Data Processing Agreement

Capitalized terms not defined in this DPA have the meanings given in the Terms. In this DPA:

• "Data Protection Laws" means all laws applicable to the processing of Personal Data under the Terms, including Regulation (EU) 2016/679 ("GDPR"), the GDPR as retained in UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act ("CCPA"), in each case as amended.
• "Customer Personal Data" means Personal Data contained in Customer Content that Crosscheck processes on behalf of Customer in providing the Service.
• "Personal Data", "Processing", "Controller", "Processor", "Data Subject" and "Supervisory Authority" have the meanings given in the GDPR. "Business", "Service Provider" and "Sell"/"Share" have the meanings given in the CCPA.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by Crosscheck or its Subprocessors.
• "Subprocessor" means any third party engaged by Crosscheck to process Customer Personal Data.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914, and "UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner.

This DPA applies to Crosscheck's processing of Customer Personal Data in providing the Service. As between the parties, Customer is the Controller (or a Processor acting on behalf of its own Controller) and Crosscheck is a Processor (or Subprocessor). Where the CCPA applies, Customer is the Business and Crosscheck is the Service Provider.

This DPA does not apply to Personal Data that Crosscheck processes as an independent Controller, such as account administration, billing, security logging and marketing communications. That processing is described in our Privacy Policy.

The subject matter, duration, nature and purpose of the processing, and the types of Personal Data and categories of Data Subjects, are described in Annex 1.

Customer is responsible for the lawfulness of the Customer Personal Data it provides and of its instructions to Crosscheck. Customer confirms that it has a lawful basis for the processing and has provided any notices and obtained any consents required by Data Protection Laws. Customer will not upload special categories of Personal Data or data relating to criminal convictions unless this is necessary for the audit work it performs through the Service and permitted by Data Protection Laws.

4.1 Processing on Instructions

Crosscheck will process Customer Personal Data only on Customer's documented instructions, unless required to do otherwise by applicable law, in which case Crosscheck will inform Customer of that legal requirement before processing unless the law prohibits it. The Terms, this DPA and Customer's configuration and use of the Service are Customer's complete instructions. Crosscheck will inform Customer if, in its opinion, an instruction infringes Data Protection Laws.

4.2 No Model Training or Sale

Crosscheck will not use Customer Personal Data to train general-purpose AI models, and will engage AI providers only under terms that prohibit them from training on Customer Personal Data. Crosscheck will not Sell or Share Customer Personal Data, will not retain, use or disclose it for any purpose other than providing the Service, and will not combine it with Personal Data from other sources except as permitted by Data Protection Laws.

4.3 Confidentiality

Crosscheck will ensure that personnel authorized to process Customer Personal Data are bound by appropriate obligations of confidentiality and access it only as needed to provide the Service.

4.4 Security

Crosscheck will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing. These measures are described in Annex 2. Crosscheck may update them from time to time, provided the overall level of protection is not materially reduced.

Customer gives general authorization for Crosscheck to engage Subprocessors. The current list is set out in Annex 3. Crosscheck will impose data protection obligations on each Subprocessor that are no less protective than those in this DPA, and remains responsible for each Subprocessor's performance of those obligations.

Crosscheck will update Annex 3 at least 30 days before a new Subprocessor begins processing Customer Personal Data, and will also notify by email any Customer that has asked to receive these updates by writing to privacy@crossxcheck.com. Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith; if it cannot be resolved, Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for the remaining term.

Taking into account the nature of the processing, Crosscheck will provide reasonable assistance to Customer in responding to requests from Data Subjects to exercise their rights under Data Protection Laws. If Crosscheck receives such a request directly, it will forward it to Customer without undue delay and will not respond except to direct the Data Subject to Customer, unless required by law.

Crosscheck will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Crosscheck will take reasonable steps to contain and remediate the breach and will provide updates as more information becomes available. Notification is not an acknowledgment of fault or liability.

Crosscheck will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with Supervisory Authorities, to the extent required by Data Protection Laws and relating to Crosscheck's processing of Customer Personal Data. Crosscheck will maintain records of its processing activities as required by Data Protection Laws.

Crosscheck will make available to Customer, on request, the information reasonably necessary to demonstrate compliance with this DPA, including summaries of relevant third-party security reports and certifications where available. If that information is not sufficient to meet Customer's obligations under Data Protection Laws, or a Supervisory Authority requires it, Customer may conduct an audit, at its own cost, no more than once in any 12-month period, on at least 30 days' written notice, during normal business hours, subject to reasonable confidentiality and security conditions, and in a manner that does not disrupt the Service or compromise other customers' data.

Crosscheck may process Customer Personal Data in the United States, the European Union and other countries where Crosscheck or its Subprocessors operate. Where available, Customer Personal Data is stored in the region associated with Customer's account.

Where Customer Personal Data originating in the European Economic Area is transferred to a country that has not been found to provide an adequate level of protection, the parties agree that the SCCs are incorporated into this DPA by reference and apply as follows: Module 2 (controller to processor) where Customer is a Controller, and Module 3 (processor to processor) where Customer is a Processor; Clause 7 (docking clause) applies; under Clause 9, Option 2 (general authorization) applies with the notice period in Section 5; the optional language in Clause 11 does not apply; under Clauses 17 and 18, the law and courts of Ireland apply; and Annexes I to III of the SCCs are completed by Annexes 1 to 3 of this DPA. Where Crosscheck is certified under the EU-US Data Privacy Framework, it may rely on that framework instead.

For transfers subject to the UK GDPR, the UK Addendum applies, completed with the information in this DPA, and either party may end it as permitted by its Section 19. For transfers subject to Swiss law, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection and the competent supervisory authority being the Swiss Federal Data Protection and Information Commissioner.

If there is a conflict between this DPA and the SCCs or UK Addendum, the SCCs or UK Addendum prevail.

During the term, Customer may export or delete Customer Content through the Service. Within 30 days after termination of the Terms, Crosscheck will delete Customer Personal Data, unless Customer requests its return before then or applicable law requires further storage. Data held in backups will be deleted in the ordinary course of backup rotation, and will remain protected by this DPA until deleted.

Each party's liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability in the Terms, except where such limitations are not permitted by Data Protection Laws or the SCCs.

This DPA remains in effect for as long as Crosscheck processes Customer Personal Data under the Terms. If there is a conflict between this DPA and the Terms regarding the processing of Customer Personal Data, this DPA prevails.

Crosscheck may update this DPA to reflect changes in Data Protection Laws, Subprocessors or the Service. Crosscheck will post the updated DPA on this page and update the "Last updated" date. Material changes that reduce the protection of Customer Personal Data will be notified to Customer at least 30 days in advance and will not apply to Customer if it objects and terminates the affected Service within that period.

• Parties: Customer (data exporter; Controller or Processor) and Crosscheck Technologies Inc. (data importer; Processor). Contact details are those associated with Customer's account and privacy@crossxcheck.com for Crosscheck.
• Subject matter and duration: Provision of the Service for the term of the Terms and the deletion period in Section 11.
• Nature and purpose: Hosting, storage, transmission, AI-assisted analysis, extraction and organization of certification, audit, supply chain and sustainability records; report generation; collaboration between Customer users and invited external participants; and support.
• Frequency of transfer: Continuous, for as long as Customer uses the Service.
• Categories of Data Subjects: Customer's authorized users; Customer's clients, suppliers, farmers, producers and their staff; auditors and reviewers; and other individuals whose Personal Data appears in documents uploaded to the Service.
• Types of Personal Data: Names, business contact details, job titles and roles, signatures, identifiers and location data in certification and supply chain records (such as farm or site locations), user activity and audit logs, and any other Personal Data contained in Customer Content.
• Special categories: None intended. Customer should not upload special categories of Personal Data except as described in Section 3.
• Retention: For the term of the Terms, then as described in Section 11.
• Competent supervisory authority: The supervisory authority determined in accordance with Clause 13 of the SCCs.

• Encryption: Customer Content is encrypted at rest using AES-256 and in transit using TLS.
• Tenant isolation: Each customer environment is logically isolated, with access enforced by organization- and role-based authorization checks.
• Access control: Administrative access requires multi-factor authentication and follows least privilege. Access is granted only to personnel who need it.
• Secure file handling: Files are uploaded and downloaded through short-lived signed URLs.
• Logging and monitoring: Security-relevant events and AI-assisted steps are logged; production errors are monitored and alerted.
• AI safeguards: AI providers are engaged under enterprise terms that prohibit training on Customer Content and limit retention to what processing requires. AI output is reviewed by people and cannot make certification decisions.
• Availability and resilience: Managed infrastructure with automated backups and recovery procedures.
• Secure development: Code review, automated testing and dependency management before changes reach production.
• Personnel: Confidentiality obligations and security awareness for all personnel with access to Customer Personal Data.
• Incident response: Documented procedures to detect, contain, investigate and notify Personal Data Breaches as described in Section 7.

Crosscheck engages the following Subprocessors to provide the Service:

Questions about this DPA or requests for a countersigned copy can be sent to us at the address below. Contract questions can also go to legal@crossxcheck.com.

privacy@crossxcheck.com
Crosscheck Technologies Inc.