Data Processing Addendum

Version 1.4 — Effective August 6, 2026

This Data Processing Addendum ("DPA") is entered into between Elemental Genius LLC ("Elemental Genius," "we," "us"), the provider of CyrForge, and the customer entity that has agreed to Elemental Genius's Terms & Conditions and uses CyrForge to process personal data ("Customer," "you"). This DPA supplements and forms part of that agreement (the "Principal Agreement").

Where Customer's use of CyrForge involves the processing of personal data that is subject to the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK GDPR, or the Swiss Federal Act on Data Protection, this DPA applies and its terms take precedence over any conflicting terms of the Principal Agreement solely with respect to that processing.

If you accepted this DPA electronically (e.g., by checking a box or continuing to use CyrForge after notice), that acceptance is legally binding, and we record the version accepted, together with who accepted it and when.

---

1. Definitions

"Controller," "Processor," "Data Subject," "Personal Data," "Processing," "Personal Data Breach," and "Supervisory Authority" have the meanings given in the GDPR. "Sub-processor" means any processor engaged by Elemental Genius to process Personal Data on Customer's behalf. "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission (Commission Implementing Decision (EU) 2021/914), as may be updated or replaced from time to time.

2. Roles of the Parties

As between Customer and Elemental Genius, Customer is the Controller (or acts as processor on behalf of a further controller, in which case Customer warrants it has authority to enter into this DPA) and Elemental Genius is the Processor. Elemental Genius will process Personal Data only as described in this DPA and as necessary to provide CyrForge.

3. Subject Matter, Duration, Nature and Purpose

• Subject matter: Elemental Genius's processing of Personal Data on Customer's behalf in the course of providing the CyrForge service.
• Duration: For the term of the Principal Agreement, and thereafter only as needed to comply with Section 10 (Deletion or Return) or applicable law.
• Nature and purpose: Hosting, storage, transmission, and processing of Personal Data as necessary to operate CyrForge's CRM, communication, and account-management functionality, and to provide support to Customer.
• Categories of Data Subjects: Customer's end users, contacts, leads, and other individuals whose data Customer stores or manages within CyrForge.
• Categories of Personal Data: Contact and identification data (e.g., name, email address, phone number), account and authentication data, communications content and metadata processed through connected integrations (e.g., Gmail), and any other Personal Data Customer chooses to input into CyrForge.

4. Customer's Instructions

Elemental Genius will process Personal Data only on Customer's documented instructions, including with regard to transfers of Personal Data to a third country, unless required to do otherwise by law to which Elemental Genius is subject — in which case Elemental Genius will inform Customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. Customer instructs Elemental Genius to process Personal Data to provide, secure, support, and improve CyrForge, consistent with the Principal Agreement and Customer's use of the service's configurable features.

5. Confidentiality

Elemental Genius ensures that persons authorized to process Personal Data have committed themselves to confidentiality (whether by contract or statutory obligation) and are informed of the confidential nature of the Personal Data.

6. Security of Processing

Elemental Genius implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, consistent with Article 32 GDPR, including measures addressing:

• Encryption of Personal Data in transit and at rest;
• The ability to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems;
• The ability to restore availability and access to Personal Data in a timely manner following an incident;
• Regular testing and evaluation of the effectiveness of security measures.

Further detail on Elemental Genius's security practices is available on the Security page and on request.

7. Sub-processors

Customer provides general authorization for Elemental Genius to engage Sub-processors to support the provision of CyrForge. Elemental Genius's current Sub-processor list is maintained as part of the CyrForge Privacy Policy at cyrforge.com/privacy-policy#subprocessors (the "Subprocessor List"), which is incorporated into this DPA by reference and controls over any separate restatement of Sub-processors. Elemental Genius will:

• Impose data protection obligations on each Sub-processor that are no less protective than those set out in this DPA;
• Remain liable to Customer for a Sub-processor's performance of its data protection obligations;
• Provide at least 30 days' notice via the Subprocessor List (or by direct notice, at Elemental Genius's discretion) before adding or replacing a Sub-processor. Customer may object on reasonable data-protection grounds within that 30-day period. If Customer objects and the parties cannot resolve the objection, Customer's exclusive remedy is to terminate the affected service in accordance with the Principal Agreement. This is the notice period recorded at Clause 9a of the UK Addendum in Annex 3.

8. International Transfers

Elemental Genius is based in the United States, and the Sub-processors on the Subprocessor List are US-based. Where Customer's Personal Data originates in the European Economic Area, the United Kingdom, or Switzerland and is transferred to Elemental Genius or its Sub-processors in the United States, the parties agree that such transfers are governed by the Standard Contractual Clauses, attached as Annex 2, with Customer as "data exporter" and Elemental Genius as "data importer," Module Two (Controller to Processor) or Module Three (Processor to Processor), as applicable. Where a UK-established Customer is exporting data, the UK International Data Transfer Addendum to the SCCs, attached as Annex 3, applies in place of or alongside the EU SCCs as appropriate.

Certain Sub-processors separately maintain their own EU-U.S. Data Privacy Framework certification; that certification pertains to that Sub-processor's own transfers and does not by itself serve as Elemental Genius's transfer mechanism for purposes of this DPA. Customer should discuss the adequacy of this transfer structure for its specific circumstances with its own legal counsel.

9. Assistance with Data Subject Rights and Breach Notification

• Data Subject requests: Taking into account the nature of the processing, Elemental Genius will assist Customer, insofar as possible and through appropriate technical and organizational measures, in fulfilling Customer's obligation to respond to requests from Data Subjects exercising their rights under GDPR (access, rectification, erasure, restriction, portability, and objection). Where a Data Subject contacts Elemental Genius directly regarding their Personal Data, Elemental Genius will direct them to Customer.
• Personal Data Breach: Elemental Genius will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer's Personal Data, and will provide information reasonably necessary for Customer to meet any of its own breach-notification obligations.
• DPIAs: Elemental Genius will provide reasonably requested information to assist Customer with data protection impact assessments and, where required, prior consultations with Supervisory Authorities, to the extent such information is reasonably available to Elemental Genius.

10. Deletion or Return of Personal Data

On termination or expiration of the Principal Agreement, and upon Customer's request, Elemental Genius will delete or return all Personal Data processed on Customer's behalf, and delete existing copies, unless applicable law requires continued storage. CyrForge's account closure flow — churn feedback, Stripe cancellation, revocation of connected-account grants, and deletion of stored data and the account record — implements this obligation; Customer may also request deletion directly.

11. Audit and Information Rights

Elemental Genius will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer, subject to reasonable advance notice, confidentiality protections, and no more than once per 12-month period absent a Personal Data Breach or Supervisory Authority requirement. Elemental Genius may satisfy audit requests by providing a summary of relevant certifications, assessments, or third-party audit reports where available, in lieu of an on-site audit, at Elemental Genius's discretion.

12. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Principal Agreement.

13. Order of Precedence

In the event of a conflict between this DPA and the Principal Agreement regarding the processing of Personal Data subject to GDPR, this DPA controls. In the event of a conflict between the body of this DPA and the SCCs annexed hereto, the SCCs control.

14. Version History

---

Annex 1 — Processing Details

See Section 3 above for subject matter, duration, nature, purpose, categories of Data Subjects, and categories of Personal Data. See the Subprocessor List for current Sub-processors and their processing locations.

Annex 2 — EU Standard Contractual Clauses

The Standard Contractual Clauses referenced in Section 8 (Module Two, Controller to Processor, or Module Three, Processor to Processor, as applicable) are incorporated into this DPA by reference, with Annex I completed in accordance with Section 3 above and Annex II completed in accordance with Section 6 above.

Optional clauses and selections

The SCCs contain optional provisions that the parties must select. The parties agree the following:

For the avoidance of doubt, the Clause 17 and Clause 18(b) selections above govern the Standard Contractual Clauses only. They do not vary the governing law or forum of the Principal Agreement, which remain as stated in the Terms & Conditions, and Section 13 (Order of Precedence) applies to any conflict between the two.

Annex I.A — List of Parties

The data exporter is the Customer entity that accepted this DPA, with the contact details recorded at acceptance. The data importer is Elemental Genius LLC, Brockport, NY 14420, United States; contact [email protected]. The activities relevant to the data transferred are set out in Section 3 above, and each party's role is as described in Section 2.

Annex I.B — Description of Transfer

As set out in Section 3 above (categories of Data Subjects, categories of Personal Data, frequency, nature and purpose of processing, retention, and the subject matter and duration of Sub-processor processing).

Annex I.C — Competent Supervisory Authority

The competent supervisory authority is the Irish Data Protection Commission.

Annex II — Technical and Organisational Measures

As set out in Section 6 above and on the Security page.

To request the executed Standard Contractual Clauses, or a countersigned copy of this DPA, contact [email protected].

Annex 3 — UK International Data Transfer Addendum

For Restricted Transfers subject to the UK GDPR, the parties enter into the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, Version B1.0, in force 21 March 2022 (the "UK Addendum"), issued by the Information Commissioner under s119A(1) of the Data Protection Act 2018.

Part 1 of the UK Addendum is completed as set out below. Part 2 (Mandatory Clauses) is incorporated in the form permitted by the Approved Addendum itself, as stated at the end of this Annex.

Table 1: Parties

Start date: the date on which the Customer accepted this DPA, as recorded by Elemental Genius under the acceptance provisions above.

Signature: the parties enter into the UK Addendum by electronic acceptance in accordance with Section 2 of its Mandatory Clauses, which provides that the parties may enter into it in any way that makes it legally binding and allows data subjects to enforce their rights.

Table 2: Selected SCCs, Modules and Selected Clauses

The Addendum EU SCCs are the Approved EU SCCs as incorporated by Annex 2 of this DPA, with the following selections:

Table 3: Appendix Information

Table 4: Ending this Addendum when the Approved Addendum changes

Which parties may end the UK Addendum as set out in Section 19 of its Mandatory Clauses: Exporter.

Part 2: Mandatory Clauses

Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

To request a countersigned copy of the UK Addendum, contact [email protected].

Contact

Elemental Genius LLC Email: [email protected] Address: Brockport, NY 14420 Phone: 585-204-0942

© 2026 Elemental Genius LLC. All rights reserved.