AccuSights Data Processing Addendum

© 2026 AccuSights, Inc. · 2058 N. Western Ave, Chicago, IL 60647 · +1 (773) 747-7490 · [email protected] (subject "ATTN: Privacy")

This Data Processing Addendum ("DPA") forms part of, and is incorporated by reference into, (a) the AccuSights Terms of Service between AccuSights, Inc. and Customer, and (b) where Customer has executed the AccuSights LLC Protect Services Agreement, that agreement (each, the "Agreement"). The AccuSights entity that is party to the applicable Agreement is "AccuSights" under this DPA for the Services provided under that Agreement. AccuSights, Inc. and AccuSights LLC are separate contracting parties and each is responsible only for its own processing. AccuSights Technology Consultants LLC (Dubai, United Arab Emirates), doing business as AccuSights UAE, operates accusights.ae and is a separate legal entity and a separate data controller for personal data collected through accusights.ae and UAE operations; it is not a party to this DPA or the Agreement, is not a Subprocessor under this DPA, and neither AccuSights, Inc. nor AccuSights LLC is liable for it.

1. Definitions

"Applicable Data Protection Law" means all laws applicable to the Processing of Personal Data under the Agreement, including, as applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations ("CCPA"), other U.S. state comprehensive privacy laws (including those of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others as in effect) ("U.S. State Privacy Laws"), Regulation (EU) 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018 ("UK GDPR"), and the Swiss Federal Act on Data Protection ("FADP").

"Customer Personal Data" means Personal Data contained in Customer Data that AccuSights Processes on Customer's behalf under the Agreement.

"Personal Data," "Processing," "Controller," "Processor," "Data Subject," "Business," "Service Provider," "Contractor," "Consumer," "Sell," "Share" and "Personal Information" have the meanings given in Applicable Data Protection Law. "Personal Data" includes "Personal Information."

"Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in AccuSights' possession or control. Unsuccessful attempts (pings, port scans, blocked intrusion attempts, failed logins) are not Security Incidents.

"Subprocessor" means a third party engaged by AccuSights to Process Customer Personal Data.

"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914, and "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under s.119A of the Data Protection Act 2018.

Capitalized terms not defined here have the meanings in the Agreement.

2. Roles; Scope; Details of Processing

2.1 Roles. Customer is the Controller (or Business) of Customer Personal Data, or, where Customer acts on behalf of its own customers (for example, as an MSP), a Processor acting on documented instructions of its Controller; AccuSights is the Processor (or Service Provider / Contractor). Where Customer is a Processor, Customer warrants that its instructions to AccuSights are authorized by the relevant Controller.

2.2 Details of Processing. Annex 1 describes the subject matter, duration, nature and purpose of Processing, the types of Personal Data and categories of Data Subjects.

2.3 AccuSights as Controller. AccuSights is an independent Controller of (a) account, billing and contact data of Customer's personnel used to administer the relationship, (b) Usage Data, and (c) De-identified Data, each as described in the AccuSights Privacy Policy. This DPA does not apply to that Processing.

3. Customer Instructions; Customer Obligations

3.1 Instructions. AccuSights will Process Customer Personal Data only on Customer's documented instructions, which consist of: the Agreement; this DPA; Customer's configuration of and use of the Services; and other written instructions Customer gives that are consistent with the Agreement. AccuSights will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend the instruction until resolved.

3.2 Customer obligations. Customer is responsible for (a) the lawfulness of its collection and provision of Customer Personal Data, including all required notices and consents; (b) the accuracy and content of its instructions; (c) providing only the Personal Data necessary for the Services; (d) not providing PHI absent a BAA, or CUI absent a CUI Enclave, as stated in the Agreement; and (e) its own compliance with Applicable Data Protection Law as Controller or Business.

4. CCPA Service Provider / Contractor Terms (Cal. Code Regs. tit. 11, § 7051)

To the extent Customer Personal Data includes Personal Information of California Consumers, AccuSights certifies that it understands and will comply with the following:

(a) AccuSights Processes Personal Information only for the limited and specified business purposes described in Annex 1: providing, securing, supporting and improving the Services for Customer, as permitted for a Service Provider or Contractor under CCPA § 1798.140(e) and § 7050.

(b) AccuSights will not Sell or Share Personal Information.

(c) AccuSights will not retain, use or disclose Personal Information (i) for any purpose other than the business purposes specified in Annex 1 and the Agreement, including for any commercial purpose, or (ii) outside the direct business relationship between AccuSights and Customer, except as permitted by the CCPA and its regulations.

(d) AccuSights will not combine Personal Information received from or on behalf of Customer with Personal Information it receives from another person or collects from its own interactions with the Consumer, except as permitted by § 7050(a).

(e) AccuSights will comply with the CCPA and provide the same level of privacy protection as required of Businesses, and will notify Customer if it determines that it can no longer meet its obligations under the CCPA.

(f) Customer has the right to take reasonable and appropriate steps to ensure that AccuSights uses Personal Information consistently with Customer's CCPA obligations (Section 9), and to stop and remediate unauthorized use of Personal Information upon notice.

(g) AccuSights will cooperate with Customer in responding to verifiable Consumer requests (Section 7), and will flow down these obligations to any Subprocessor (Section 6).

(h) AccuSights will not use Personal Information to build or improve profiles of Consumers for use with other customers, except to the extent Personal Information is De-identified in accordance with CCPA § 1798.140(m) and AccuSights publicly commits to maintain and use it only in de-identified form and not to attempt re-identification.

5. GDPR / UK GDPR Processor Terms (Article 28) and International Transfers

5.1 Application. This Section 5 applies only to the extent Customer Personal Data is subject to the GDPR, the UK GDPR or the FADP ("European Data").

5.2 Article 28 obligations. For European Data, AccuSights will: (a) Process only on documented instructions (Section 3.1), including with regard to transfers to third countries, unless required by EU or Member State law, in which case AccuSights will inform Customer before Processing unless the law prohibits it; (b) ensure that persons authorized to Process are bound by confidentiality (Section 8.2); (c) implement the measures in Annex 2 (Article 32); (d) engage Subprocessors only in accordance with Section 6 (Article 28(2) and (4)); (e) assist Customer, taking into account the nature of the Processing, with Data Subject requests (Section 7); (f) assist Customer with security, breach notification, data-protection impact assessments and prior consultation (Articles 32–36), taking into account the information available to AccuSights; (g) delete or return European Data at the end of the Services (Section 10); and (h) make available information necessary to demonstrate compliance and allow for and contribute to audits (Section 9).

5.3 Transfers. Customer Personal Data is Processed in the United States. For transfers of European Data to AccuSights in the United States: (a) the EU SCCs, Module Two (Controller-to-Processor) or, where Customer is a Processor, Module Three (Processor-to-Processor), are incorporated by reference and entered into between Customer (as data exporter) and AccuSights (as data importer), with the following selections: Clause 7 (docking) included; Clause 9 Option 2 (general authorization) with the notice period in Section 6.2; Clause 11 optional language not included; Clause 13 and Annex I.C: the supervisory authority of the Member State in which the data exporter is established; Clause 17 Option 1: the laws of Ireland; Clause 18: the courts of Ireland; Annex I is completed by Annex 1 of this DPA; Annex II by Annex 2; Annex III by Section 6.1; (b) for UK transfers, the UK Addendum is incorporated, with Table 1 completed by the parties' details in the Agreement, Table 2 by the selections above, Table 3 by the Annexes, and Table 4 "neither party"; and (c) for Swiss transfers, the SCCs apply with the modifications required by the Swiss Federal Data Protection and Information Commissioner. AccuSights does not target customers in the European Union or United Kingdom, is not certified under the EU-U.S. Data Privacy Framework, and has not appointed a representative under GDPR Article 27 or UK GDPR Article 27; if AccuSights later becomes certified under the EU-U.S. Data Privacy Framework or its UK Extension, AccuSights may rely on that certification as an alternative transfer mechanism on notice to Customer. In case of conflict between the SCCs and this DPA, the SCCs control for European Data.

5.4 Government access requests. AccuSights will, to the extent legally permitted, notify Customer of any legally binding request for disclosure of European Data by a public authority, challenge requests it reasonably considers unlawful, and disclose only the minimum required.

6. Subprocessors

6.1 Current Subprocessors. Customer generally authorizes AccuSights to engage the Subprocessors listed below, and AccuSights maintains the current list at accusights.com/legal/subprocessors, where Customer may subscribe to change notifications.

Website analytics and advertising tools (Google Tag Manager, Google Analytics 4, Google Ads conversion tag, Microsoft Clarity, Meta Pixel, LinkedIn Insight Tag and Reddit Pixel) operate on the accusights.com public website only, do not Process Customer Personal Data within the Platform, and are described in the AccuSights Cookie Notice and Privacy Policy rather than in this table.

6.2 New Subprocessors. AccuSights will give Customer at least thirty (30) days' notice (via the subscription mechanism or email to Customer's Admins) before authorizing a new Subprocessor to Process Customer Personal Data. Customer may object in writing on reasonable, documented data-protection grounds within that period. The parties will discuss in good faith; if AccuSights cannot reasonably accommodate the objection, Customer may terminate the affected Services on notice and receive a pro-rata refund of prepaid, unused Fees for them, as its sole remedy.

6.3 Flow-down. AccuSights will impose on each Subprocessor, by written contract, data-protection obligations that are no less protective than those in this DPA to the extent applicable to the services the Subprocessor provides, and remains responsible for its Subprocessors' performance.

7. Data Subject and Consumer Requests

AccuSights will, within five (5) business days, forward to Customer any request it receives directly from a Data Subject or Consumer relating to Customer Personal Data, and will not respond except to direct the individual to Customer, unless required by law. Requests relating to Personal Data for which AccuSights is an independent Controller (Section 2.3) are handled under the AccuSights Privacy Policy: they may be submitted by email to [email protected] with the subject "ATTN: Privacy Request" and are answered within forty-five (45) days (extendable once by a further forty-five (45) days where reasonably necessary, with notice), and appeals may be sent to the same address with the subject "ATTN: Privacy Appeal". The Services include self-service features that allow Customer to access, correct, export and delete Customer Personal Data; where Customer cannot fulfill a request using those features, AccuSights will provide reasonable assistance at Customer's request, and may charge its then-current rates for assistance that is excessive or repetitive.

8. Security; Personnel; Security Incidents

8.1 Measures. AccuSights will implement and maintain the technical and organizational measures in Annex 2, and may update them provided the updates do not materially reduce the overall security of the Services.

8.2 Personnel. AccuSights personnel with access to Customer Personal Data are bound by written confidentiality obligations, receive security and privacy training at onboarding and annually, and are subject to background screening as permitted by law.

8.3 Security Incident notice. AccuSights will notify Customer without undue delay, and in any event within seventy-two (72) hours after confirming a Security Incident, by email to Customer's Admins. The notice will describe, to the extent known, the nature of the Security Incident, the categories and approximate number of Data Subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point, and AccuSights will supplement the notice as information becomes available. AccuSights will take reasonable steps to contain, investigate and mitigate the Security Incident and will reasonably cooperate with Customer's own investigation and notification obligations. AccuSights' notice is not an admission of fault or liability. Customer is solely responsible for determining whether, when and how to notify Data Subjects, regulators and other third parties, and for the costs of doing so, subject to the Agreement.

8.4 Customer's security responsibilities. Customer is responsible for securing its own systems, credentials and integrations, for configuring the Services' security features (including MFA and role-based access), and for the security of Customer Personal Data before it is provided to and after it is exported from the Services.

9. Audits and Assessments

9.1 By report. On written request no more than once every twelve (12) months, AccuSights will make available, subject to confidentiality, (a) its most recent SOC 2 report once one is issued (a SOC 2 Type 1 examination of AccuSights is in progress; AccuSights does not currently hold a SOC 2 report; its controls are aligned to NIST CSF 2.0 and CIS Controls v8.1), (b) the executive summary of its most recent independent penetration test, provided under NDA, and (c) responses to a reasonable written security questionnaire (for example, SIG Lite or CAIQ). These reports and responses satisfy Customer's audit rights except as stated in Section 9.2.

9.2 On-site or remote audit. If (a) the materials in Section 9.1 are insufficient to demonstrate compliance with this DPA, (b) a Security Incident has occurred affecting Customer Personal Data, or (c) a supervisory authority requires an audit, Customer (or an independent auditor bound by confidentiality and reasonably acceptable to AccuSights, not a competitor of AccuSights) may conduct an audit of AccuSights' relevant facilities, systems and records, no more than once per twelve (12) months, on at least thirty (30) days' written notice, during business hours, in a manner that does not unreasonably disrupt AccuSights' operations or compromise other customers' data, and at Customer's cost, including AccuSights' reasonable time at its then-current rates. Customer will share findings with AccuSights and treat them as AccuSights' Confidential Information.

9.3 CCPA. The rights in this Section 9 constitute Customer's "reasonable and appropriate steps" under CCPA § 1798.100(d) and § 7051(a)(7).

10. Return and Deletion

On expiration or termination of the Agreement, Customer may export Customer Personal Data during the Export Window under the Agreement (thirty (30) days). Thereafter, AccuSights will delete or de-identify Customer Personal Data in production systems beginning sixty (60) days after termination and purge it from backups within ninety (90) days after termination, in accordance with the Agreement, except where retention is required by law, in which case AccuSights will continue to protect the retained data under this DPA and Process it only for the purpose of the retention requirement. On request, AccuSights will certify deletion in writing.

11. Liability

Each party's liability under or in connection with this DPA (including the SCCs, to the extent permitted by them) is subject to the exclusions and limitations of liability in the Agreement, and the cap in the Agreement applies to liability under the Agreement and this DPA together, not separately. Nothing in this DPA limits liability that cannot be limited under Applicable Data Protection Law. AccuSights, Inc. and AccuSights LLC are each liable only for their own Processing under their own Agreement.

12. General

12.1 Precedence. For the Processing of Customer Personal Data, this DPA controls over the Agreement in case of conflict; the SCCs control over this DPA for European Data.

12.2 Changes. AccuSights may update this DPA in accordance with the amendment provisions of the Agreement, including to reflect changes in Applicable Data Protection Law or new transfer mechanisms.

12.3 Term. This DPA remains in effect for as long as AccuSights Processes Customer Personal Data.

12.4 Governing law. This DPA is governed by the law governing the Agreement (Illinois), except that the SCCs are governed as stated in Section 5.3.

Annex 1 — Details of Processing (SCC Annex I)

Annex 2 — Security Measures (SCC Annex II)

AccuSights maintains an information-security program aligned to the NIST Cybersecurity Framework 2.0, covering the following functions: