Data Processing Agreement

This Data Processing Agreement (“DPA”) is entered into in connection with the Purchase Order Agreement between Syntro Inc. (“Company”) and the customer identified in that Purchase Order Agreement (“Client”), together with any terms it incorporates (the “Agreement”). This DPA is incorporated into and forms part of the Agreement, governs the processing of any Personal Data that Client may make accessible to Company, and is effective as of the Agreement's effective date (“Effective Date”). It is the agreement referenced in Section 2.3 of Company's Privacy Policy at usesyntro.com/privacy. This DPA applies automatically when Client accepts a Purchase Order that references it; a signable copy is available on request.

Section 1: Definitions

In addition to terms defined elsewhere in this DPA, the following definitions shall apply:

“Applicable Data Protection Law” means all applicable data protection and privacy laws, including but not limited to, the EU General Data Protection Regulation 2016/679 (the “GDPR”), the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (the “CCPA/CPRA”), and any other applicable national or local data protection laws.

“Data Controller” means the party who determines the purposes and means of the processing of Personal Data.

“Data Processor” means the party who processes Personal Data on behalf of the Data Controller.

“Data Subject” means an identified or identifiable natural person to whom Personal Data relates.

“Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.

“Personal Data” means any information relating to an identified or identifiable natural person that is processed by Data Processor on behalf of the Data Controller under the Agreement. This may include, but is not limited to, the business contact details of individuals contained in Client's data (such as name, business email address, telephone number, job title, and employer) and the account identifiers and usage records of Client's authorized users.

“Processing” means any operation or set of operations that is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Subprocessor” means any third-party data processor engaged by the Data Processor to Process Personal Data on behalf of the Data Controller.

“Technical and Organizational Measures” means those measures aimed at protecting Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the Processing involves the transmission of data over a network, and against all other unlawful forms of Processing. These measures should ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected, having regard to the state of the art and the cost of their implementation.

Section 2: Processing of Personal Data

2.1 Subject Matter, Nature and Purpose of Processing

The Data Processor shall process Personal Data as necessary to provide the services under the Agreement, including, but not limited to:

• Hosting and storing Personal Data contained in Client's procurement records to operate the services.
• Processing purchase orders, requests for quotation, bills of materials, supplier and vendor records, and related communications to perform sourcing, supplier coordination, and purchasing workflows.
• Submitting inputs to third-party artificial intelligence or machine learning providers on the Data Controller's behalf to perform those workflows.
• Generating reports and other outputs based on processed data, to be delivered to the Data Controller.
• Providing support and maintenance for the services.

The Data Processor will process Personal Data only in accordance with documented instructions from the Data Controller, and for the specific purposes outlined in this DPA and the Agreement. For purposes of the CCPA/CPRA, when applicable, Data Processor acts as a “service provider” and “processor” (as such terms are defined under Applicable Data Protection Law) with respect to Personal Data processed on behalf of the Data Controller, and Data Processor shall not sell or share (as such terms are defined under the CCPA/CPRA) Personal Data, nor retain, use, or disclose Personal Data for any purpose other than performing the services specified in the Agreement, except as otherwise permitted by the CCPA/CPRA, including to secure and improve the services under the Agreement, comply with applicable law (including applicable Data Protection Law), and use Personal Data solely in aggregated and de-identified form for analytics, benchmarking, and product improvement purposes. The Data Processor will not use Personal Data to train artificial intelligence or machine learning models, consistent with Company's Terms of Service.

2.2 Categories of Data Subjects

The Personal Data processed under this DPA relates to the following categories of Data Subjects:

• The Data Controller's authorized users and personnel who access the services.
• Individual points of contact at the Data Controller's suppliers, vendors, and other counterparties whose details appear in purchase orders, requests for quotation, bills of materials, and related communications.
• Other individuals whose Personal Data the Data Controller may choose to provide to the Data Processor for processing, as agreed upon in writing between the parties.

2.3 Types of Personal Data

The Personal Data processed under this DPA may include, but is not limited to, the following types:

• Names, business email addresses, telephone numbers, job titles, and employer information.
• Account identifiers and usage records of authorized users.
• Any other type of Personal Data provided by the Data Controller to the Data Processor for processing in connection with the services. The services are not intended to process special categories of Personal Data.

2.4 Duration of Processing

The Data Processor will process Personal Data for the duration of the Agreement, and for any extended period necessary to fulfill contractual obligations, or as required by Applicable Data Protection Law. Upon termination of the Agreement, the Data Processor will handle Personal Data as described in Section 7 of this DPA.

Section 3: Data Controller's Instructions

3.1 General Instructions

The Data Processor shall only process Personal Data on behalf of the Data Controller and in accordance with the Data Controller's documented instructions. The Data Controller instructs the Data Processor to Process Personal Data in order to provide the services as described in the Agreement and this DPA, and in accordance with any lawful instructions given by the Data Controller from time to time.

3.2 Lawfulness of Processing

The Data Controller warrants that it has all necessary rights, permissions, and consents to provide the Personal Data to the Data Processor for Processing in accordance with Applicable Data Protection Law, including but not limited to any necessary consents from Data Subjects. The Data Controller is solely responsible for ensuring the lawfulness of its instructions and the processing of Personal Data.

3.3 Instructions Regarding Changes

The Data Controller may, from time to time, provide additional instructions to the Data Processor regarding the Processing of Personal Data. Such instructions must be in writing (including email) and shall be subject to the terms of the Agreement and this DPA. In the event that such instructions are inconsistent with the terms of the Agreement or this DPA, the Data Processor shall notify the Data Controller without undue delay, and the Parties will cooperate in good faith to resolve any conflict.

3.4 Instructions Regarding Data Subject Rights

The Data Controller is responsible for responding to requests from Data Subjects regarding their rights under Applicable Data Protection Law. The Data Processor will cooperate as set out in Section 4.5 to assist the Data Controller in fulfilling these obligations.

Section 4: Data Processor Obligations

4.1 Confidentiality

The Data Processor shall treat all Personal Data as confidential and shall ensure that its personnel authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. The Data Processor shall not disclose Personal Data to any third party except as permitted under this DPA, the Agreement, or as required by law.

4.2 Use of Subprocessors

(a) The Data Controller acknowledges and agrees that the Data Processor may engage Subprocessors to process Personal Data on its behalf.

(b) The Data Processor will maintain an up-to-date list of Subprocessors used for the processing of Personal Data and will provide this list to the Data Controller upon request.

(c) The Data Processor will ensure that each Subprocessor is subject to written contractual obligations that are substantially the same as the obligations imposed on the Data Processor under this DPA, including the requirement to implement appropriate Technical and Organizational Measures to protect Personal Data.

(d) Before engaging a new Subprocessor that will Process Personal Data, the Data Processor will provide the Data Controller with written notice (including email) of such engagement. The Data Controller may object on reasonable data protection grounds within ten (10) business days of receipt of such notice. The parties will work in good faith to resolve the objection. If they cannot, the Data Controller may, as its sole and exclusive remedy, terminate the Agreement with respect to the affected portion of the services on written notice.

(e) The Data Processor shall remain fully liable to the Data Controller for the performance of the Subprocessor's obligations under this DPA.

4.3 Data Security

The Data Processor shall implement and maintain appropriate Technical and Organizational Measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. Further information about these measures is available at usesyntro.com/security.

4.4 Data Breach Notification

In the event of a Data Breach, the Data Processor shall notify the Data Controller without undue delay, and in any event within seventy-two (72) hours after confirming the Data Breach. The notification will describe, to the extent known, the nature and scope of the Data Breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, the measures taken or proposed to address it, and a point of contact for further information. The Data Processor shall cooperate with the Data Controller to investigate and remediate the Data Breach, take all reasonable steps to mitigate any damages, and assist the Data Controller in meeting its own breach notification obligations under Applicable Data Protection Law. Notification is not an acknowledgment of fault or liability.

4.5 Assistance with Data Subject Rights

The Data Processor shall assist the Data Controller, by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Data Controller's obligation to respond to requests from Data Subjects seeking to exercise their rights under Applicable Data Protection Law, including but not limited to the right to access, rectify, erase, restrict the processing of, or port their Personal Data, where applicable. When the Data Processor receives a Data Subject request relating to the Data Controller's data, it shall inform the Data Controller without undue delay and will cooperate with the Data Controller to respond to such request.

Section 5: Data Transfers

5.1 Transfers of Personal Data

In the event that the Data Processor transfers Personal Data to a country outside of the jurisdiction in which the Data Controller is located, or outside of the jurisdiction in which the Data Subject is located, the Data Processor shall ensure that such transfers are made in compliance with the applicable provisions of Applicable Data Protection Law, and the following provisions shall apply:

(a) For Transfers Subject to GDPR: If the transfer of Personal Data is from the European Economic Area (EEA) or the United Kingdom to a country outside of the EEA or the United Kingdom not deemed adequate by the European Commission, the Parties agree to enter into Standard Contractual Clauses (SCCs) as issued by the European Commission, which will be incorporated into this DPA by reference and will apply in conjunction with the terms of this DPA. The relevant SCCs will be those relevant to the relationship between a Data Controller and a Data Processor.

(b) Other Transfers: For transfers of Personal Data subject to other Applicable Data Protection Laws, the Data Processor will ensure that appropriate safeguards, as specified in Applicable Data Protection Law, are in place to protect Personal Data.

5.2 Data Transfers in Response to Government Authority

In the event the Data Processor receives a demand from a government authority to disclose Personal Data, the Data Processor shall, to the extent permitted by law, promptly notify the Data Controller of such demand. The Data Processor will reasonably cooperate with the Data Controller to determine if such government request is valid under applicable laws.

Section 6: Audits

6.1 Verification of Compliance

The Data Processor shall make available to the Data Controller information reasonably necessary to demonstrate compliance with this DPA. The Data Controller may verify the Data Processor's compliance through: (a) the Data Processor's then-current third-party audit reports and certifications, including its SOC 2 report when available, provided under the confidentiality obligations of this DPA; and (b) the Data Processor's written responses to a reasonable security questionnaire. The parties agree that these means satisfy the Data Controller's audit and inspection rights under Applicable Data Protection Law.

6.2 Limitations and Scope

Verification under Section 6.1 shall be limited to once per twelve (12) month period, except where required by Applicable Data Protection Law or where there is a reasonable suspicion of a material breach of this DPA or a Data Breach affecting the Data Controller's Personal Data. For the avoidance of doubt, these verification rights do not include the right to conduct penetration testing, vulnerability scanning, or other testing of the services.

6.3 Confidentiality of Audit Results

Any information obtained during verification shall be considered Confidential Information of the Data Processor, and the Data Controller shall keep such information confidential.

Section 7: General Provisions

7.1 Return or Deletion of Personal Data

Upon termination or expiration of the Agreement, or at the Data Controller's documented request, the Data Processor shall, at the Data Controller's option, either securely delete or return all Personal Data to the Data Controller within the timeframe set out in the applicable Purchase Order Agreement, or if not specified, within sixty (60) days, in accordance with the Data Controller's documented instructions. The Data Processor will certify to the Data Controller that the data has been either deleted or returned. If the Data Controller chooses to have the data deleted and is subsequently unable to retrieve the data, the Data Processor is not responsible for that loss. This Section is subject to any retention permitted or required under the Agreement or by Applicable Law.

7.2 Liability

Each Party's liability under this DPA shall be limited to the extent permitted under the Agreement. To the extent the Agreement does not address the liability arising under this DPA, the parties will agree to a liability limit that is reasonable given the size and complexity of the processing operations, but will not be higher than what is permitted under Applicable Data Protection Law.

7.3 Governing Law and Jurisdiction

This DPA shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws provisions, consistent with the governing law of the Agreement. The parties agree that any legal action or proceeding arising out of or relating to this DPA shall be brought exclusively in the state or federal courts located in the State of Delaware, and the parties hereby irrevocably submit to the personal jurisdiction and venue of such courts, except that nothing in this Section overrides the governing law or forum required by the Standard Contractual Clauses for the transfers they address.

7.4 Relationship to the Agreement

This DPA is incorporated into and forms part of the Agreement. With respect to the Processing of Personal Data, this DPA prevails over the Purchase Order Agreement and any other component of the Agreement in the event of a conflict on data protection matters; in all other respects the order of precedence set out in the Agreement is unchanged.

7.5 Changes to this DPA

Company may update this DPA from time to time by posting the updated version at usesyntro.com/dpa and revising its effective date. Company will notify Client of material changes as required by the Agreement or Applicable Data Protection Law. The updated DPA applies to Personal Data processed on or after its effective date, and Client's continued use of the services after that date constitutes acceptance of the updated DPA.

7.6 Severability

If any provision of this DPA is held to be invalid, illegal, or unenforceable, the validity, legality, and enforceability of the remaining provisions shall not in any way be affected or impaired thereby, and the invalid, illegal, or unenforceable provision shall be deemed replaced by a valid, legal, and enforceable provision that comes closest to the intentions of the parties.

7.7 Survival

The obligations regarding confidentiality, data security, and data deletion/return as stated in this DPA shall survive the termination of the Agreement.