Data Processing Addendum

AskTheo Data Processing Addendum

Exhibit B to the AskTheo Terms of Use · Effective: August 31, 2026

This Data Protection Addendum (“DPA”) is Exhibit B to, and forms part of, the AskTheo Terms of Use between HarrisX LLC (“HarrisX”) and Customer (“Customer”) for HarrisX’s provision of Services (the “Terms” or the “Agreement”). In the event of any conflict between the terms of this DPA and the other terms of this Agreement, this DPA will govern. It applies where HarrisX processes personal data contained in Customer Data (as defined in the Terms) on Customer’s behalf. References in this DPA to “Customer” mean “you” as defined in the Terms.

Definitions

1. In this DPA:
   1. “Applicable Law” means all laws, regulations and other legal requirements applicable to either (i) HarrisX as provider of the Services or (ii) Customer as user of the Services. For example, to the extent applicable, this includes the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”); equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the UK General Data Protection Regulation (“UK Data Protection Law”); the Swiss Federal Act on Data Protection (“Swiss FADP”); the California Consumer Privacy Act, as amended by the California Privacy Rights Act and together with associated regulations (“CCPA”); as well as U.S. state laws similar to the CCPA (together with the CCPA, as they become effective, the “U.S. State Privacy Laws”).
   2. “Designated Contact Address” means the email address Customer designates for legal notices in an Order or, if none, the email address associated with Customer’s AskTheo account.
   3. “Personal Data” means any information relating to an identified or identifiable individual, within the meaning of the GDPR (regardless of whether the GDPR applies), any information that qualifies as “personal information” under the CCPA (regardless of whether the CCPA applies) and any other information defined as “personal information,” “personal data,” or an analogous term in Applicable Law.
   4. “Personal Data Breach” means the accidental or unlawful destruction, loss, alteration, disclosure or other Processing of, or access to, Personal Data.
   5. “Process” and “Processing” mean any operation or set of operations performed on data, whether or not by automated means, such as collection, recording, organization, creating, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
   6. “Standard Contractual Clauses” refers to the clauses issued pursuant to the EU Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, available at http://data.europa.eu/eli/dec_impl/2021/914/oj and completed as described in the “Data Transfers” section below.
   7. “Subprocessor” means a subcontractor engaged by HarrisX for the Processing of Personal Data.
   8. “UK SCC Addendum” means the United Kingdom International Data Transfer Addendum to the EU Commission Standard Contractual Clauses at https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf completed as described in the “Data Transfers” section below.
2. For ease of reading, some other terms are defined later in the DPA.

Scope, Relationship of the Parties, and Data Use Limitations

1. Unless required by Applicable Law, HarrisX will Process the Personal Data only to (i) provide and ensure the proper operation the Services; and (ii) carry out Customer’s reasonable written instructions that are consistent with this Agreement. Without limiting the foregoing, HarrisX:
   1. shall not “sell” the Personal Data, as such term is defined in the U.S. State Privacy Laws (regardless of whether such laws apply);
   2. shall not “share” the Personal Data, as such term is defined in the CCPA (regardless of whether the CCPA applies) or otherwise disclose it for targeted advertising purposes;
   3. shall not retain, use, or disclose any such data outside of the direct business relationship between Customer and HarrisX, or for any purpose (including any commercial purpose) other than the limited business purposes specified in this DPA;
   4. shall comply with any applicable restrictions under Applicable Law on combining the Personal Data that HarrisX receives from, or on behalf of, Customer with Personal Data that HarrisX receives from, or on behalf of, another person or persons, or that HarrisX collects from any other interaction between HarrisX and a data subject;
   5. shall provide the same level of protection for the Personal Data subject to the CCPA as is required under the CCPA; and
   6. hereby certifies that it understands the restrictions and obligations set forth in this DPA and that it will comply with them.
2. If Applicable Law requires HarrisX to engage in Processing not permitted by the above, HarrisX will first inform Customer of the relevant legal requirement unless Applicable Law prohibits such notification. HarrisX will notify Customer as soon as legally permissible if, for any other reason, HarrisX determines that HarrisX can no longer meet its obligations under Applicable Law.
3. Customer has the right to take reasonable and appropriate steps to (a) ensure that HarrisX is using the Personal Data consistent with Customer’s obligations under Applicable Law, and (b) stop and remediate unauthorized use of the Personal Data.
4. Customer is responsible for providing any legally required notices to the individual, obtaining any legally required consents from the individual, and taking any other steps required by Applicable Law, to enable Customer to lawfully use the Services.
5. For the Personal Data, Customer is the “Controller” and HarrisX is Customer’s “Processor” as such terms are defined in the U.S. State Privacy Laws and in the GDPR, and, to the extent the CCPA applies, Customer is the “business” and HarrisX is Customer’s “service provider” as such terms are defined in the CCPA.

Confidentiality and Training

1. HarrisX will ensure that the persons HarrisX authorizes to Process the Personal Data are contractually required to maintain the confidentiality of such data.

Security

1. HarrisX will comply with its security obligations under Applicable Law. HarrisX will assist Customer in Customer’s compliance with such obligations by implementing the measures set forth in Schedule B.
2. HarrisX will not be liable for harm arising from Customer’s failure to use HarrisX security features.

Subprocessors

1. HarrisX may subcontract the collection or other Processing of Personal Data (i) only in compliance with Applicable Law regarding subprocessing, (ii) only with Customer’s consent and (iii) only if HarrisX has imposed contractual obligations on the Subprocessor that are substantially the same as, or more restrictive than, those imposed on HarrisX under this DPA.
2. Current Subprocessors are listed in Schedule C. When any new Subprocessor is engaged, HarrisX will notify Customer by email to the Designated Contact Address (“Subprocessor Notification”) at least 14 days prior to giving the Subprocessor access to the Personal Data (the “Subprocessor Notification Period”).
3. If Customer has any reasonable objection to the new Subprocessor, Customer has 10 days from the date of the Subprocessor Notification to email HarrisX at privacy@harrisx.com , explaining in reasonable detail the basis of the objection and (if Customer desires) Customer’s intent to terminate Customer’s subscription to the Service if it is not resolved to Customer’s satisfaction by the end of the Subprocessor Notification Period. Customer is deemed to consent to the new Subprocessor if Customer does not terminate the subscription as set forth above.
4. HarrisX remains liable for its Subprocessors’ acts and omissions to the same extent HarrisX is liable for its own.

Assistance Responding to Individuals’ Requests to Exercise Rights

1. If HarrisX receives a request from an individual or their representative to exercise Personal Data-related rights under Applicable Law (a “Data Subject Request”), such as rights to access, correct, or delete their Personal Data, or a Personal Data-related complaint from an individual or their representative, and the communication identifies Customer, HarrisX will forward the communication to Customer at the Designated Contact Address:
   1. as soon as commercially practicable; but
   2. no later than within 72 hours of receipt if the communication arrives via privacy@harrisx.com or any other contact method specified in HarrisX’s then-current publicly available Privacy Policy.
2. Customer will be responsible for lawfully addressing the Data Subject Request, and HarrisX will provide prompt, reasonable cooperation to Customer, taking into account the nature of the Services and the information available to HarrisX.

Personal Data Breach Notification

1. HarrisX will comply with the Personal Data Breach-related obligations applicable to it under Applicable Law. HarrisX will assist Customer in complying with those applicable to Customer by informing Customer of a confirmed Personal Data Breach without undue delay and in any event within 72 hours of becoming aware and by otherwise complying with this “Personal Data Breach Notification” section of the DPA.
2. HarrisX will provide such notification to Customer at the Designated Contact Address.
3. Such notification is not an acknowledgement of fault or responsibility. The notification will include HarrisX’s then-current assessment of the following:
   1. The nature of the Personal Data Breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of Personal Data records concerned;
   2. The likely consequences of the Personal Data Breach; and
   3. Measures taken or proposed to be taken by HarrisX to address the Personal Data Breach including, where applicable, measures to mitigate its possible adverse effects.

Assistance with DPIAs and Consultation with Supervisory Authorities

1. HarrisX will provide reasonable assistance to and cooperation with Customer, taking into account the nature of the Services and information available to HarrisX for (i) Customer’s performance of any data protection impact assessment of the Processing or proposed Processing of the Personal Data involving HarrisX, and (ii) related consultation with supervisory authorities.

Data Return and Destruction

1. HarrisX will destroy all Personal Data within 60 days after the termination of this Agreement except to the extent Applicable Law requires storage of the Personal Data.
2. In the event of such legally required retention, (i) HarrisX will inform Customer as soon as legally permitted, (ii) HarrisX will retain only Personal Data as required by Applicable Law and will retain it only as long as is required, (iii) during the retention period, HarrisX will refrain from Processing the Personal Data other than as required by Applicable Law and will continue to comply with this DPA with respect to the Personal Data, to the extent permitted by Applicable Law, and (iv) HarrisX will promptly destroy the Personal Data when Applicable Law no longer requires its retention.

Compliance Verification and Audits

1. HarrisX will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to reasonable audits of such compliance, including inspections.
2. If the requested audit scope is addressed in an audit report issued by a third-party auditor, within the prior twelve months and HarrisX provides such report to Customer and confirms in writing that there are no known material changes in the controls audited, Customer will accept the findings presented in the report in lieu of requesting an audit of the same controls covered by the report.
3. Such reports and any other information that Customer obtains under this Compliance Verification and Audits section is confidential information of HarrisX, and Customer can use such material solely to assess HarrisX’s compliance with its contractual obligations to Customer and to address any related legal matters.

Data Transfers

1. Customer authorizes HarrisX to make international transfers of the Personal Data only if (i) Applicable Law for such transfers is respected and (ii) the transfer is otherwise permitted by this DPA.
2. To the extent legally required, the Standard Contractual Clauses form part of this DPA and take precedence over the rest of this DPA to the extent of any conflict, and, except as set forth in the Sections below, they will be deemed completed as follows:
   1. Customer, the exporter, acts as a controller and HarrisX, the importer, acts as Customer’s processor with respect to the Personal Data subject to the Standard Contractual Clauses, and its Module 2 applies. Their contact information is set forth in Schedule A.
   2. Clause 7 (the optional docking clause) is included.
   3. Under Clause 9 (Use of sub-processors), the parties select Option 2 (General written authorization). The initial list of sub-processors is set forth in Schedule C.
   4. Under Clause 11 (Redress), the optional requirement that data subjects be permitted to lodge a complaint with an independent dispute resolution body does not apply.
   5. Under Clause 17 (Governing law), the parties choose Option 1 (the law of an EU Member State that allows for third-party beneficiary rights). The parties select the law of Ireland.
   6. Under Clause 18 (Choice of forum and jurisdiction), the parties select the courts of Ireland.
   7. Annexes I and II of the Standard Contractual Clauses are set forth in Schedule A of the DPA.
   8. Annex III of the Standard Contractual Clauses (List of subprocessors) is inapplicable.
3. With respect to Personal Data for which UK Data Protection Law governs the transfer, to the extent legally required, the UK SCC Addendum forms part of this DPA and takes precedence over the rest of this DPA to the extent of any conflict and shall be deemed completed as follows (with capitalized terms not defined elsewhere having the definition set forth in the UK SCC Addendum):
   1. Table 1 of the UK SCC Addendum: The Parties, their details, and their contacts are those set forth in Schedule A.
   2. Table 2 of the UK SCC Addendum: the “Approved EU Standard Contractual Clauses” shall be the Standard Contractual Clauses as set forth above.
   3. Table 3 of the UK SCC Addendum: Annexes I(A), I(B), and II are in Schedule A of the DPA, and Annex III is in Schedule C.
   4. Table 4 of the UK SCC Addendum: neither party may exercise the right set forth in Section 19 of the UK SCC Addendum.
4. With respect to Personal Data for which the Swiss FADP governs the transfer, the Standard Contractual Clauses shall be deemed to have the following differences to the extent required by the Swiss FADP:
   1. References to the GDPR in the Standard Contractual Clauses are to be understood as references to the Swiss FADP insofar as the data transfers are subject exclusively to the Swiss FADP and not to the GDPR.
   2. The term “member state” in Standard Contractual Clauses shall not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the Standard Contractual Clauses.
   3. Under Annex I(C) of the Standard Contractual Clauses (Competent supervisory authority):
      1. Where the transfer is subject exclusively to the Swiss FADP and not the GDPR, the supervisory authority is the Swiss Federal Data Protection and Information Commissioner.
      2. Where the transfer is subject to both the Swiss FADP and the GDPR, the supervisory authority is the Swiss Federal Data Protection and Information Commissioner insofar as the transfer is governed by the Swiss FADP, and the supervisory authority is as set forth in the Standard Contractual Clauses insofar as the transfer is governed by the GDPR.

Survival

1. This DPA survives termination of this Agreement for so long as HarrisX continues to Process the Personal Data.

Schedule A to DPA

Annexes I and II of the Standard Contractual Clauses

ANNEX I

A. LIST OF PARTIES

MODULE TWO: Transfer controller to processor

Data exporter(s): Customer, as identified in the applicable Order or, absent an Order, by the organization and account details provided to HarrisX at registration. Contact: the Designated Contact Address. Where applicable, Customer’s data protection officer and/or representative in the European Union are as notified by Customer to HarrisX in writing.

1. Name: Customer, as specified in the Agreement.

Address: as set forth in the Agreement

Contact person’s name, position and contact details: as set forth in the Agreement

Activities relevant to the data transferred under these Clauses: Use of the importer’s Services.

Signature and date: The Parties are deemed to have signed this Annex I by signing the Agreement.

Role (controller/processor): Controller

Data importer(s): HarrisX LLC, 1808 I Street NW, 5th Floor, Washington, DC 20006, United States. Contact person with responsibility for data protection: Privacy Office, privacy@harrisx.com.

1. Name: HarrisX LLC

Address: 1808 I Street NW, Suite 500, Washington, DC 20006, United States

Contact person’s name, position and contact details: privacy@harrisx.com

Activities relevant to the data transferred under these Clauses: The importer will provide the Services.

Signature and date: The Parties are deemed to have signed this Annex I by signing the Agreement.

Role (controller/processor): Processor

B. DESCRIPTION OF TRANSFER

MODULE TWO: Transfer controller to processor

Categories of data subjects whose personal data is transferred: Individuals whose personal data is contained in Customer Data that Customer uploads to or generates through the Services, which may include survey respondents, panel members, customers of Customer and other individuals determined by Customer.

Categories of personal data transferred: Identifiers and contact details, demographic data, survey responses, opinions and other data as determined by Customer in its use of the Services.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: Submission of sensitive data to the Services is prohibited under the BYOD Addendum (Exhibit A) unless expressly permitted in writing by HarrisX. To the extent Customer elects to do so, the data is subject to the restrictions and safeguards set out in Schedule B and the purpose-limitation, access-control and confidentiality obligations of the DPA.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): Continuous, for the duration of the Agreement.

Nature of the processing: Receipt, storage, organization, analysis (including automated and AI-assisted analysis), display, transmission and deletion of Customer Data in connection with the Services.

Purpose(s) of the data transfer and further processing: Provision of the Services to Customer in accordance with the Agreement and Customer’s instructions.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: For the term of the Agreement and thereafter as set out in the DPA (Data Return and Destruction).

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: As set out in Schedule C, for the purposes and durations described therein.

C. COMPETENT SUPERVISORY AUTHORITY

MODULE TWO: Transfer controller to processor

Identify the competent supervisory authority/ies in accordance with Clause 13:

The parties shall follow the rules for identifying such authority under Clause 13 and, to the extent legally permissible, select the Irish Data Protection Commission.

ANNEX II - TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

See Schedule B immediately below.

Schedule B to DPA

Information Security Addendum

HarrisX has established and agrees to maintain a written information security and privacy program (the “Information Security Program”) designed to comply with this Information Security Addendum and Applicable Law. Terms not defined herein have the meaning set forth in the DPA.

HarrisX maintains an information security management system that has completed ISO/IEC 27001:2022 Stage 1 and Stage 2 certification assessment (scope covering HarrisX LLC, Northstar Research Partners Inc., Northstar Research Partners (USA) LLC and Northstar Research Partners (UK) Limited, and naming AskTheo). Upon issuance of the certificate, HarrisX will maintain such certification, or a successor or substantially equivalent certification, for the term of the Agreement and will provide a copy of the current certificate to Customer on request.

As part of its program, HarrisX has implemented and agrees to maintain administrative, technical, and physical security safeguards designed to protect the confidentiality, integrity, and availability of Personal Data, including but not limited to:

• Administrative and Organizational Safeguards
  • HarrisX maintains policies and procedures for the security of Personal Data, including the following:
    • Written information security policies that set forth HarrisX’s procedures with regard to maintaining the safeguards set forth in this Information Security Addendum.
    • An incident response plan, which sets forth HarrisX’s procedures to investigate, mitigate, remediate, and otherwise respond to security incidents.
  • HarrisX conducts regular assessments of the risks and vulnerabilities to the confidentiality and security of Personal Data.
  • HarrisX regularly tests and monitors the effectiveness of its Information Security Program, including through security audits, and will evaluate its Information Security Program and information security safeguards in light of the results of the testing and monitoring and any material changes to its operations or business arrangements.
  • HarrisX has appointed an individual to oversee and manage its Information Security Program and lead the response to any Personal Data Breach.
  • HarrisX maintains role-based access restrictions for its systems, including restricting access to only those HarrisX employees that require access to perform the HarrisX Services or to facilitate the performance of such HarrisX Services, such as system administrators, consistent with the concepts of least privilege, need-to-know, and separation of duties.
  • HarrisX periodically reviews its access lists to ensure that access privileges have been appropriately provisioned and regularly reviews and terminates access privileges for HarrisX employees that no longer need such access.
  • HarrisX assigns unique usernames to authorized HarrisX employees and requires that HarrisX employees’ passwords satisfy minimum length and complexity requirements.
  • HarrisX regularly provides training to employees, as relevant for their roles, on confidentiality and security.
  • HarrisX requires relevant HarrisX employees to acknowledge HarrisX’s Information Security Program annually.
  • HarrisX has a policy in place to address violations of its Information Security Program.
• Technical Security
  • HarrisX logs certain system activity—including authentication events, changes in authorization and access controls—and regularly reviews and audits such logs. To facilitate forensic investigation of potential security incidents, HarrisX retains such logs for a reasonable period of time, and in any event for at least as long as required by its security certifications.
  • HarrisX maintains network security measures, including but not limited to firewalls, to segregate its internal networks from the internet, risk-based network segmentation, intrusion prevention or detection systems to alert HarrisX to suspicious network activity, and anti-virus and malware protection software.
  • HarrisX has implemented workstation protection policies for its systems, including automatic logoff after a period of inactivity and locking the system after a defined number of incorrect authentication attempts.
  • HarrisX requires multi-factor authentication on key systems for administrative users.
  • HarrisX conducts periodic vulnerability scans and assessments on systems storing, processing, or transmitting Personal Data to identify potential vulnerabilities and risks to Personal Data.
  • HarrisX engages an independent third party to perform penetration testing of its external attack surface at least annually and remediates findings in accordance with its documented remediation timelines.
  • HarrisX remediates identified vulnerabilities in a risk-prioritized and timely manner, including timely implementation of all high-risk mitigating manufacturer- and developer-recommended security updates and patches to systems and software storing, transmitting, or otherwise Processing Personal Data.
• Physical Security
  • HarrisX restricts employees’ access to its facilities, equipment, and devices on a need-to-know basis.
  • HarrisX tracks the location of its equipment, devices, and electronic media and maintains a record of such locations.

Schedule C to DPA

Subprocessor list

As of the effective date of the Terms, HarrisX engages the following Subprocessors in connection with the Services. The then-current list is also available from HarrisX on request at privacy@harrisx.com.