Data Processing Addendum

1. Roles and Scope

Shekl processes personal information only to provide the Service and on Customer's documented instructions, which include the Agreement and use of the Service. Customer is responsible for the accuracy and lawfulness of the data it provides and for having a lawful basis to share it.

2. Service Provider Obligations (CCPA/CPRA)

Shekl certifies that it will:

• Not sell or share personal information;
• Not retain, use, or disclose personal information except as necessary to provide the Service or as permitted by law;
• Not combine personal information with data from other sources except as permitted for a service provider;
• Not process personal information outside the direct business relationship; and
• Comply with applicable obligations and provide the same level of privacy protection as required of a business.

3. Confidentiality and Security

Shekl will ensure persons authorized to process personal information are bound by confidentiality, and will maintain the technical and organizational security measures described in Annex II, consistent with the GLBA Safeguards Rule.

4. Sub-processors

Customer authorizes Shekl to engage the sub-processors listed in Annex III and others on notice. Shekl will impose data-protection obligations on sub-processors substantially similar to those in this DPA and remains responsible for their performance.

5. Assistance, Requests, and Breach Notice

Shekl will provide reasonable assistance for consumer-rights requests and for Customer's security and assessment obligations.

Shekl will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer data, and will cooperate in good faith.

6. Deletion and Return

During the term, connected data is retained for up to 24 months and then deleted or de-identified, unless law requires otherwise. On termination, Shekl will delete or return personal information at Customer's request, except where retention is required by law, after which Shekl will delete or de-identify it.

7. International Transfers (Future Expansion)

The Service is currently operated in the United States. If Shekl processes personal data subject to UK or EU law (for planned UK or Australian operations), the parties will enter into appropriate transfer mechanisms (for example, the UK International Data Transfer Agreement or EU Standard Contractual Clauses) as an annex to this DPA. [Confirm with counsel before launching outside the U.S.]

8. Audits

On reasonable written notice and subject to confidentiality, Shekl will make available information necessary to demonstrate compliance with this DPA, which may take the form of third-party audit reports or certifications.

Annex I — Details of Processing

Annex II — Security Measures (summary)

• Encryption of data in transit and at rest;
• Role-based access controls and least-privilege access;
• Logging, monitoring, and intrusion detection;
• Secure software-development and vulnerability-management practices;
• Regular backups and a documented incident-response plan;
• Vendor and sub-processor risk management.

Annex III — Approved Sub-processors