Data Processing Addendum

In2ition AI, Inc.

Version: 2026-10-26

This Data Processing Addendum (the “DPA”) forms part of the Master Services Agreement between In2ition AI, Inc. (“Provider”) and the customer named in the Order Form (“Customer”) (the “Agreement”). Capitalized terms not defined here have the meanings in the Agreement. For the processing of Customer Personal Data, this DPA controls over the rest of the Agreement, except for the Special Terms of an Order Form.

1. Definitions

1.1 “Customer Personal Data” means personal data contained in Customer Data that Provider processes on Customer’s behalf in providing the Services.

1.2 “Data Protection Laws” means all data protection and privacy laws that apply to the processing of Customer Personal Data under the Agreement, including US state consumer privacy laws.

1.3 “personal data”, “processing”, “controller”, “processor”, “business”, “service provider”, and “data subject” have the meanings given in the applicable Data Protection Laws, and “personal data” includes “personal information”.

1.4 “Security Incident” has the meaning in the Agreement.

2. Roles and Scope

2.1 Roles. Customer is the controller (or business) of Customer Personal Data. Provider is a processor (or service provider) that processes Customer Personal Data on Customer’s behalf. Where Customer acts as a processor for another controller, Provider is Customer’s subprocessor, and Customer is responsible for obtaining that controller’s authorizations.

2.2 Details. Annex 1 describes the processing.

2.3 Instructions. Provider processes Customer Personal Data only on Customer’s documented instructions. The Agreement, the Order Form, and Customer’s configuration and use of the Services are Customer’s complete instructions. Additional instructions require written agreement. Provider will tell Customer if Provider believes an instruction violates Data Protection Laws. Provider may process Customer Personal Data as otherwise required by law, after informing Customer where the law allows.

2.4 Permitted uses. Provider may also use Customer Data as permitted in Sections 5.2 to 5.4 of the Agreement, including to create Aggregated Data. Provider will not attempt to re-identify Aggregated Data and will require recipients of Aggregated Data not to do so.

2.5 Customer obligations. Customer is responsible for the lawfulness of Customer Personal Data and of its instructions, including having a lawful basis, obtaining all consents, and giving all notices required by Data Protection Laws and by the laws described in Sections 4.2 and 4.3 of the Agreement.

3. US State Privacy Law Terms

To the extent a US state privacy law applies to Customer Personal Data, Provider will: (a) not sell or share Customer Personal Data, as those terms are defined in that law; (b) not retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer or for any purpose other than the business purposes in the Agreement, except as that law allows; (c) not combine Customer Personal Data with personal data it receives from other sources, except as that law allows; (d) comply with the obligations of that law that apply to service providers and provide the same level of privacy protection the law requires; and (e) notify Customer if it determines it can no longer meet its obligations under that law. Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data after notice to Provider.

4. Personnel

Provider ensures that personnel authorized to process Customer Personal Data are bound by obligations of confidentiality.

5. Security

Provider implements and maintains the technical and organizational measures described in the Security Exhibit to the Agreement. Provider may change how it implements those measures, but will not materially reduce the overall protection of Customer Personal Data during a paid term.

6. Subprocessors

6.1 Authorization. Customer gives Provider general authorization to engage subprocessors. The subprocessors on Provider’s current list are authorized. Provider makes the list available to Customer on request. The list is Provider’s Confidential Information.

6.2 Obligations. Provider binds each subprocessor by written terms that require it to protect Customer Personal Data in a manner appropriate to its services. Provider remains responsible for its subprocessors’ performance of Provider’s obligations under this DPA.

6.3 Notice of new subprocessors. Provider will notify Customer of a new subprocessor by email to Customer’s notice contact, or to another address Customer gives Provider for subprocessor notices, before the new subprocessor processes Customer Personal Data. If an urgent change is needed to protect the security or continuity of the Services, Provider may give notice promptly after the change.

6.4 Objection. Customer may object to a new subprocessor on reasonable data-protection grounds by written notice to legal@in2ition.ai within 15 days after Provider’s notice. The parties will discuss the objection in good faith. If they cannot resolve it within a reasonable time, Customer may terminate the affected Services by written notice, and Provider will refund prepaid fees for the unused part of the term for those Services. This is Customer’s sole and exclusive remedy for the objection. If Customer does not object in time, the new subprocessor is authorized.

7. Security Incidents

7.1 Notice. Provider will notify Customer without undue delay after Provider confirms a Security Incident.

7.2 Information. Provider will provide information about the Security Incident as it becomes known, which may be in phases, to help Customer meet its own obligations. This may include the nature of the Security Incident, the categories of data involved, and the steps Provider is taking.

7.3 Response. Provider will take reasonable steps to contain, investigate, and mitigate the Security Incident.

7.4 No admission. Notice of, or response to, a Security Incident is not an admission of fault or liability.

7.5 Notices to others. Unless the law requires Provider to give notice itself, Customer decides whether to notify data subjects, regulators, or others about a Security Incident. Provider will not name Customer in a public statement about a Security Incident without Customer’s consent, unless required by law.

8. Assistance

8.1 Data subject requests. If Provider receives a request from a data subject about Customer Personal Data, Provider will refer the data subject to Customer and will not respond except to do so, unless the law requires otherwise. Taking into account the nature of the processing, Provider will give Customer reasonable assistance in responding to data subject requests, to the extent Customer cannot respond using the features of the Services.

8.2 Assessments. Provider will give Customer reasonable information that Customer needs to complete a data protection impact assessment or a consultation with a regulator required by Data Protection Laws, to the extent Customer does not otherwise have access to it.

8.3 Government requests. If Provider receives a legally binding request from a government authority for Customer Personal Data, Provider will notify Customer before disclosing, where the law allows, so that Customer may seek protection.

8.4 Cost. Provider may charge reasonable fees for assistance beyond what the Services and this DPA ordinarily provide.

9. Audits

9.1 Reports. On Customer’s written request, and subject to the confidentiality terms of the Agreement, Provider will make available its most recent independent audit report and reasonable written answers to Customer’s security questionnaire, not more than once in any 12-month period, unless a Security Incident or a regulator requires more.

9.2 Other audits. If Data Protection Laws or a regulator require Customer to conduct an audit beyond Section 9.1, the parties will agree in advance on its scope, timing, duration, and confidentiality. Customer bears its costs and Provider’s reasonable costs of such an audit.

10. Return and Deletion

Return and deletion of Customer Personal Data on termination follow Section 8.5 of the Agreement.

11. Location and Transfers

Provider processes Customer Personal Data in the United States. Before Customer submits personal data whose transfer to the United States requires a transfer mechanism under Data Protection Laws, Customer will notify Provider, and the parties will agree in writing on the applicable transfer terms.

12. Liability

Each party’s liability arising from this DPA is subject to the limitations and exclusions of liability in the Agreement.

Annex 1: Details of Processing

Subject matter and duration	Provision of the Services for the term of the Agreement and the return and deletion period in Section 8.5 of the Agreement.
Nature and purpose	Hosting, recording, transcribing, analyzing, scoring, and summarizing calls and sessions; operating AI voice agents; sending calls, messages, and invitations; reporting; support; security; and the other uses permitted by the Agreement.
Data subjects	Customer’s Authorized Users; Call Recipients, including Customer’s customers, prospects, job candidates, employees, and former employees; other individuals whose data Customer submits.
Categories of personal data	Contact details (such as name, phone number, email address); employment and candidate information Customer submits; call and session audio, recordings, and transcripts; Outputs about individuals, such as scores, summaries, and notes; account and usage information of Authorized Users.
Sensitive data	None intended. Customer must not submit the restricted data described in the Agreement and the Acceptable Use Policy unless the parties have signed a separate agreement covering it. Call content may incidentally include sensitive data that Call Recipients choose to disclose.
Frequency	Continuous, for the term of the Agreement.