Data Processing Addendum

This Data Processing Addendum (this "DPA") is incorporated into and forms part of the Julia Terms of Service or other written or electronic agreement between Julia AI Inc., a Delaware corporation ("Julia AI"), and the customer entity that has agreed to such terms ("Customer") governing Customer's access to and use of Julia and related services (the "Agreement" and, together with the services described therein, the "Services"). This DPA governs Julia AI's Processing of Customer Personal Data on Customer's behalf. In the event of any conflict between this DPA and the Agreement with respect to the subject matter of this DPA, this DPA controls (see Section 15). Questions regarding this DPA may be directed to info@onjulia.com.

1. Definitions

1.1 "Customer Data" means all data, content, and information submitted to or collected by the Services by or on behalf of Customer or its Authorized Users, including data about Customer's clients, leads, contacts, and communication recipients. Customer Data corresponds to the data described as "Customer Platform Data" in the Julia Privacy Policy.

1.2 "Customer Personal Data" means any Personal Data contained within Customer Data that Julia AI Processes on behalf of Customer in the course of providing the Services.

1.3 "Data Protection Laws" means all laws and regulations applicable to the Processing of Customer Personal Data under the Agreement, including, to the extent applicable: (a) the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations ("CCPA"); (b) the Virginia Consumer Data Protection Act; (c) the Colorado Privacy Act; (d) the Texas Data Privacy and Security Act; (e) the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Maryland Online Data Privacy Act, the Minnesota Consumer Data Privacy Act, and other United States federal and state privacy and data-security laws now or hereafter in effect; (f) where applicable, Regulation (EU) 2016/679 (the "GDPR") and the GDPR as incorporated into the law of the United Kingdom (the "UK GDPR"); and (g) in each case, any successor or implementing legislation, amendments, and binding regulatory guidance.

1.4 "Personal Data" means any information relating to an identified or identifiable natural person or household, or that is otherwise defined as "personal data," "personal information," or a similar term under Data Protection Laws.

1.5 "Consumer" and "Data Subject" each mean the identified or identifiable natural person to whom Customer Personal Data relates, as those or equivalent terms are defined under applicable Data Protection Laws.

1.6 "Controller," "Business," "Processor," "Service Provider," "Processing" (and "Process"), "Sell," and "Share" have the meanings given to them (or their nearest equivalents) under applicable Data Protection Laws.

1.7 "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Customer Personal Data Processed by Julia AI or its Subprocessors. "Security Incident" does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as unsuccessful log-in attempts, pings, port scans, denial-of-service attacks, or other network attacks on firewalls or networked systems.

1.8 "Subprocessor" means any third party engaged by Julia AI to Process Customer Personal Data on Customer's behalf in connection with the Services.

1.9 "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision (EU) 2021/914, as amended or replaced from time to time. "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office.

2. Roles of the Parties

2.1 As between the parties, Customer is the Controller and/or Business with respect to Customer Personal Data, and Julia AI is the Processor and/or Service Provider Processing Customer Personal Data on Customer's behalf. Where Customer is itself a processor acting on behalf of a third-party controller, Customer warrants that its instructions to Julia AI are authorized by that controller, and Julia AI acts as Customer's subprocessor.

2.2 Each party shall comply with the obligations that apply to it in its respective role under Data Protection Laws. Customer is solely responsible for: (a) the accuracy, quality, and lawfulness of Customer Personal Data and the means by which it was acquired; (b) providing all required notices to, and obtaining all required consents and authorizations from, Consumers and Data Subjects (including any consents required for telephone, SMS, email, or call-recording communications initiated through the Services); and (c) ensuring its instructions to Julia AI comply with Data Protection Laws.

2.3 The details of the Processing (subject matter, duration, nature and purposes, categories of data and data subjects) are set out in Annex I.

3. CCPA Service-Provider Terms; Certifications

To the extent the CCPA applies to Customer Personal Data, the parties acknowledge that Customer discloses Customer Personal Data to Julia AI only for the limited and specified business purposes described in Annex I (provision and operation of the Services, security and integrity, customer support, and permitted internal operations), and Julia AI agrees as follows:

3.1 No sale or sharing. Julia AI shall not Sell or Share Customer Personal Data.

3.2 Purpose limitation. Julia AI shall not retain, use, or disclose Customer Personal Data for any purpose (including any commercial purpose) other than the business purposes specified in Annex I and this DPA, or as otherwise permitted for service providers under the CCPA and its regulations.

3.3 No use outside the direct business relationship. Julia AI shall not retain, use, or disclose Customer Personal Data outside of the direct business relationship between Julia AI and Customer, except as permitted by the CCPA.

3.4 No combination. Julia AI shall not combine Customer Personal Data with Personal Data that Julia AI receives from or on behalf of another person, or collects from its own interactions with Consumers, except as permitted for service providers under the CCPA and its regulations (including to perform the Services, to detect security incidents or protect against fraudulent or illegal activity, and for permitted internal uses).

3.5 Certification. Julia AI certifies that it understands the restrictions in this Section 3 and will comply with them.

3.6 Same level of protection. Julia AI shall provide the same level of privacy protection for Customer Personal Data as is required of Customer as a Business under the CCPA, including by complying with the applicable sections of the CCPA and its regulations and cooperating with Customer's compliance obligations, including by assisting Customer in responding to Consumer requests as set out in Section 10.

3.7 Notice of non-compliance. Julia AI shall notify Customer without undue delay if it determines that it can no longer meet its obligations under the CCPA or this Section 3.

3.8 Remediation. Upon reasonable notice, Customer may take reasonable and appropriate steps to (a) ensure that Julia AI uses Customer Personal Data in a manner consistent with Customer's obligations under the CCPA, and (b) stop and remediate any unauthorized use of Customer Personal Data.

3.9 The parties intend the equivalent processor obligations under the Virginia CDPA, Colorado CPA, Texas TDPSA, Maryland MODPA, and other applicable US state privacy laws to be satisfied by this DPA, and this Section 3 shall be construed to include any analogous mandatory contract terms required by those laws.

4. Processing on Documented Instructions

4.1 Julia AI shall Process Customer Personal Data only on Customer's documented instructions, including with regard to transfers of Customer Personal Data, unless required to do so by applicable law to which Julia AI is subject (in which case Julia AI shall inform Customer of that legal requirement before Processing, unless the law prohibits such disclosure on important grounds of public interest).

4.2 The parties agree that the following constitute Customer's complete documented instructions as of the effective date: (a) the Agreement and this DPA (including the Annexes); (b) Customer's and its Authorized Users' configuration and use of the Services, including settings, automations, flows, integrations, and features that Customer enables or invokes (including instructions given to the "Julia" AI assistant); and (c) any additional written instructions agreed by the parties. Additional instructions outside the scope of the foregoing require prior written agreement, including any fees payable for their execution.

4.3 Julia AI shall promptly notify Customer if, in Julia AI's opinion, an instruction infringes Data Protection Laws; provided that Julia AI has no obligation to monitor Customer's compliance or to provide legal advice, and may suspend execution of the relevant instruction until it is confirmed or modified.

5. No AI Training

5.1 Julia AI shall not use Customer Personal Data to train, retrain, fine-tune, or otherwise improve any generalized machine-learning or artificial-intelligence model for the benefit of any third party or for use outside the provision of the Services to Customer.

5.2 Where Julia AI uses third-party AI service providers as Subprocessors to deliver AI-powered features of the Services (including the Julia assistant, transcription, and content generation), Julia AI shall ensure such providers are contractually prohibited from using Customer Personal Data to train or improve their models, and shall configure such services accordingly (e.g., zero-retention or no-training API terms) where available.

5.3 For clarity, this Section does not prohibit Processing Customer Personal Data at Customer's direction to generate outputs for Customer within the Services, or the use of aggregated or de-identified data as permitted by Section 12.4.

6. Confidentiality

Julia AI shall ensure that all persons it authorizes to Process Customer Personal Data (including employees and contractors) are subject to binding written or statutory obligations of confidentiality with respect to such data, and Process it only as needed to perform their roles in delivering the Services.

7. Security

7.1 Julia AI shall implement and maintain reasonable and appropriate technical and organizational measures designed to protect Customer Personal Data against Security Incidents and to preserve its confidentiality, integrity, and availability, as described in Annex II. In determining the appropriate level of security, Julia AI shall take into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risks of varying likelihood and severity to natural persons.

7.2 Julia AI may update the measures in Annex II from time to time, provided such updates do not materially diminish the overall security of the Services during the term of the Agreement.

7.3 Customer is responsible for securing its own accounts and systems, including managing Authorized User credentials and roles, enabling available security features (including multi-factor authentication), and appropriately configuring the Services.

8. Security Incident Notification

8.1 Julia AI shall notify Customer without undue delay after becoming aware of a Security Incident, and in any event within the time period required by applicable Data Protection Laws.

8.2 To the extent known at the time (and supplemented as information becomes available), the notification shall describe: (a) the nature of the Security Incident; (b) the categories and approximate number of Consumers/Data Subjects and records concerned; (c) the likely consequences; (d) the measures taken or proposed to address the Security Incident and mitigate its possible adverse effects; and (e) a contact point for further information.

8.3 Julia AI shall take reasonable steps to contain, investigate, and remediate the Security Incident, and shall provide reasonable cooperation and assistance to enable Customer to comply with its own notification obligations to regulators and affected individuals. Customer is solely responsible for determining whether and how to notify regulators or individuals, unless applicable law imposes a direct notification obligation on Julia AI.

8.4 Julia AI's notification of or response to a Security Incident is not an acknowledgment or admission of any fault or liability.

9. Subprocessors

9.1 General authorization. Customer provides Julia AI with a general authorization to engage Subprocessors to Process Customer Personal Data in connection with the Services. The current categories of Subprocessors, with the purpose of the engagement and categories of data involved, are set out in Annex III. A current list of Subprocessor identities is available upon written request to info@onjulia.com, and Customer may subscribe to notifications of Subprocessor changes by writing to the same address.

9.2 Change notice and objection. Julia AI shall provide subscribed Customers at least thirty (30) days' advance notice of the addition or replacement of a Subprocessor (except that shorter notice may be given where prompt replacement is reasonably necessary for security or service-continuity reasons, in which case notice will be given as soon as practicable). Customer may object to a new Subprocessor within the notice period on reasonable, documented data-protection grounds. Upon such objection, the parties shall work together in good faith to resolve the concern, and Julia AI may, at its option: (a) remediate the concern; (b) make available a commercially reasonable alternative that avoids the objected-to Subprocessor; or (c) if neither is reasonably feasible, permit Customer to terminate the affected feature or, if the affected feature is material to Customer's use of the Services as a whole, the affected Services, with a pro-rata refund of prepaid, unused fees for the terminated portion. If Customer does not object within the notice period, the new Subprocessor is deemed accepted.

9.3 Flow-down. Julia AI shall enter into a written agreement with each Subprocessor imposing data-protection obligations that are substantially equivalent to, and no less protective than, those imposed on Julia AI under this DPA with respect to the Processing performed by that Subprocessor, including the restrictions in Sections 3 and 5.

9.4 Liability. Julia AI remains responsible and liable for the performance of each Subprocessor's obligations to the same extent Julia AI would be liable if performing the relevant Processing directly, subject to the limitations in Section 14.

10. Assistance to Customer

10.1 Consumer and Data Subject requests. Taking into account the nature of the Processing, Julia AI shall assist Customer, by appropriate technical and organizational measures and insofar as reasonably possible, in fulfilling Customer's obligations to respond to Consumer and Data Subject requests to exercise rights under Data Protection Laws (including access, deletion, correction, portability, and opt-out rights). The Services' native search, export, editing, and deletion capabilities constitute the primary means of such assistance. If Julia AI receives a request directly from a Consumer or Data Subject that identifies Customer or relates to Customer Personal Data, Julia AI shall (to the extent legally permitted) promptly forward the request to Customer and shall not respond substantively except to direct the individual to Customer or as required by law.

10.2 DPIAs and consultations. To the extent the GDPR or UK GDPR applies to the Processing and Customer cannot obtain the necessary information through the Services, documentation, or Annexes, Julia AI shall provide reasonable assistance to Customer, at Customer's expense, with data protection impact assessments and prior consultations with supervisory authorities, in each case solely to the extent related to Julia AI's Processing of Customer Personal Data.

10.3 Julia AI may charge a reasonable fee for assistance under this Section 10 that is materially disproportionate in scope or frequency, except where such assistance is required of Julia AI without charge under Data Protection Laws.

11. Audits and Compliance Information

11.1 Julia AI shall make available to Customer information reasonably necessary to demonstrate compliance with this DPA. Customer agrees that its audit rights shall be satisfied first by Julia AI providing: (a) copies of then-current third-party audit reports, certifications, or attestations covering the Services (e.g., SOC 2 or equivalent), subject to confidentiality obligations; and (b) written responses to reasonable information-security questionnaires, no more than once per twelve (12) months.

11.2 If Data Protection Laws grant Customer a mandatory audit right that cannot be satisfied by Section 11.1, Customer (or an independent third-party auditor on its behalf that is not a competitor of Julia AI and is bound by confidentiality) may audit Julia AI's compliance with this DPA, subject to the following: (a) no more than once per twelve (12) months, except following a Security Incident affecting Customer Personal Data or where required by a regulator; (b) at least thirty (30) days' prior written notice and a mutually agreed scope, time, and duration during normal business hours; (c) at Customer's sole cost and expense, including reimbursement of Julia AI's reasonable time at then-standard rates where the audit exceeds one business day; (d) conducted in a manner that does not unreasonably interfere with Julia AI's operations; and (e) with no access to data of Julia AI's other customers, to Julia AI's proprietary or privileged information unrelated to this DPA, or to physical facilities of Subprocessors (for which the relevant Subprocessor's audit reports shall be relied upon). Audit results are Julia AI's Confidential Information.

12. Return and Deletion of Customer Personal Data

12.1 During the term of the Agreement, Customer may access and export Customer Personal Data through the Services and the API.

12.2 For sixty (60) days following termination or expiration of the Agreement, Julia AI shall, upon Customer's written request, make Customer Personal Data available for export in a commonly used, machine-readable format.

12.3 Following the export window, Julia AI shall delete or de-identify Customer Personal Data within ninety (90) days, except to the extent that: (a) retention is required by applicable law (including tax, accounting, e-signature evidentiary, or telecommunications record-keeping requirements); or (b) the data resides in routine backup archives, which shall be deleted or overwritten in the ordinary course of Julia AI's backup rotation and shall not be restored to production except as necessary for disaster recovery. Any Customer Personal Data retained under this Section remains subject to the protections of this DPA for so long as it is retained, and shall be isolated from further Processing except as required for the retention purpose.

12.4 Nothing in this DPA prohibits Julia AI from creating and using aggregated or de-identified data that does not identify Customer, any Consumer, or any Data Subject, provided that Julia AI maintains and uses such data in de-identified form, does not attempt to re-identify it, and contractually prohibits recipients from re-identifying it, consistent with Data Protection Laws.

13. International Transfers

13.1 Julia AI Processes Customer Personal Data primarily in the United States. Customer authorizes Julia AI to Process Customer Personal Data in the United States and in other locations where Julia AI or its Subprocessors maintain facilities, subject to this Section 13.

13.2 To the extent Julia AI Processes Customer Personal Data that is subject to the GDPR and such Processing involves a transfer to a country not recognized as providing an adequate level of protection, the SCCs (Module Two: controller to processor) are incorporated into this DPA by reference, with: (a) Customer as "data exporter" and Julia AI as "data importer"; (b) Clause 7 (docking) included; (c) Clause 9 Option 2 (general written authorization) with the notice period in Section 9.2; (d) the optional redress language in Clause 11 not included; (e) Clause 17 governed by the law of Ireland and Clause 18 courts of Ireland; (f) Annexes I and II of this DPA serving as Annexes I and II of the SCCs, and Annex III (together with the identity list available under Section 9.1) serving as Annex III of the SCCs. In the event of a conflict between the SCCs and this DPA, the SCCs control.

13.3 To the extent Customer Personal Data subject to the UK GDPR is transferred to Julia AI, the UK Addendum applies to such transfer, completed with the information in this DPA and its Annexes, and modifying the SCCs as set out therein. For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with the adaptations customary for Swiss transfers (competent authority: FDPIC; references to EU member-state law read as references to Swiss law where applicable).

13.4 If a transfer mechanism relied upon is invalidated or superseded, the parties shall cooperate in good faith to implement a lawful successor mechanism.

14. Liability

Each party's and its affiliates' aggregate liability arising out of or related to this DPA (including the SCCs, to the extent permitted by law) is subject to the exclusions of damages and limitations of liability set forth in the Agreement, and any claims under this DPA shall be brought solely under and subject to the terms of the Agreement. Nothing in this Section limits either party's liability with respect to a Consumer's or Data Subject's rights under Data Protection Laws or the SCCs where such limitation is prohibited.

15. Order of Precedence; General

15.1 With respect to the subject matter of this DPA, in the event of a conflict: (a) the SCCs (where applicable) control over this DPA; (b) this DPA controls over the Agreement and any other agreement between the parties; and (c) where Data Protection Laws impose requirements more protective than this DPA, the Data Protection Laws control.

15.2 If any provision of this DPA is held invalid or unenforceable, the remainder shall remain in effect, and the invalid provision shall be construed to give maximum effect to its intent as permitted by law. Julia AI may update this DPA from time to time as required to reflect changes in Data Protection Laws, provided such updates do not materially reduce the protections for Customer Personal Data.

15.3 This DPA terminates automatically upon deletion of Customer Personal Data pursuant to Section 12, except for provisions that by their nature survive.

Annex I: Details of Processing

A. Subject matter. Julia AI's Processing of Customer Personal Data to provide, secure, and support the Julia business-management platform, including CRM, field-service and job management, invoicing and payments facilitation, scheduling, document management and e-signature, email/SMS/voice communications, and the Julia assistant.

B. Duration. The term of the Agreement, plus the export and deletion periods in Section 12.

C. Nature and purposes of Processing. Collection, storage, hosting, organization, structuring, retrieval, use, disclosure by transmission (at Customer's direction), analysis at Customer's direction, and deletion of Customer Personal Data for the following business purposes: (1) providing and operating the Services, including hosting and CRM functionality; (2) delivering communications (email, SMS, voice calls, call recording and transcription) initiated or configured by Customer; (3) facilitating document workflows and electronic signatures; (4) AI-assistant Processing at Customer's direction (answering queries, drafting content, executing Customer-instructed actions within the Services); (5) providing customer support; (6) ensuring security, preventing fraud, and maintaining the integrity of the Services; (7) complying with applicable law; and (8) internal operations permitted for service providers under Data Protection Laws (e.g., debugging, service improvement not involving prohibited AI training per Section 5, billing, and analytics on Customer's use of the Services).

D. Categories of Data Subjects/Consumers. (1) Customer's clients, customers, leads, prospects, vendors, subcontractors, and other business contacts; (2) recipients of communications sent through the Services; (3) Customer's employees, contractors, agents, and Authorized Users; (4) other individuals whose Personal Data Customer submits to the Services.

E. Categories of Customer Personal Data. Contact and identity details (name, email, phone, address, company, role); communications content and metadata (email and SMS content, call recordings, voicemails, and transcripts, chat messages); documents and electronic signatures (uploaded files, signed agreements, signature data and audit trails); transaction and financial records (orders, invoices, payments status, estimates, expenses); notes and activity history; scheduling and calendar data (appointments, jobs, visits, time entries); location data of Customer's employees and field personnel, where Customer enables location-based workforce features (check-in/check-out, job-site geofencing, field-personnel location, time-clock verification); device/usage data associated with Authorized Users.

F. Sensitive data. The Services are not designed or intended for the Processing of sensitive Personal Data (e.g., government identifiers, health information, biometric data, or data of children), and, except as described in this sentence, not for precise geolocation of Consumers; the sole intended category of precise geolocation is location data of Customer's own personnel Processed through location-based workforce features that Customer elects to enable, which is Processed strictly on Customer's instructions and subject to Customer's compliance with the notice, consent, and monitoring-law obligations set out in the Agreement. Customer shall not submit other sensitive Personal Data except as strictly necessary and lawful; any such data submitted incidentally by Customer is Processed only as part of Customer Data under the protections of this DPA.

G. Frequency. Continuous, for the duration in Part B.

H. Retention. As determined by Customer through its use of the Services during the term; thereafter per Section 12.

I. Competent supervisory authority (SCCs, where applicable). The supervisory authority of the EU member state in which the data exporter is established or, where the exporter is not established in the EU, the supervisory authority determined in accordance with Clause 13 of the SCCs.

Annex II: Technical and Organizational Security Measures

Julia AI maintains a written information-security program appropriate to the nature of the Customer Personal Data Processed, including at minimum:

1. Security program and governance. Documented security policies, designated security ownership, periodic risk assessments, and at-least-annual policy review. 2. Access control. Role-based access on a least-privilege, need-to-know basis; unique credentials per user; multi-factor authentication for administrative and production access; prompt revocation upon role change or termination; periodic access reviews. 3. Encryption. Encryption of Customer Personal Data in transit over public networks (TLS 1.2+) and at rest using industry-standard algorithms; encryption or secure storage of credentials, tokens, and secrets. 4. Multi-tenant isolation. Logical segregation of each customer organization's data through tenant-scoped access controls enforced at the application and data layers, so that one customer's data is not accessible to another customer. 5. Network security. Segregated production environments, firewalls and network access restrictions, hardened configurations, and restriction of production data from development and test environments except as strictly necessary and protected. 6. Logging and monitoring. Logging of administrative and material data-access events, audit trails for sensitive actions, monitoring and alerting designed to detect anomalous activity. 7. Vulnerability management. Regular patching, vulnerability scanning, dependency monitoring, and remediation prioritized by severity; periodic security testing of the application. 8. Personnel security. Confidentiality obligations for all personnel (Section 6); security and privacy awareness training; background screening where permitted by law and appropriate to role. 9. Vendor management. Risk-based due diligence of Subprocessors, contractual flow-down per Section 9.3, and periodic review of Subprocessor practices. 10. Backup and disaster recovery. Regular encrypted backups, geographically resilient infrastructure, documented recovery procedures, and periodic testing of restoration capability. 11. Incident response. A documented incident-response plan covering detection, escalation, containment, investigation, notification (per Section 8), remediation, and post-incident review. 12. Secure development. Change management, code review, and separation of duties for production deployments.

Annex III: Subprocessor Categories

A current list of Subprocessor identities within each category is available upon written request to info@onjulia.com. Customer may subscribe to receive notifications of new or replaced Subprocessors (Section 9.2) by written request to the same address.