Data Processing Addendum

This Data Processing Addendum (“DPA”) is between MVPGROW INC., a Delaware corporation (“MVPGROW” or “Processor”), and the customer that has accepted the Kollate Terms or entered into an order with MVPGROW (“Customer”). This DPA is incorporated into the agreement governing Customer's use of Kollate (the “Agreement”).

This DPA applies only to Personal Data that MVPGROW processes on Customer's behalf in providing the Service (“Customer Personal Data”). It becomes effective when Customer accepts the Agreement or the parties otherwise execute this DPA. If there is a conflict, this DPA controls for its subject matter, followed by any applicable transfer terms, the order, and then the Agreement.

“Applicable Data Protection Law” means privacy and data-protection law applicable to the processing, including, where applicable, the EU General Data Protection Regulation 2016/679 (“EU GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and United States state privacy laws. “Controller,” “Processor,” “Data Subject,” “Personal Data,” “Process,” and “Personal Data Breach” have the meanings assigned by Applicable Data Protection Law. “Subprocessor” means a third party engaged by MVPGROW to process Customer Personal Data.

Customer is a Controller of Customer Personal Data, or a Processor acting for another Controller. MVPGROW is a Processor for Customer, or a subprocessor when Customer is a Processor. Each party will comply with its obligations under Applicable Data Protection Law.

MVPGROW will process Customer Personal Data only on Customer's documented instructions, including the Agreement, Customer's use and configuration of the Service, and other written instructions consistent with the Agreement. MVPGROW may process as required by law after informing Customer, unless law prohibits notice. If MVPGROW believes an instruction violates Applicable Data Protection Law, it will notify Customer and may suspend the affected processing until the parties resolve the concern.

Customer is responsible for:

• the legality, accuracy, and quality of Customer Personal Data and its instructions;
• providing required privacy notices and establishing a lawful basis for processing;
• obtaining required employee, contractor, communications, or monitoring consent;
• avoiding covert surveillance and unauthorized third-party data capture;
• configuring access, administrators, connections, and capture tools appropriately; and
• responding to Data Subjects where Customer can do so through Service functionality.

Customer may submit sensitive or special-category data, but must determine that doing so is lawful and appropriate and apply required safeguards. The Service is not designed for HIPAA-regulated protected health information, PCI DSS payment-card data, or FERPA student records, and this DPA is not a business associate agreement.

The subject matter, nature, purpose, duration, categories of Personal Data, and Data Subjects are described in Annex I. MVPGROW will not sell Customer Personal Data or share it for cross-context behavioral advertising. MVPGROW will not use identifiable Customer Personal Data to train its own machine-learning models.

MVPGROW may create aggregated or deidentified information only where it cannot reasonably identify or be linked to a person, Customer, or workspace. MVPGROW will maintain that information in deidentified form and will not attempt to reidentify it, except to test the effectiveness of deidentification.

MVPGROW will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations, receive access only as needed for their duties, and process the data only on Customer's instructions unless required by law.

MVPGROW will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, implementation cost, processing context, and risk. Current measures are described in Annex II. MVPGROW may update the measures without materially reducing overall protection of the Service.

MVPGROW will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, with a target of notification within 48 hours. Notification is not an admission of fault. As information becomes available, MVPGROW will provide the nature of the incident, affected data and people, likely consequences, measures taken or proposed, and a contact for follow-up. Information may be delivered in phases. MVPGROW will take reasonable steps to contain, investigate, and remediate the breach.

Customer is responsible for notices to authorities and Data Subjects unless Applicable Data Protection Law assigns that obligation to MVPGROW. MVPGROW will provide reasonable assistance taking into account the nature of processing and information available to it.

Taking into account the nature of processing, MVPGROW will reasonably assist Customer through available functionality and appropriate technical or organizational measures with requests to access, correct, delete, restrict, object, or obtain portability of Customer Personal Data. If MVPGROW receives a request relating to Customer-controlled data, it will direct the requester to Customer and, where permitted, notify Customer. MVPGROW will not independently respond except on Customer's instruction or as required by law.

MVPGROW will provide reasonable information and assistance for Customer's data protection impact assessments, prior consultations with authorities, security obligations, and records of processing, considering the nature of processing and the information available to MVPGROW. Additional assistance that is unusually burdensome or unrelated to a failure by MVPGROW may be subject to reasonable fees agreed in advance.

Customer gives MVPGROW general written authorization to engage Subprocessors. Current Subprocessors and their functions are listed at kollate.ai/subprocessors. MVPGROW will impose written data-protection obligations that are no less protective in substance than those required by this DPA for the relevant processing. MVPGROW remains responsible for each Subprocessor's performance of its obligations to the extent required by Applicable Data Protection Law.

Before a new Subprocessor begins processing Customer Personal Data, MVPGROW will provide reasonable advance notice by emailing the registered workspace administrator or updating the public list. Customer may object on legitimate data-protection grounds by emailing dpa@mvpgrow.com promptly after notice. The parties will work in good faith on a reasonable solution. If no solution is reasonably available, either party may terminate the affected portion of the Service, and MVPGROW will refund prepaid fees for the terminated period. This section does not create a fixed notice period.

Customer authorizes processing in countries where MVPGROW and its Subprocessors operate. MVPGROW's primary Supabase database for the Service is hosted in EU Central 1 (Frankfurt). Other processing may occur in the United States and elsewhere.

If a valid alternative transfer mechanism applies, the parties may rely on it. If a transfer provision conflicts with the EU SCCs or mandatory law, the EU SCCs or mandatory law controls.

Unless prohibited by law, MVPGROW will notify Customer of a legally binding demand for Customer Personal Data. MVPGROW will review demands for validity, challenge unlawful or overbroad demands where there are reasonable grounds, and disclose only the minimum data legally required. MVPGROW will document and respond to requests consistently with the applicable transfer terms.

On reasonable written request, MVPGROW will provide information reasonably necessary to demonstrate compliance with this DPA, including available security documentation, questionnaires, or independent reports. Customer may conduct one audit per year, and additional audits following a material Personal Data Breach or when required by a supervisory authority. Audits must be coordinated in advance, occur during business hours, avoid unreasonable disruption, protect other customers' information, and use an independent auditor bound by confidentiality. On-site inspection is available only when legally required or when documentary review cannot reasonably demonstrate compliance. Customer bears audit costs unless the audit finds a material breach by MVPGROW.

During the term, Customer may request deletion through available controls or at dpa@mvpgrow.com. After termination, Customer may request an export for 30 days. MVPGROW will delete production copies within 30 days after that window and backup copies will cycle out within 90 days after production deletion, unless law requires retention. Retained data remains protected by this DPA and is not used for other purposes. Deidentified data that cannot reasonably be linked back is not Customer Personal Data.

Each party's liability under this DPA is subject to the exclusions and limitations in the Agreement, except to the extent those limits are prohibited by Applicable Data Protection Law or the EU SCCs. This DPA ends when MVPGROW no longer processes Customer Personal Data, except provisions that by their nature must survive.

• Encryption: TLS for data in transit and encryption at rest provided by the hosting and database infrastructure.
• Tenant isolation: database row-level security and organization-scoped authorization controls designed to separate customer workspaces.
• Access control: role-based access, least-privilege administrative access, authenticated sessions, and confidentiality obligations.
• Capture security: hashed connection tokens, HMAC-signed requests, time-limited replay protection, payload limits, and server-side credential handling.
• Data minimization: supported capture tools are designed to retain user and assistant text while excluding tool calls and outputs, hidden reasoning, images, and attachments.
• AI safeguards: optional analysis only when invoked by an authorized user, automated redaction of common secret patterns before provider transmission, and provider contractual controls.
• Logging: operational logging designed to avoid conversation content, with security and diagnostic access limited by role and need.
• Resilience: managed cloud infrastructure, backups, monitoring, incident investigation, and restoration procedures appropriate to the Service.
• Lifecycle controls: procedures for account termination, export, production deletion, backup expiry, and legal holds.
• Vendor management: diligence, written data-protection terms, access limitations, and review of material Subprocessors.

The authorized Subprocessors, locations, and processing functions are maintained on the public Subprocessor List, which is incorporated into this DPA. Customer has given general authorization subject to Section 11.

Questions and requests concerning this DPA should be sent to the privacy contact below. The person accepting the Agreement for Customer represents that they are authorized to enter into this DPA for Customer.