Last updated: November 3, 2026

This Data Processing Addendum (this "DPA") supplements and is incorporated into the Huddle Terms of Service (the "Agreement") between Huddle Platform, Inc., a Delaware corporation ("Huddle"), and the customer identified in the applicable Order Form or online subscription ("Customer"). This DPA applies to Huddle's Processing of Personal Information on behalf of Customer in connection with the Services. Capitalized terms not defined in this DPA have the meanings given to them in the Agreement.

This DPA automatically forms part of the Agreement with respect to Personal Information subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), the Connecticut Data Privacy Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act, the Personal Information Protection and Electronic Documents Act ("PIPEDA"), the Act Respecting the Protection of Personal Information in the Private Sector (Quebec), as amended by Law 25, and analogous U.S. state and Canadian federal or provincial privacy laws (together, "Applicable Privacy Laws"). Customer may also elect to execute this DPA by countersigning the signature block at the end of this document, in which case it applies to all Personal Information Processed by Huddle on Customer's behalf.

In this DPA, the following capitalized terms have the meanings below. Other capitalized terms are defined in the Agreement or in the body of this DPA.

"Business" has the meaning given under CCPA/CPRA.

"Business Purpose" means the provision of the Services to Customer, the performance of Huddle's obligations under the Agreement and this DPA, and the other purposes set forth in Section 3 of this DPA.

"Controller" has the meaning given under the applicable Applicable Privacy Law, and has the same meaning as "Business" under CCPA/CPRA.

"Data Subject" means an identified or identifiable natural person to whom Personal Information relates.

"Data Subject Request" means a request from a Data Subject to exercise rights under Applicable Privacy Laws, including rights to access, correct, delete, or obtain a copy of Personal Information, or to opt out of the sale or sharing of Personal Information or its use for targeted advertising.

"Personal Information" means any information within Customer Data that (a) identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device, and (b) is subject to an Applicable Privacy Law. "Personal Information" includes "personal data" as defined under non-California Applicable Privacy Laws.

"Processor" has the meaning given under the applicable Applicable Privacy Law, and has the same meaning as "Service Provider" under CCPA/CPRA.

"Security Incident" means a confirmed unauthorized access to, acquisition of, or disclosure of Personal Information Processed by Huddle on behalf of Customer.

"Sell," "Sale," "Share," and "Sharing" have the meanings given under CCPA/CPRA.

"Sensitive Personal Information" has the meaning given under the applicable Applicable Privacy Law, and includes "sensitive data" under non-California Applicable Privacy Laws.

"Service Provider" has the meaning given under CCPA/CPRA.

"Subprocessor" means a third party engaged by Huddle to Process Personal Information on Customer's behalf in connection with the Services.

"Process" and "Processing" mean any operation or set of operations performed on Personal Information, including collection, recording, organization, storage, retrieval, consultation, use, disclosure, transmission, alignment, combination, restriction, erasure, or destruction.

This DPA applies to Huddle's Processing of Personal Information contained in Customer Data in connection with the Services.

With respect to Personal Information Processed under this DPA, Customer is the Business (under CCPA/CPRA) or Controller (under other Applicable Privacy Laws), and Huddle is the Service Provider (under CCPA/CPRA) or Processor (under other Applicable Privacy Laws).

In the event of a conflict between this DPA and the Agreement with respect to the Processing of Personal Information, this DPA controls. In all other respects, the Agreement controls.

Each Party will comply with its obligations under Applicable Privacy Laws in connection with its Processing of Personal Information under the Agreement and this DPA. Customer is solely responsible for determining whether Personal Information it submits to the Services is subject to Applicable Privacy Laws and for complying with its obligations as the Business or Controller, including providing required notices to Data Subjects and obtaining any required consents.

Huddle will Process Personal Information only on Customer's documented instructions, except where required by law. Customer instructs Huddle to Process Personal Information as follows: (a) as described in the Agreement, this DPA, and the Documentation; (b) as initiated by Authorized Users through their use of the Services, including by using AI Features and by connecting Third-Party Integrations; (c) to respond to Customer's reasonable written requests consistent with the Agreement; and (d) to comply with applicable law. Customer represents that these instructions comply with Applicable Privacy Laws.

The subject matter, nature, purpose, duration, categories of Data Subjects, and categories of Personal Information Processed under this DPA are described in Annex 1.

Huddle will Process Personal Information only for the Business Purpose, including to (a) provide, maintain, secure, and improve the Services; (b) perform Huddle's obligations under the Agreement; (c) detect and prevent fraud, abuse, and security threats; (d) generate Usage Data, De-Identified Data, and Aggregated Data as permitted by the Agreement; and (e) comply with law.

Huddle will not: (a) Sell or Share Personal Information; (b) retain, use, or disclose Personal Information for any purpose other than the Business Purpose, including for any commercial purpose other than the Business Purpose; (c) retain, use, or disclose Personal Information outside the direct business relationship between Huddle and Customer; (d) combine Personal Information with personal information received from or on behalf of another person, or collected from Huddle's own interactions with a consumer, except as permitted under CCPA/CPRA and other Applicable Privacy Laws for a Service Provider or Processor; or (e) use contact information contained in Personal Information to send Huddle marketing communications.

Notwithstanding Section 3.4, Huddle may create and use De-Identified Data and Aggregated Data derived from Personal Information in accordance with the Agreement and Applicable Privacy Laws. Huddle will not attempt to re-identify De-Identified Data and will maintain reasonable technical and contractual safeguards against re-identification.

Huddle will notify Customer if it determines that it can no longer meet its obligations under Applicable Privacy Laws with respect to Personal Information Processed under this DPA. Upon such notice, Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Information.

Huddle will ensure that personnel authorized to Process Personal Information are (a) informed of the confidential nature of the Personal Information, (b) bound by written confidentiality obligations or appropriate statutory obligations of confidentiality, and (c) granted access to Personal Information on a need-to-know basis.

Customer grants Huddle general authorization to engage Subprocessors to Process Personal Information in connection with the Services. Huddle's current Subprocessors are listed in Annex 3. Customer specifically authorizes the Subprocessors listed in Annex 3 as of the date Customer accepts this DPA.

Before engaging a Subprocessor, Huddle will enter into a written agreement with the Subprocessor that imposes data-protection obligations no less protective than those in this DPA with respect to the Processing of Personal Information, including the restrictions in Section 3.4.

Huddle will provide Customer with notice of the engagement of any new Subprocessor that will Process Personal Information, either by email to the contact on file for the Customer account or by updating Annex 3 and notifying Customer in the Services, at least thirty (30) days before the new Subprocessor begins Processing Personal Information.

If Customer has a reasonable, good-faith objection to a new Subprocessor on data-protection grounds, Customer will notify Huddle in writing within fifteen (15) days of receiving Huddle's notice. The Parties will work together in good faith to resolve the objection. If the Parties cannot resolve the objection within a reasonable period, Customer may terminate the portion of the Services that cannot be provided without the objectionable Subprocessor, on written notice, and will receive a pro rata refund of pre-paid Fees for the unused portion of the Subscription Term allocable to the terminated portion of the Services.

Huddle is liable for the acts and omissions of its Subprocessors to the same extent as if Huddle performed the relevant acts or omissions itself, subject to the limitations of liability in the Agreement.

Providers of Third-Party Integrations that Customer or its Authorized Users choose to connect, including third-party AI assistants that access the Services through Huddle's connector, are not Subprocessors. Personal Information that Customer or its Authorized Users cause to be sent to those providers is Processed under Customer's agreement with them.

Huddle will implement and maintain the technical and organizational security measures described in Annex 2, which are designed to protect Personal Information against unauthorized access, use, disclosure, alteration, and destruction, consistent with generally accepted industry practices for SaaS providers of similar size and scale. Huddle may update its technical and organizational measures from time to time, provided that such updates do not materially diminish the overall level of security afforded to Personal Information.

Huddle will conduct background checks on personnel with access to Personal Information to the extent permitted by law and will provide periodic security and privacy training to such personnel.

Huddle will notify Customer of a Security Incident without undue delay, and in any event no later than seventy-two (72) hours after Huddle's confirmation of the Security Incident.

Huddle's notification will include, to the extent then known and as the investigation progresses: (a) a description of the nature of the Security Incident; (b) the categories and approximate number of Data Subjects and records affected; (c) the likely consequences of the Security Incident; (d) the measures taken or proposed to address the Security Incident and mitigate its adverse effects; and (e) contact information for Huddle's response personnel.

Huddle will reasonably cooperate with Customer in investigating and remediating the Security Incident and will provide information reasonably necessary to enable Customer to meet its own notification obligations under applicable law.

Huddle's notification of a Security Incident is not an acknowledgment of fault or liability.

As between the Parties, Customer is responsible for responding to Data Subject Requests relating to Personal Information Processed on its behalf. The Services include tools that let Customer view, correct, deactivate, and export records about individual team members.

Taking into account the nature of the Processing, Huddle will provide reasonable assistance, through appropriate technical and organizational measures and insofar as possible, to enable Customer to fulfill its obligation to respond to Data Subject Requests. Huddle may charge a reasonable fee for assistance that is disproportionate or that falls outside the features made available in the Services.

If Huddle receives a Data Subject Request directly from a Data Subject regarding Personal Information Processed on Customer's behalf, Huddle will, without substantive response, refer the Data Subject to Customer or forward the request to Customer for response, except where Huddle is required by law to respond directly.

Huddle will make available to Customer, on reasonable written request, information reasonably necessary to demonstrate Huddle's compliance with this DPA, including any then-current independent third-party audit reports or certifications Huddle holds, or summaries thereof, subject to confidentiality obligations.

To the extent the information described in Section 9.1 is insufficient to demonstrate compliance and Customer has a reasonable, good-faith basis to request an audit, Customer may audit Huddle's compliance with this DPA once per twelve (12) month period, subject to the following: (a) Customer will provide at least thirty (30) days' prior written notice; (b) the audit will be conducted during normal business hours, in a manner that does not unreasonably interfere with Huddle's operations, and subject to Huddle's reasonable safety, security, and confidentiality requirements; (c) the audit will be performed by Customer or by an independent auditor that is not a competitor of Huddle, bound by confidentiality obligations; (d) Customer will bear its own costs and the reasonable costs incurred by Huddle in connection with the audit, except where the audit reveals a material breach by Huddle; and (e) Customer will provide Huddle with a copy of the audit report, which will be treated as Huddle's Confidential Information.

Huddle will cooperate with audits or inspections conducted by a supervisory authority with jurisdiction over Customer's Processing of Personal Information.

Huddle will provide Customer, upon reasonable written request, with information reasonably necessary to enable Customer to conduct data protection impact assessments or risk assessments required under Applicable Privacy Laws, taking into account the nature of the Processing and the information available to Huddle.

Upon termination or expiration of the Agreement, Huddle will return or delete Personal Information in accordance with Section 8.6 of the Agreement, including the ninety (90) day post-termination export window.

Huddle may retain Personal Information to the extent (a) required by law; (b) contained in routine backup or archival systems not readily accessible and subject to retention schedules, until deleted in the ordinary course; (c) subject to a legal hold that Customer has placed in the Services, until Customer releases it; or (d) retained as De-Identified Data or Aggregated Data in accordance with the Agreement. Huddle will continue to protect Personal Information retained under this Section 11.2 in accordance with this DPA.

Huddle certifies that it understands and will comply with the restrictions set forth in Sections 3.3 and 3.4 of this DPA and its obligations as a Service Provider under CCPA/CPRA.

The Business Purposes for which Customer discloses Personal Information to Huddle are described in Section 3.3 of this DPA, the Agreement, and the Documentation. Huddle will Process Personal Information only for those Business Purposes.

Without limiting Section 3.4, Huddle will not: (a) Sell or Share Personal Information; (b) retain, use, or disclose Personal Information outside the direct business relationship between the Parties; (c) retain, use, or disclose Personal Information for any purpose other than the Business Purposes specified in the Agreement and this DPA, including for any commercial purpose other than the Business Purposes; or (d) combine Personal Information with personal information from other sources, except as permitted for a Service Provider under CCPA/CPRA.

Huddle will Process Sensitive Personal Information only for the purposes permitted under CCPA/CPRA for Service Providers and only as necessary to perform the Services.

Customer has the right, upon written notice, to take reasonable and appropriate steps to (a) ensure that Huddle uses Personal Information in a manner consistent with Customer's obligations under CCPA/CPRA and (b) stop and remediate unauthorized use of Personal Information.

Huddle will notify Customer if Huddle determines that it can no longer meet its obligations under CCPA/CPRA.

Huddle will engage Subprocessors that Process Personal Information only pursuant to a written contract that requires the Subprocessor to observe the restrictions in Sections 3.3 and 3.4 and to comply with the applicable obligations of a Service Provider or contractor under CCPA/CPRA.

For Personal Information subject to Applicable Privacy Laws other than CCPA/CPRA, Huddle acts as a Processor and will Process Personal Information in accordance with this DPA. The terms of this DPA are intended to satisfy the processor-contract requirements of such Applicable Privacy Laws, including by:

This Section 14 applies to Personal Information subject to PIPEDA or a Canadian provincial privacy law (together, "Canadian Privacy Laws"). With respect to such Personal Information, Huddle acts as a service provider to Customer and Processes Personal Information on Customer's behalf and under its accountability.

Customer acknowledges and instructs Huddle that Personal Information may be transferred to, stored in, and Processed in the United States. Huddle will maintain comparable levels of protection for Personal Information Processed in the United States through the contractual, technical, and organizational measures set forth in this DPA. Customer is responsible for providing any notices to, and obtaining any consents from, Data Subjects as required under Canadian Privacy Laws in connection with such cross-border transfers.

Huddle will Process Personal Information subject to Canadian Privacy Laws in a manner consistent with Customer's accountability obligations under those laws, including by complying with the confidentiality, security, Subprocessor, Security Incident, Data Subject Request assistance, and deletion provisions of this DPA.

Where required, Huddle will provide Customer with information reasonably necessary to enable Customer to meet its breach-reporting obligations under Canadian Privacy Laws, including reporting to the Office of the Privacy Commissioner of Canada or applicable provincial commissioner and notification to affected Data Subjects, consistent with Section 7 of this DPA.

For Personal Information of residents of Quebec, Customer acknowledges that the Act Respecting the Protection of Personal Information in the Private Sector, as amended by Law 25, imposes additional obligations on Customer, including privacy impact assessment requirements for transfers of Personal Information outside Quebec. Huddle will provide Customer, upon reasonable written request, with information reasonably necessary to enable Customer to conduct such assessments, consistent with Section 10 of this DPA.

The limitations of liability in the Agreement, including the aggregate cap in Section 14.2 of the Agreement, apply to liability arising out of or relating to this DPA, regardless of whether any claim is framed under the Agreement or this DPA. Each Party's liability under the Agreement and this DPA, in the aggregate, is subject to the Agreement's limitations.

Nothing in this DPA expands or increases either Party's liability beyond what is set forth in the Agreement.

This DPA takes effect on the Effective Date of the Agreement (or, if later, the date this DPA is countersigned) and continues for the duration of the Agreement. Sections of this DPA that by their nature should survive termination will survive, including Sections 1, 3.4, 3.5, 5.5, 7, 11, 12, 14, 15, and 16.

Huddle may update this DPA from time to time (a) to reflect changes in Applicable Privacy Laws, (b) to reflect changes in the Services, or (c) as otherwise required or appropriate, consistent with the notice requirements in Section 16 of the Agreement. Modifications will not materially diminish Customer's rights or Huddle's obligations under this DPA without Customer's consent, except as required by law.

If any provision of this DPA is held unenforceable, the remaining provisions remain in full force and effect, and the unenforceable provision will be modified to the minimum extent necessary to render it enforceable while preserving its intent.

This DPA is governed by the laws of the State of Delaware, and disputes arising out of or relating to this DPA are subject to the dispute-resolution provisions in Section 15 of the Agreement.

Notices under this DPA will be provided in accordance with the Agreement. Privacy-related notices to Huddle may be sent to [email protected].

This DPA, together with the Agreement, constitutes the entire agreement between the Parties with respect to the Processing of Personal Information and supersedes all prior agreements on that subject.

This DPA may be executed in counterparts, including by electronic signature, each of which is an original and all of which together constitute one agreement. Customers who wish to countersign this DPA may do so below; countersignature is not required for the DPA to take effect where Applicable Privacy Laws apply.

This Annex 1 describes the Processing of Personal Information by Huddle on behalf of Customer under the Agreement and this DPA.

Subject matter. Huddle's provision of the Services to Customer under the Agreement.

Duration. The Subscription Term, plus the ninety (90) day post-termination export window in Section 8.6 of the Agreement, plus any period during which Personal Information remains in routine backups or under a Customer legal hold.

Nature of Processing. Collection, hosting, storage, organization, display, retrieval, transmission, analysis, export, and deletion of Personal Information to deliver the Services, including (a) sending notifications and emails at Customer's direction; (b) Processing documents, files, photos, and messages through third-party AI models when an Authorized User uses AI Features; (c) recording user sessions for troubleshooting and product improvement; and (d) returning data to Third-Party Integrations that Customer connects.

Purpose of Processing. The Business Purpose described in Section 3.3 of this DPA.

Categories of Data Subjects.

Categories of Personal Information.

Sensitive Personal Information. Depending on Customer's use, Personal Information may include account log-in credentials, dates of birth of minors, and time-off types that may reveal health information. Customer will not submit Restricted Data as defined in Section 3.3 of the Agreement.

Huddle maintains an information-security program that includes administrative, physical, and technical safeguards designed to protect Personal Information against unauthorized access, use, disclosure, alteration, and destruction. The program includes the measures described below, which Huddle may update from time to time consistent with Section 6.1 of this DPA.