection matters specifically (e.g. the Indian Data Protection Board for DPDP Act claims), that mandatory law and forum will govern those specific claims to the extent required.

16. Modifications to this DPA

16.1 Benevolve may update this DPA from time to time to reflect changes in Data Protection Laws, Sub-processors, or the Services, by posting the revised version at https://benevolve.com/dpa. For material changes, Benevolve will provide at least thirty (30) days' notice by email to Customer's account administrator or a prominent notice within the Services, consistent with Section 16 of the Terms of Service. Continued use of the Services after the effective date of a revised DPA constitutes acceptance.

17. Miscellaneous

17.1 Entire Agreement. This DPA, together with the Agreement and the Privacy Policy, constitutes the entire agreement between the parties regarding the Processing of Personal Data, and supersedes the parties' prior data processing terms, if any.

17.2 Severability. If any provision of this DPA is held invalid or unenforceable, the remainder of this DPA remains in full force, and the invalid provision will be replaced with a valid provision that most closely reflects the parties' original intent.

17.3 No Third-Party Beneficiaries. Except as required by applicable Data Protection Laws, this DPA does not confer any rights on any third party.

17.4 Order of Precedence. In the event of a conflict between the body of this DPA and any Schedule, the body of this DPA prevails.

Schedule 1: Details of Processing

Schedule 2: Technical and Organisational Measures

Full details are maintained at https://trust.benevolve.com/ and updated as Benevolve's security program evolves; material reductions in protection will be notified per Section 5.3.

Schedule 3: International Transfer Mechanism

This Schedule forms part of, and shall be read together with, Section 7 (International Data Transfers) of this DPA. Where a restricted transfer under EU/UK Data Protection Laws occurs, the parties incorporate the following by reference:

• Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (Controller to Processor), with Customer as data exporter and Benevolve as data importer;
• The UK International Data Transfer Addendum to the EU SCCs, issued by the UK ICO, for transfers subject to UK GDPR;
• Annex I and Annex II details for the SCCs are as set out in Schedule 1 and Schedule 2 of this DPA respectively.

Benevolve will complete and publish this module before onboarding any EU/UK customer under this self-serve DPA.

Schedule 4: Jurisdiction-Specific Terms

4.1 India — Digital Personal Data Protection Act, 2023

• Where Customer notifies Benevolve that a Data Principal has withdrawn consent or otherwise exercised a right under the DPDP Act requiring the cessation or restriction of Processing, Benevolve shall, to the extent applicable to its role as a Data Processor, comply with Customer's documented instructions regarding the relevant Customer Personal Data.
• Where the Government of India notifies any restriction or prohibition on the transfer of personal data to a country or territory under the DPDP Act, Benevolve shall comply with such restriction or prohibition in relation to Customer Personal Data, to the extent applicable to its Processing activities under this DPA.
• Benevolve will not undertake tracking, behavioural monitoring of children, or targeted advertising directed at children.

4.3 Singapore — Personal Data Protection Act 2012

• For Singapore-based Customers, Personal Data is stored on servers located in Singapore (AWS ap-southeast-1), consistent with Section 7.1.
• Benevolve will notify Customer of a Personal Data Breach without undue delay to support Customer's own notifiable-breach assessment and reporting to the PDPC within the statutory timeframe.

4.4 United States — State Privacy Laws (CCPA and similar)

• Benevolve shall not provide Customer with monetary or other valuable consideration in exchange for Customer Personal Data. The parties acknowledge and agree that Customer has not "sold" Customer Personal Data to Benevolve, as such term is defined under the applicable U.S. state privacy laws.
• Benevolve shall not "sell" or "share" Customer Personal Data, or engage in any equivalent restricted Processing under the applicable U.S. state privacy laws.
• Benevolve shall not retain, use, disclose, or otherwise Process Customer Personal Data except as necessary to provide the Services, for the business purposes specified in the Agreement and this DPA, or as otherwise permitted by the applicable U.S. state privacy laws. Benevolve shall not Process Customer Personal Data outside the direct business relationship between Benevolve and Customer.
• Benevolve shall not combine Customer Personal Data with personal information received from another person or collected from its own interactions with individuals, except where permitted by the applicable U.S. state privacy laws or on Customer's documented instructions.
• If Benevolve determines that it can no longer meet its obligations under the applicable U.S. state privacy laws, it shall notify Customer without undue delay. Upon receiving such notice, the parties shall work together in good faith to remedy the issue. If the issue cannot reasonably be remedied, Benevolve shall, upon Customer's written instruction, cease Processing the affected Customer Personal Data.

Contact Information

For inquiries regarding this DPA, please contact: