Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the Spekco Terms of Service available at spekco.com/terms, as updated from time to time, or any other agreement between Customer and Spekco governing Customer's use of the Service (the "Agreement"). This DPA is an agreement between the business that has accepted the Agreement ("Customer", "you" or "your") and 440 Technologies LLC, a Missouri limited liability company doing business as Spekco ("Spekco"). It becomes binding when Customer accepts the Agreement or this DPA. Unless otherwise defined in this DPA or in the Agreement, capitalized terms used in this DPA have the meanings given to them in Section 18.

1. Data Processing

1.1Scope and Roles. This DPA applies when Customer Data is processed by Spekco. In this context, Spekco acts as processor to Customer, who can act either as controller or processor of Customer Data.

1.2Customer Controls. Customer can use the Service Controls to assist it with its obligations under Applicable Data Protection Law, including its obligations to respond to requests from data subjects. If Spekco becomes aware that Customer Data transferred under the Standard Contractual Clauses is inaccurate or outdated, it will inform Customer without undue delay, and will cooperate with Customer to erase or rectify it by providing the Service Controls that Customer can use to do so.

1.3Details of Data Processing. The subject matter, duration, nature and purpose of the processing, the types of Customer Data and the categories of data subjects are set out in Annex 1.

1.4Compliance with Laws. Each party will comply with all laws, rules and regulations applicable to it and binding on it in the performance of this DPA, including Applicable Data Protection Law.

2. Customer Instructions

The parties agree that this DPA and the Agreement (including Customer providing instructions through the Service's settings and features) constitute Customer's documented instructions regarding Spekco's processing of Customer Data ("Documented Instructions"). Spekco will process Customer Data only in accordance with Documented Instructions, including with regard to transfers of Customer Data to a third country or an international organization, unless the law Spekco is subject to requires otherwise, in which case Spekco will inform Customer of that legal requirement before processing unless the law prohibits it. Additional instructions outside the scope of the Documented Instructions (if any) require prior written agreement between Spekco and Customer, including agreement on any additional fees payable by Customer to Spekco for carrying them out. Customer is entitled to terminate this DPA and the Agreement if Spekco declines to follow instructions requested by Customer that are outside the scope of, or changed from, those given or agreed to be given in this DPA. If Spekco forms the opinion that a Documented Instruction infringes Applicable Data Protection Law, it will immediately inform Customer, in which case Customer is entitled to withdraw or modify its Documented Instructions.

3. Confidentiality of Customer Data

Spekco will not access or use, or disclose to any third party, any Customer Data, except, in each case, as necessary to maintain or provide the Service, or as necessary to comply with the law or a valid and binding order of a governmental body (such as a subpoena or court order). If a governmental body sends Spekco a demand for Customer Data, Spekco will attempt to redirect the governmental body to request that data directly from Customer. As part of this effort, Spekco may provide Customer's basic contact information to the governmental body. If compelled to disclose Customer Data to a governmental body, Spekco will give Customer reasonable notice of the demand to allow Customer to seek a protective order or other appropriate remedy, unless Spekco is legally prohibited from doing so. As of the date of this DPA, Spekco has not received any such demand.

4. Confidentiality Obligations of Spekco Personnel

Spekco restricts its personnel from processing Customer Data without authorization by Spekco as described in the Security Standards. Spekco imposes appropriate contractual obligations on its personnel, including relevant obligations regarding confidentiality, data protection and data security.

5. Security of Data Processing

5.1Spekco has implemented and will maintain the technical and organizational measures for the Service as described in the Security Standards (Annex 2). Spekco may update them as technology and threats change, provided that an update does not materially reduce the overall protection of Customer Data.

5.2Customer can elect to implement further measures to protect Customer Data using the Service Controls, including: role-based permissions for its users; requiring two-factor authentication for every staff user; removing access promptly when someone leaves; and keeping its own exports of Customer Data.

6. Sub-processing

6.1Authorized Sub-processors. Customer provides general authorization to Spekco's use of sub-processors to provide processing activities on Customer Data on behalf of Customer ("Sub-processors") in accordance with this Section. The Spekco website (currently posted at spekco.com/subprocessors) lists the Sub-processors currently engaged by Spekco; Annex 3 shows the list at the date of this DPA. At least 30 days before Spekco engages a new Sub-processor, Spekco will update that website and notify Customer by email sent to its account administrators. To object to a Sub-processor, Customer can: (i) terminate the Agreement pursuant to its terms; or (ii) cease using the part of the Service for which Spekco has engaged the Sub-processor. Neither entitles Customer to a refund.

6.2Sub-processor Obligations. Where Spekco authorizes a Sub-processor as described in Section 6.1: (i) Spekco will restrict the Sub-processor's access to Customer Data to what is necessary to provide or maintain the Service, and will prohibit the Sub-processor from accessing Customer Data for any other purpose; (ii) Spekco will enter into a written agreement with the Sub-processor and, to the extent that the Sub-processor performs the same data processing services provided by Spekco under this DPA, will impose on the Sub-processor the same contractual obligations that Spekco has under this DPA; and (iii) Spekco will remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Sub-processor that cause Spekco to breach any of its obligations under this DPA.

6.3A Third-Party Service that Customer connects under its own account (for example its own Stripe, Square, QuickBooks, EasyPost or PrintNode account) is not a Sub-processor. It acts for Customer under Customer's own agreement with it.

7. Spekco Assistance with Data Subject Requests

Taking into account the nature of the processing, the Service Controls (including the tools for viewing, correcting, exporting and erasing data) are the technical and organizational measures by which Spekco will assist Customer in fulfilling Customer's obligations to respond to data subjects' requests under Applicable Data Protection Law. If a data subject makes a request to Spekco, Spekco will promptly forward it to Customer once Spekco has identified that the request is from a data subject for whom Customer is responsible. Customer authorizes Spekco to respond to any data subject who makes a request to Spekco, to confirm that Spekco has forwarded the request to Customer. The parties agree that Customer's use of the Service Controls, and Spekco forwarding data subjects' requests to Customer under this Section, represent the scope and extent of Customer's required assistance. Spekco may agree to provide further help at Customer's cost.

8. Customer Responsibilities

Customer is responsible for: (a) properly configuring the Service, including user access, roles and two-factor authentication; (b) using the Service Controls to keep the copies of Customer Data it needs (for example regular exports); (c) taking such steps as Customer considers adequate to maintain appropriate security, protection and deletion of Customer Data within its account; and (d) the accuracy, quality and lawfulness of Customer Data, the means by which Customer obtained it, and giving any privacy notice the law requires. The Service is not designed for special category data or criminal-offense data, and Customer will not enter it, or full payment card numbers, card security codes, bank account credentials, government identification numbers or health information. Any indemnity Customer gives under the Agreement covers claims arising from Customer Data, including processing Customer instructs that breaches Applicable Data Protection Law.

9. Security Incident Notification

9.1Security Incident. Spekco will (a) notify Customer of a Security Incident without undue delay after becoming aware of it, and (b) take appropriate measures to address the Security Incident, including measures to mitigate any adverse effects resulting from it.

9.2Spekco Assistance. To enable Customer to notify a Security Incident to supervisory authorities or data subjects (as applicable), Spekco will cooperate with and assist Customer by including in the notification under Section 9.1(a) such information about the Security Incident as Spekco is able to disclose, taking into account the nature of the processing, the information available to Spekco, and any restrictions on disclosing the information, such as confidentiality.

9.3Unsuccessful Security Incidents. Customer agrees that: (i) an unsuccessful Security Incident is not subject to this Section 9. An unsuccessful Security Incident is one that results in no unauthorized access to Customer Data or to any of Spekco's systems storing Customer Data, and could include, without limitation, pings and other attacks on firewalls or edge servers, port scans, unsuccessful log-on attempts, denial-of-service attacks or similar incidents; and (ii) Spekco's obligation to report or respond to a Security Incident under this Section 9 is not and will not be construed as an acknowledgement by Spekco of any fault or liability with respect to it.

9.4Communication. Notifications of Security Incidents, if any, will be delivered to one or more of Customer's account administrators by any means Spekco selects, including by email. It is Customer's sole responsibility to ensure its administrators' contact information in the Service is accurate.

9.5Notification Obligations. If Spekco notifies Customer of a Security Incident, or Customer otherwise becomes aware of any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data, Customer is responsible for (a) determining whether there is any resulting notification or other obligation under Applicable Data Protection Law, and (b) taking the necessary action to comply with it. This does not limit Spekco's obligations under this Section 9.

9.6Customer-caused incidents. If Spekco becomes aware of an incident caused by the acts or omissions of Customer or its users, such as compromised account credentials, Spekco will tell Customer without undue delay. Customer is responsible for responding to it, and any help Spekco gives beyond that notice is at Customer's cost.

10. Information and Audits

10.1Information. On Customer's written request at reasonable intervals, and subject to reasonable confidentiality protections, Spekco will provide information that shows its compliance with this DPA, such as the Security Standards, Spekco's written security overview and answers to a reasonable security questionnaire. This information will also assist Customer with any data protection impact assessment or prior consultation that Applicable Data Protection Law requires of it.

10.2Records. Spekco will keep records sufficient to show it complies with this DPA for one year after the Agreement ends, and Customer may review them remotely on reasonable notice.

10.3Customer Audits. If the information in Section 10.1 is not reasonably sufficient under Applicable Data Protection Law, Customer, or an independent auditor it appoints that is bound by confidentiality, may audit Spekco's compliance with this DPA, including by inspection, provided that: Customer gives reasonable prior written notice; the audit is not unreasonably disruptive, takes place during business hours and is remote where practical; it happens no more than once per calendar year, unless a supervisory authority requires it or it follows a Security Incident; it is restricted to data relevant to Customer; and Customer bears its costs, including reimbursing Spekco for time spent. Audits under the Standard Contractual Clauses are carried out under this Section.

11. Transfers of Personal Data

11.1Location. Spekco and its Sub-processors process Customer Data in the United States, except as Annex 3 sets out.

11.2Application of Standard Contractual Clauses. The Standard Contractual Clauses apply to Customer Data subject to the EU GDPR or the UK GDPR that is transferred, either directly or via onward transfer, to a country not recognized as providing an adequate level of protection (each a "Data Transfer"). When Customer is acting as a controller, the Controller-to-Processor Clauses apply; when Customer is acting as a processor, the Processor-to-Processor Clauses apply. For Data Transfers from the United Kingdom, those clauses apply as amended by the UK Addendum. Annex 4 completes them.

11.3Execution. By accepting the Agreement or this DPA, the parties are treated as having signed the Standard Contractual Clauses and the UK Addendum, including their annexes.

11.4Alternative Transfer Mechanism. The Standard Contractual Clauses will not apply to a Data Transfer if Spekco has adopted an alternative recognized compliance mechanism for lawful Data Transfers. If a mechanism in this DPA ceases to be valid, Spekco may by notice put in place an alternative that Applicable Data Protection Law permits.

12. Termination of the DPA

This DPA will continue in force until the termination of the Agreement (the "Termination Date") and, after that, for as long as Spekco processes Customer Data.

13. Return or Deletion of Customer Data

13.1At any time up to the Termination Date, and during the restore window of at least 30 days after Customer cancels or closes its account, Customer can use the Service Controls to export Customer Data. On Customer's request during that time, Spekco will also provide a copy of Customer Data that the Service Controls do not export, such as photos and attached files.

13.2Within 90 days after the restore window ends, Spekco will delete Customer Data from its live systems, unless the law requires Spekco to keep it, and will confirm the deletion in writing on Customer's request. Copies in Spekco's and its Sub-processors' backups and logs are deleted as they expire on their normal schedules, and remain protected under this DPA until then.

14. Duties to Inform

Where Customer Data becomes subject to confiscation during bankruptcy or insolvency proceedings, or similar measures by third parties while being processed by Spekco, Spekco will inform Customer without undue delay. Spekco will, without undue delay, notify all relevant parties in such action (for example, creditors or a bankruptcy trustee) that any Customer Data subject to those proceedings is Customer's property and area of responsibility, and that Customer Data is at Customer's sole disposition.

15. Spekco as Controller; CCPA

15.1For Account Data and Usage Data, Spekco is an independent controller, not a joint controller with Customer. Spekco uses that data to manage its relationship with Customer; for billing, accounting, tax and audit; to secure the Service and to detect and prevent fraud and abuse; to verify identity; to meet its legal obligations; and to provide, maintain and improve the Service, including by creating aggregated or de-identified information that does not identify Customer, its End Users or any individual. The Privacy Policy describes that processing.

15.2As far as the CCPA applies to Customer Data, Spekco is a service provider. Spekco will not sell or share Customer Data (as the CCPA defines those terms), and will not retain, use or disclose it except to provide the Service under the Agreement or as the CCPA otherwise permits. Spekco certifies that it understands these restrictions.

16. Entire Agreement; Conflict; Liability

This DPA incorporates the Standard Contractual Clauses and the UK Addendum by reference. Except as amended by this DPA, the Agreement will remain in full force and effect. If there is a conflict between the Agreement and this DPA, the terms of this DPA will control on the processing of Customer Data. Nothing in this document varies or modifies the Standard Contractual Clauses or the UK Addendum. Claims under this DPA are subject to the exclusions and limitations of liability in the Agreement, to the extent Applicable Data Protection Law and the Standard Contractual Clauses permit.

17. Changes and Governing Law

Spekco may update this DPA. For a change that materially reduces the protection of Customer Data, Spekco will give at least 30 days' notice, and such a change may be made only where Applicable Data Protection Law, a regulator's guidance or a change to the Service requires it. This DPA is governed by the law that governs the Agreement, except where Applicable Data Protection Law or the Standard Contractual Clauses require otherwise; the UK Addendum is governed by the laws of England and Wales.

18. Definitions

Unless otherwise defined in the Agreement, capitalized terms used in this DPA have the meanings given to them below:

• "Account Data" means personal data about Customer's relationship with Spekco, such as the names and contact details of Customer's administrators and users, billing information, and correspondence with Spekco, including support requests.
• "Applicable Data Protection Law" means all laws and regulations applicable to and binding on the processing of Customer Data by a party, including, as applicable, the EU GDPR, the UK GDPR, the UK Data Protection Act 2018 and the California Consumer Privacy Act as amended (the "CCPA").
• "Controller-to-Processor Clauses" and "Processor-to-Processor Clauses" mean Module Two and Module Three respectively of the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (together, with the UK Addendum where it applies, the "Standard Contractual Clauses").
• "Customer Data" means the personal data in the content Customer and its users submit to or collect through the Service, processed by Spekco on Customer's behalf. It does not include Account Data or Usage Data.
• "EU GDPR" means Regulation (EU) 2016/679, and "UK GDPR" means that Regulation as it forms part of the law of the United Kingdom.
• "Security Incident" means a breach of Spekco's security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data.
• "Security Standards" means the security standards in Annex 2.
• "Service Controls" means the controls, including security features and functionalities, that the Service provides, as described in its help documentation.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, template Addendum B.1.0 issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as revised under Section 18 of its Mandatory Clauses.
• "Usage Data" means data about how the Service is used and performs, such as feature use, activity and error logs, and security signals.
• "controller", "processor", "data subject" and "processing" have the meanings given to them in the EU GDPR and the UK GDPR.

Annex 1. Details of Data Processing

Annex 2. Security Standards

1. Information Security Program. Spekco maintains an information security program designed to (a) help Customer secure Customer Data against accidental or unlawful loss, access or disclosure, (b) identify reasonably foreseeable risks to the security and availability of the Service, and (c) minimize security risks, including through risk assessment and testing. Spekco designates a person who is accountable for the program. The program includes the following measures.

1.1 Logical Security

• Access Controls. The Service's production systems are accessible only to authorized Spekco personnel, and only as necessary to maintain and provide the Service. The production database is not reachable from the internet; it is reached only over a private network connection, and operator access goes through an audited session on the cloud provider. Each customer's data is tied to its account, every query is scoped to that account, and automated tests check that one account cannot reach another's data.
• Restricted User Access. Production access follows least-privilege principles, with separate cloud accounts and roles for the test and production environments. Multi-factor authentication protects the cloud provider's root account, the database provider account and the Spekco platform administration console.
• Customer Authentication. Staff users can use two-factor authentication, and Customer can require it for every staff user. Staff passwords have at least 12 characters with complexity rules and expire after 365 days; customer portal passwords have at least 8 characters; all passwords are stored as bcrypt hashes; sign-in and other sensitive endpoints are rate-limited.
• Encryption. Data is encrypted in transit (HTTPS/TLS only) and at rest (database storage encryption and server-side encryption for stored files). Payment and integration credentials and two-factor secrets also get application-layer AES-256-GCM encryption.
• Network and Application Security. A web application firewall with managed rule sets sits in front of the Service, and application servers accept traffic only through the content delivery network. The Service sends security headers, including a Content Security Policy. Automated dependency vulnerability alerts run, and a deployment gate refuses known-vulnerable production dependencies.
• Security Testing. Spekco carries out internal penetration testing of the Service, most recently in October 2026, and tracks the findings in its issue log until they are resolved.
• Change Management. Changes are normally tested in a separate test environment, with automated tests, before they are released to production.
• Monitoring and Incident Management. Cloud API activity is logged, threat detection runs in all regions, and security posture checks run, with alerts sent to Spekco's on-call engineer. Spekco maintains a documented incident response plan.
• Business Continuity. Nightly database backups are held under a lock that prevents deletion or alteration, with an off-site copy held by a second provider in the United States. The database supports point-in-time recovery, deleted or replaced files can be recovered for a limited period, and backups are restore-tested.

1.2 Physical Security

• The Service runs in Amazon Web Services data centers. Physical security, redundancy and media disposal are provided by AWS under its own security standards and independent certifications.

1.3 Personnel

• Spekco personnel with access to Customer Data are bound by confidentiality obligations and have access only as needed to provide, secure and support the Service.

2. Continued Evaluation. Spekco periodically reviews its information security program and updates it as necessary to respond to new security risks and to take advantage of new technologies.

Annex 3. Sub-processors

The current list is published at spekco.com/subprocessors. At the date of this DPA it is:

Spekco also uses Stripe, Inc. (USA) to bill Customer for the Service. Spekco is the controller of that billing data (Account Data), so Stripe is not a Sub-processor under this DPA.

Annex 4. Completion of the Standard Contractual Clauses and the UK Addendum