Data Protection Addendum

Last Updated: May 20, 2026

This Data Protection Addendum ("DPA") forms part of the Terms of Service ("Agreement") between Customer (as defined in the Agreement or "Controller") and Helms Deep AI LLC ("Processor") under which the Processor provides the Controller with the software and services pursuant to the terms of the Agreement (the "Services"). Controller and Processor are individually referred to as a "Party" and collectively as the "Parties." This DPA is supplemental to the Agreement and applies to Processor's processing of Personal Data provided by Controller as part of Processor's obligations under the Agreement. Except as modified below, the terms of the Agreement shall remain in full force and effect.

1. Definitions

Terms not otherwise defined herein shall have the meaning given to them in the Applicable Data Protection Law or the Agreement. The following terms shall have the corresponding meanings assigned to them below:

1. "Applicable Data Protection Law" means all data protection and privacy laws and regulations applicable to the provision of the Services generally including, without limitation, the EU GDPR and applicable data protection laws in effect in the United States.
2. "Data Transfer" means a transfer of the Personal Data from Controller to Processor, or between two establishments of Processor, or with a Sub-processor by Processor.
3. "EU GDPR" means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
4. "Standard Contractual Clauses" means the contractual clauses implemented pursuant to the European Commission's Implementing Decision (EU) 2021/914 of 4 June 2021 on Standard Contractual Clauses for the transfer of Personal Data to processors established in third countries which do not ensure an adequate level of data protection, as amended by the UK Addendum where applicable.
5. "Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.
6. "Processor" means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the controller.
7. "Sub-processor" means a processor / sub-contractor appointed by Processor for the provision of all or parts of the Services and Processes the Personal Data as provided by Controller.

2. Purpose of this Agreement

This DPA sets out various obligations of Processor in relation to the Processing of Personal Data and shall be limited to Processor's obligations under the Agreement. If there is a conflict between the provisions of the Agreement and this DPA, the provisions of this DPA shall prevail with respect to the subject matter herein.

3. Categories of Personal Data and Data Subjects

Controller authorizes permission to Processor to process the Personal Data to the extent of which is determined and regulated by Controller. The current nature of the Personal Data is specified in Annex I to Schedule 1 to this DPA.

4. Purpose of Processing

The objective of Processing of Personal Data by Processor shall be set forth in the Agreement.

5. Duration of Processing

Processor will Process Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing by Controller.

6. Data Controller's Obligations

1. Controller warrants that it has all necessary rights to provide the Personal Data to Processor for the Processing to be performed in relation to the agreed services. To the extent required by Applicable Data Protection Law, Controller is responsible for ensuring that it provides Personal Data to Processor based on an appropriate legal basis allowing lawful processing activities, including any necessary Data Subject consents to this Processing are obtained, and for ensuring that a record of such consents is maintained. Should such consent be revoked by the Data Subject, Controller is responsible for communicating the fact of such revocation to Processor.
2. Controller shall provide all natural persons from whom it collects Personal Data with the relevant privacy notice.
3. Controller shall request Processor to purge Personal Data when required by Controller or any Data Subject from whom it collects Personal Data unless Processor is otherwise required to retain the Personal Data by applicable law.
4. Controller shall immediately advise Processor in writing if it receives or learns of any: complaint or allegation indicating a violation of Applicable Data Protection Law regarding Personal Data; request from one or more individuals seeking to access, correct, or delete Personal Data; inquiry or complaint from one or more individuals relating to the collection, processing, use, or transfer of Personal Data; and regulatory request, search warrant, or other legal, regulatory, administrative, or governmental process seeking Personal Data.

7. Processor's Obligations

1. Processor will follow written and documented instructions received, including email, from Controller's duly authorized representatives with respect to the Processing of Personal Data (each, an "Instruction"). The Processing described in the Agreement and the relating documentation shall be deemed to be Instruction from the Controller.
2. At Controller's request, Processor will provide reasonable assistance to Controller in responding to and complying with requests and directions from Data Subject in exercising their rights or of the applicable regulatory authorities regarding Processor's Processing of Personal Data.
3. Where Personal Data is transferred outside Processor's territorial boundaries, Processor shall ensure that the recipient of such data is under contractual obligations to protect such Personal Data to the same or higher standards as those imposed under this DPA and the Applicable Data Protection Law.
4. Processor shall inform Controller if, in its opinion, a processing instruction infringes applicable legislation or regulation.
5. Processor shall not sell Personal Data as the term "sell" is defined by the CCPA. Processor shall not disclose or transfer Personal Data to a Sub-processor or other parties that would constitute "selling" as the term is defined by the CCPA.

8. Confidentiality

1. Processor will protect Personal Data in accordance with its confidentiality obligations as set forth in the Agreement.
2. Processor will ensure personnel who Process Personal Data either enter into written confidentiality agreements or are subject to statutory obligations of confidentiality.

9. Audit Rights

1. Upon Controller's reasonable request, Processor will make available to Controller, information as is reasonably necessary to demonstrate Processor's compliance with its obligations under the EU GDPR or other applicable laws in respect of its Processing of the Personal Data. All such information provided to Controller and any results of an audit shall be Processor's Confidential Information. Processor reserves the right to redact any information from the review that is not applicable to this DPA or if disclosure would breach confidentiality obligations Processor may have to customers, other partners, or any other third parties.
2. When Controller wishes to conduct the audit (by itself or through a representative) at Processor's site, it shall provide at least ninety (90) days' prior written notice to Processor; such audits shall be limited to no more than once per calendar year unless required by a supervisory authority or in connection with a confirmed Personal Data Breach. Processor will provide reasonable cooperation and assistance in relation to audits, including inspections, conducted by Controller or its representative. Controller shall bear the expense of such an audit.

10. Mechanism of Data Transfers

Any Data Transfer for the purpose of Processing by the Processor in a country outside the European Economic Area (the "EEA") shall only take place in compliance as detailed in Schedule 1 to this DPA. Where such model clauses have not been executed at the same time as this DPA, Processor shall not unduly withhold the execution of such template model clauses, where the transfer of Personal Data outside of the EEA is required for the performance of the Agreement.

11. Sub-processors

1. Controller acknowledges and agrees that Processor may engage third-party Sub-processor(s) in connection with the performance of the Services, provided such Sub-processor(s) are bound by written data protection obligations equivalent to those imposed on Processor under this DPA. The current Sub-processors engaged by the Processors and approved by Controller are listed in Annex III of Schedule 1 hereto. In accordance with Article 28(4) of the GDPR, Processor shall remain liable to Controller for any failure on behalf of a Sub-processor to fulfil its data protection obligations under the DPA in connection with the performance of the Services.
2. If Controller has a concern that the Processing of Personal Data by Sub-processor(s) is reasonably likely to cause Controller to breach its data protection obligations under the GDPR, Controller may object to Processor's use of such Sub-processor and Processor and Controller shall confer in good faith to address such concern.

12. Personal Data Breach Notification

1. Processor shall maintain defined procedures in case of a Personal Data Breach (as defined under the GDPR) and shall without undue delay notify Controller if it becomes aware of any Personal Data Breach unless such Data Breach is unlikely to result in a risk to the rights and freedoms of natural persons.
2. Processor shall provide Controller with all reasonable assistance to comply with the notification of Personal Data Breach to Supervisory Authority and/or the Data Subject, to identify the cause of such Data Breach and take such commercially reasonable steps as reasonably required to mitigate and remedy such Data Breach. Processor's notification of or response to a Personal Data Breach under this DPA will not be construed as an acknowledgement by Processor of any fault or liability with respect to the data incident.

13. Return and Deletion of Personal Data

1. Within thirty (30) days from the end of the Agreement or cessation of Processor's Services under the Agreement, whichever occurs earlier, Processor shall return to the Controller all the Personal Data, or if the Controller so instructs, the Processor shall have the Personal Data deleted, except to the extent that Processor is required to retain any Personal Data by applicable law or as part of routine backups, in which case Processor shall notify Controller of any such retention and shall not Process retained Personal Data for any other purpose. The Processor shall return such Personal Data in a commonly used format or in the current format in which it was stored at discretion of the Controller, as soon as reasonably practicable following receipt of Controller's notification.
2. In any case, following the return or deletion of Personal Data pursuant to Section 13.1, the Processor shall delete any remaining copies of Personal Data in its possession as soon as reasonably practicable, and in any event within thirty (30) days following the end of the Agreement.

14. Technical and Organizational Measures

Having regard to the state of technological development and the cost of implementing any measures, Processor will take appropriate technical and organizational measures against the unauthorized or unlawful processing of Personal Data and against the accidental loss or destruction of, or damage to, Personal Data to ensure a level of security appropriate to: (a) the harm that might result from unauthorized or unlawful processing or accidental loss, destruction or damage; and (b) the nature of the data to be protected including the measures stated in Annex II of Schedule 1.

15. Cross-border Transfer of Personal Data Outside EEA

Processor may transfer or otherwise process Personal Data outside the European Economic Area ("EEA") without obtaining the Controller's prior written consent.

1. Processor may only process, or permit the processing, of Personal Data outside the EEA, provided Processor is processing Personal Data in a territory in relation to which the European Commission has made an adequacy decision or the Parties have executed Standard Contractual Clauses.
2. If the transfer from Controller to Processor/Processor to Processor requires execution of Standard Contractual Clauses, the unchanged version of the Standard Contractual Clauses shall be deemed incorporated by reference hereto and completed as follows:
   1. Module Two or Module Three will apply (as applicable).
   2. Clause 7: The optional docking clause will apply.
   3. Clause 11: The optional language will not apply.
3. Annex I of the SCC shall be deemed completed with the information set out in Annex I to this DPA.

Schedule 1

Annex I

A. List of Parties

Data exporter(s):

• Name: Customer (as set forth in the relevant Order Form)
• Address: As set forth in the relevant Order Form
• Contact: As set forth in the relevant Order Form
• Activities: Recipient of the Services provided by Helms Deep AI LLC in accordance with the Agreement
• Role: Controller

Data importer(s):

• Name: Helms Deep AI LLC
• Address: 330 E Liberty St, Ann Arbor, MI 48104, USA
• Contact: Michael Koenig, Chief Executive Officer, privacy@helmapp.ai
• Activities: Provision of the Services to the Customer in accordance with the Agreement
• Role: Processor

B. Description of Transfer

• Categories of data subjects:
  Customer's authorized users of the Services and other natural persons whose Personal Information Customer chooses to input into the Services.
• Categories of Personal Data:
  Name, email address, profile and authentication data, organizational role, content submitted to the Services (including objectives, key results, milestones, comments, and status updates), integration data from connected systems (e.g., Slack messages, calendar entries) where Customer has enabled such integrations, and technical data automatically collected during use of the Services (including IP address, device and browser identifiers, session timestamps, and application logs).
• Sensitive data:
  Processor does not require, request, or intentionally process sensitive data or special categories of personal data. Customer is responsible for ensuring that Personal Data submitted to the Services does not include such categories unless the Parties have agreed in writing on appropriate additional safeguards.
• Frequency: Continuous basis
• Nature of processing:
  The data importer's Processing activities shall be limited to those discussed in the Agreement and the DPA.
• Purpose:
  The purpose of the transfer is to facilitate the performance of the Services more fully described in the Agreement and accompanying order forms.
• Retention period:
  The period for which the Personal Data will be retained is more fully described in the Agreement and accompanying order forms.
• Sub-processor transfers:
  The subject matter, nature, and duration of the Processing more fully described in the Agreement and accompanying order forms.

C. Competent Supervisory Authority

The competent supervisory authority is as determined by application of Clause 13 of the EU SCCs.

Annex II — Technical and Organizational Measures

Description of the technical and organisational security measures implemented by Helms Deep AI LLC as the data processor/data importer to ensure an appropriate level of security, taking into account the nature, scope, context, and purpose of the processing, and the risks for the rights and freedoms of natural persons.

1. Encryption. All Personal Data is encrypted at rest using AES-256 (database) and encrypted in transit using TLS 1.2 or higher across all customer-facing and inter-service connections.
2. Network security. Customer-facing endpoints sit behind Cloudflare's Web Application Firewall and DDoS protection. Application infrastructure is hosted on Railway, with managed network isolation between services.
3. Logging and monitoring. Application errors and operational events are logged via Sentry. Authentication and database access events are logged via Supabase. Logs are retained for at least thirty (30) days.
4. Backup and recovery. Database backups are performed daily by the underlying hosting provider and retained according to the provider's standard retention schedule.
5. Personnel security. All personnel with access to Personal Data are subject to written confidentiality obligations. Access is provisioned on a least-privilege basis and revoked promptly upon role change or termination.
6. Sub-processor management. Sub-processors are subject to written data protection obligations equivalent to those imposed under this DPA, and their use of Personal Data is reviewed periodically.
7. Incident response. A documented incident response procedure governs identification, containment, investigation, and notification of Personal Data Breaches in accordance with this DPA.
8. Vulnerability management. Underlying infrastructure providers (Railway, Supabase, Cloudflare) maintain ongoing patching and vulnerability management for the platforms they operate. Application-layer dependencies are monitored for known vulnerabilities.

Annex III — List of Sub-processors