Data Processing Agreement

Effective August 17, 2026

This Data Processing Agreement (”DPA”) is incorporated into and forms part of the Master Subscription Agreement, Order Form(s), or other written agreement governing Constructor's provision of the Services to Customer (the “Principal Agreement”) by and between Constructor.io Corporation, a Delaware corporation, with offices at 268 Bush Street #4450, San Francisco, CA 94104-3503 (“Constructor”) and the customer identified in the applicable Principal Agreement, Proof Schedule, account registration, web form submission, or online acceptance flow (“Customer”) (each a “Party” and together, the “Parties”); and applies to any and all provision of Services by Constructor to Customer, including as part of a pre-contractual “Proof Schedule” arrangement (or similar proof of concept offering). This DPA becomes binding on the date Customer executes or accepts the Principal Agreement, begins to send Constructor Personal Data to facilitate a Proof Schedule (or similar proof of concept offering), or first accesses or uses the Services, whichever occurs first (the “Effective Date”). Capitalized terms not defined herein shall have the meanings set forth in the Principal Agreement.

These additional terms set out in Section 13 of this DPA shall only apply to “Personal Information” of a “Consumer” that Constructor Processes in the course of providing Customer the Services under the Principal Agreement (referred to hereafter as “Customer Personal Information”). Capitalized terms identified in this Section 13 shall have the same meaning as defined in the CCPA, unless otherwise noted.

ANNEX I

A. LIST OF PARTIES

Data exporter(s): Customer, as identified in the applicable Principal Agreement, account registration, web form submission, or other online acceptance flow. Customer's contact details, and where applicable the contact details of its data protection officer and/or representative in the European Union, will be provided by Customer through Constructor's web forms, dashboard, account records, or other commercially reasonable means and maintained by Constructor in its account records. Customer may update its contact details through the Constructor dashboard or by contacting Constructor.

• Company name: Customer, as identified in the applicable Principal Agreement, account registration, web form submission, or other online acceptance flow.
• Address: as provided by Customer through the applicable Principal Agreement, account registration, web form submission, Constructor dashboard, or other online account records maintained by Constructor.
• Contact person’s name, position and/or email: as provided by Customer through Constructor's web forms, dashboard, account records, or other commercially reasonable means and maintained by Constructor in its account records.
• Role (controller/processor): The parties acknowledge and agree that with regard to the processing of Personal Data, the Customer is acting as the Data Controller (Module 2).

Data importer(s): [Identity and contact details of the data importer(s), including any contact person with responsibility for data protection]

• Company name: Constructor.io Corporation
• Address: 268 Bush Street #4450, San Francisco, CA 94104 United States
• Contact person’s name, position and contact details: Dan McCormick, CISO, privacy@constructor.io
• Role (controller/processor): The parties acknowledge and agree that with regard to the processing of Personal Data, Constructor is acting as a Data Processor (Module 2).

B. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred

Customer may submit Customer Personal Data to Constructor for the provision of the Services, which may include, but is not limited to Customer Personal Data relating to the following categories of data subjects:

• Customer employees with access to the Constructor dashboard and/or support channels
• Visitors to Customer Properties utilizing Constructor’s Service

Categories of personal data transferred

Customer may submit (or Constructor may collect at Customer’s direction) Customer Personal Data to Constructor for the provision of the Services, the extent of which is determined by Customer in its sole discretion, which may include the following categories of Customer Personal Data:

• For Customer employees and contractors with access to the Constructor dashboard and/or support channels:
  • Email address (and other contact information that may be provided by such users from time to time)
  • IP Address
• For visitors to Customer Properties utilizing Constructor’s Services:
  • IP Address
  • Other non-sensitive personal data that may be provided by Customer to Constructor from time to time.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

N/A

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Continuous, for the duration of the Principal Agreement.

Nature of the processing

For Constructor to provide Services in accordance with the Principal Agreement.

Purpose(s) of the data transfer and further processing

Customer Personal Data is transferred for the purpose of provision of the Services by Constructor to Customer pursuant to the Principal Agreement.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

Customer Personal Data will be retained in accordance with Section 10 of this DPA (Deletion or Return of Customer Personal Data)

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

The subject matter, nature and duration of the processing shall be as specified in the Sub-processor List.

C. COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13

In respect of the EU SCCs, means the competent supervisory authority determined in accordance with Clause 13 of the EU SCCs. In respect of the UK SCCs, means the UK Information Commissioner's Office.

ANNEX II – TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

The technical and organizational security measures are based on Constructor’s Security Terms and Conditions applicable to the Services and may be modified from time to time, however any update will not materially reduce the overall protections provided herein.

Measures of pseudonymisation and encryption of personal data:

Constructor maintains Customer Data in an encrypted format at rest using AES-256 or equivalent and in transit over public networks using industry standard HTTPS/TLS (1.2 or higher).

Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services:

Constructor’s customer agreements contain strict confidentiality obligations. Constructor’s personnel and subcontractors authorized to Process Personal Data are subject to confidentiality obligations substantially equivalent with the ones Constructor committed to in the Principal Agreement or are under an appropriate statutory obligation of confidentiality. Constructor has a business continuity plan designed to maintain service and/or recovery from reasonably foreseeable emergency situations or disaster. Customer Data is securely backed up on a regular basis. Constructor infrastructure spans multiple fault-independent availability zones on its hosting provider and is supported by various tools and processes designed to maintain availability and resiliency of Services.

Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident:

Constructor performs regular backups and live replicas of Customer Data, which is hosted in third-party cloud provider data centers. Backups are retained redundantly across multiple availability zones and encrypted in transit and at rest.

Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing:

Constructor maintains a comprehensive information security program, including administrative, organizational, technical, and physical safeguards reasonably designed to protect the Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. As set out in Section 5 of the DPA, Constructor’s security program is intended to be appropriate to the nature of the Services and the size and complexity of Constructor’s business operations. Constructor has a separate and dedicated security team that manages the Constructor security program. This team facilitates and supports independent audits and assessments performed by third parties to provide independent feedback on the operating effectiveness of the information security program.

Measures for user identification and authorisation:

Constructor personnel are required to use unique user access credentials and multi-factor authentication for authorization related to Customer Data. Constructor follows the principles of least privilege through role-based access models when provisioning service or system access. Constructor personnel are authorized to access Customer Data based on their job function, role and responsibilities. Access is promptly removed upon termination.

Measures for the protection of data during transmission:

Customer Data is encrypted when in transit over public networks using industry standard HTTPS/TLS (TLS 1.2 or higher).

Measures for the protection of data during storage:

Customer Data is encrypted at rest using Advanced Encryption Standard (AES-256) or equivalent.

Measures for ensuring physical security of locations at which personal data are processed:

Constructor is a fully distributed organization with no physical premise to secure. Constructor maintains user access policies and procedures which are documented, approved and implemented for maintaining logical access in accordance with least privileges and need to know.

The Constructor Services hosted on data servers owned by third party cloud provider(s) are protected by the security and environmental controls of such cloud provider(s). Our third party cloud provider(s) is SOC 1,2,3, ISO 27001/27017/27018, and PCI-DSS compliant.

Measures for ensuring events logging:

Constructor monitors access to applicable Constructor applications, tools, and resources that process or store Customer Data as follows:

• Logs recording privileged user access activities, authorized and unauthorized access attempts, system exceptions, and information security events are retained, complying with applicable laws and regulations.
• Logs are reviewed regularly and network intrusion detection (IDS) tools implemented to help facilitate timely detection.
• Physical and logical user access to log files are restricted to authorized personnel.

Measures for ensuring system configuration, including default configuration:

Constructor maintains programmatic configuration baselines for Constructor systems supporting the production data processing environment. Changes to these baselines are restricted to a small number of authorized Constructor personnel, and are required to adhere to internal change control processes.

Measures for internal IT and IT security governance and management:

Constructor maintains internal policies on the acceptable use of IT systems and general information security. Constructor has implemented and will maintain a security team responsible for ensuring the management of Constructor’s security program. All Constructor personnel with access to Customer Data must complete new hire security awareness training, as well as annual refreshers, that includes the protection of such information.

Measures for certification/assurance of processes and products:

Constructor has a separate and dedicated security team that manages Constructor’s security program, by holding regular independent third-party audits to attest of Constructor’s security-related certifications, including SOC 2 and ISO 27001 certification, and regular application penetration testing.

Measures for ensuring data minimization:

When using Constructor Services, the Customer may submit personal data into the Services and/or Constructor may use its beacon placed on Customer Properties to collect personal data. The Customer determines the personal data that is being inputted into the Services. Constructor truncates the IP addresses of visitors to Customer Properties by removing the last octet shortly after collection. Constructor stores raw logs containing the full IP address, but only the truncated version is used for general service uses (e.g. behavioral tracking).

Measures for ensuring data quality:

As part of Constructor’s security program, Constructor conducts system audits, event logging, and related monitoring procedures to proactively record user access and system activity for routine review. When Constructor's dedicated Security Team becomes aware of an incident, Constructor’s incident response plan guides Constructor’s investigation, response to, and mitigation of any problem related to its Services and information assets.

Measures for ensuring limited data retention:

Upon termination or expiration of the Principal Agreement, Constructor will delete or destroy all copies of Personal Data in Constructor’s systems or otherwise in Constructor’s possession or control, unless legally prohibited or to fulfill a legitimate interest.

Customers can access, update, delete, or correct their account information via the Constructor dashboard or by contacting their Customer Success representative.

Measures for ensuring accountability:

Constructor has implemented and has adopted internal policies and implemented measures across its organization based on the principles of data protection by design and data protection by default. For more detailed information, please refer to Constructor Privacy Policy.

Measures for allowing data portability and ensuring erasure:

The Customer is responsible for responding to requests from their users to exercise their rights under applicable Data Protection Laws, including the right to access, rectification, restriction of Processing, erasure (“right to be forgotten”), data portability, objection to the Processing, or to not be subject to an automated individual decision making. Customers can contact us at privacy@constructor.io to address such requests from the Data Subject. If the Customer, in its use of the Services, does not have the ability to address such request from its Data Subject, Constructor shall, upon Customer’s request, provide commercially reasonable efforts to assist Customer in responding to such Data Subject request, to the extent Constructor is legally permitted to do so and the response to such Data Subject request is required under applicable Data Protection Laws and Regulations.

For transfers to Subprocessors, also describe the specific technical and organisational measures to be taken by the Subprocessor to be able to provide assistance to the controller and, for transfers from a processor to a subprocessor, to the data exporter

When Constructor engages a subprocessor under this DPA, Constructor and the subprocessor enter into an agreement with data protection terms substantially equivalent to those contained herein

ANNEX III – APPROVED SUBPROCESSORS

ANNEX IV - CROSS BORDER DATA TRANSFER MECHANISM

1.1 When Constructor in the provision of the Services is a recipient of Personal Data subject to the GDPR, then Constructor will process such Personal Data outside of the European Economic Area (EEA) or Switzerland. The parties agree that the EU SCCs will apply to Personal Data that is transferred via the Services from the European Economic Area or Switzerland, either directly or via onward transfer, to any country or recipient outside the European Economic Area or Switzerland that is: (a) not recognized by the European Commission (or, in the case of transfers from Switzerland, the competent authority for Switzerland) as providing an adequate level of protection for personal data and (b) not covered by a suitable framework recognized by the relevant authorities or courts as providing an adequate level of protection for personal data, including but not limited to Binding Corporate Rules for Processors.

1.2 For data transfers from the EEA or Switzerland that are subject to the EU SCCs, the EU SCCs will be deemed entered into (and incorporated into this DPA by this reference) and completed as follows:

(i) Where Customer acts as a Data Controller and Constructor acts as Customer’s Data Processor with respect to Personal Data subject to the EU SCCs, Module 2 (Controller to Processor) will apply;

(ii) in Clause 7, the optional docking clause will not apply;

(iii) in Clause 9, option 2 will apply, and the time period for prior notice of Sub-Processor changes shall be as set out in Section 6 (Subprocessing) of this DPA. In Clause 9(c), where confidentiality restrictions prohibit Constructor from providing a copy of a Sub-Processor agreement to Customer, Constructor shall (on a confidential basis) provide all information that it reasonably can in connection with such Sub-Processor Agreement to Customer;

(iv) in Clause 11, the optional language will not apply;

(v) in Clause 12, any claims brought under the EU SCCs shall be subject to the terms and conditions set forth in the Principal Agreement to the extent possible;

(vi) in Clause 13, the supervisory authority shall be as follows:

(a) Where the Customer is established in an EU Member State: the supervisory authority with responsibility for ensuring compliance by Customer with the GDPR as regards the data transfer shall act as competent supervisory authority;

(b) Where the Customer is not established in an EU Member State, but falls within the territorial scope of application of the GDPR in accordance with Article 3(2) and has appointed a representative pursuant to Article 27(1) of the GDPR, the supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of the GDPR is established shall act as competent supervisory authority;

(c) Where the Customer is not established in an EU Member State, but falls within the territorial scope of application of the GDPR in accordance with Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of the GDPR, the Irish Data Protection Commission shall act as competent supervisory authority.

(d) Where the Customer is established in the United Kingdom, the Information Commissioner’s Office shall act as competent supervisory authority.

(vii) in Clause 17, option 1 will apply, and the EU SCCs will be governed by Irish law;

(viii) in Clause 18(b), disputes shall be resolved before the courts of Dublin, Ireland;

(ix) Annex I of the EU SCCs shall be deemed completed with the information set out in Annex 1 to this DPA;

(x) Annex II of the EU SCCs shall be deemed completed with the information set out in Annex 2 to this DPA;

Nothing in this Section 1.2 is intended to conflict with either party’s rights or responsibilities under the EU SCCs and, in the event of any such conflict, the EU SCCs shall prevail.

1.3 The EU Standard Contractual Clauses apply to (i) the legal entity that has executed the Standard Contractual Clauses as a Data Exporter and, (ii) all Affiliates of Customer established within the European Economic Area (EEA) and Switzerland that have purchased subscriptions to the Services on the basis of an Order Form. For the purpose of the EU SCCs and this Section 1.3, the aforementioned entities shall be deemed “Data Exporters”.

2.1 When Constructor in the provision of the Services is a recipient of Personal Data subject to the UK GDPR (and not the law in any EEA jurisdiction), then Constructor will process such Personal Data outside of the UK. The parties agree that the UK SCCs will apply to Personal Data that is subject to the UK GDPR and transferred via the Services from the UK, either directly or via onward transfer, to any country or recipient outside the European Territories that (a) is not recognized by the competent authority as providing an adequate level of protection for personal data, and (b) not covered by a suitable framework recognized by the relevant authorities or courts as providing an adequate level of protection for personal data, including but not limited to Binding Corporate Rules for Processors.

2.2 For data transfers from the UK that are subject to the UK SCCs, the UK SCCs will be deemed entered into (and incorporated into this DPA by this reference) and completed as follows:

(i) In Table 1 of the UK SCCs, the Parties’ details shall be the Parties and their Affiliates to the extent any of them is involved in such transfer, including those set forth in Annex 1, and the Key Contact shall be the contacts set forth in Annex 1.

(ii) In Table 2 of the UK SCCs, the Approved EU SCCs referenced in Table 2 shall be the EU SCCs as executed by the Parties pursuant to this DPA.

(iii) In Table 3 of the UK SCCs, Annex 1A, 1B, and II shall be as set forth in Annex 1.

(iv) In Table 4 of the UK SCCs, either party may end this DPA as set out in Section 19 of the UK SCCs.

(v) By entering into this DPA, the Parties are deemed to be signing the UK SCCs and their applicable Tables and Appendix Information.

3. Additional Safeguards for the Data Transfer and Processing of Customer Personal Data from the EEA, Switzerland, and the United Kingdom: