Data Processing Addendum

1. Introduction.

This Data Processing Addendum (the "Addendum") is incorporated into the Agreement(s) (as defined below) between Canopy Works, Inc.(herein referred to as the "Provider"), and the Provider's customers (collectively referred to as "Customers").

This Addendum is designed to ensure compliance with applicable data protection and privacy laws, including but not limited to the General Data Protection Regulation (GDPR) and any other applicable data protection laws and regulations.

2. Background.

The Provider provides cloud-based services to its Customers which may involve the processing of personal data. In connection with the provision of these services, the Provider engages the services of Google Cloud (a "Sub-Processor") to assist in processing such data.

3. Agreed Terms.

3.1 Definitions

"Provider" refers to Canopy Works, Inc., a company with its principal place of business at 1401 Parkinson Ave, Palo Alto, CA 94301

"Customer" refers to the firm or entity who purchases software or services from the Provider

"Sub-Processor" refers to Google Cloud

"Services" refers to the cloud-based services provided by the Provider

3.2 Scope. The Provider is responsible for the collection, processing, and storage of personal data of its Customers in accordance with its agreement(s) with Customers.

3.3 Purpose. The purpose of processing is to provide the agreed-upon services to Customers, including but not limited to data storage, analysis, and other processing activities as required for the services provided by the Provider.

3.4 Data Processor. The Provider engages the Sub-Processor for specific services and processes related to the storage, analysis, and other processing activities of personal data of Customers.

3.5 Subprocessing. The Provider may engage the Sub-Processor for specific services and processes as necessary to fulfill the purposes mentioned in this Addendum. Customers consent to the Provider's use of the Sub-Processor for these specific services.

3.6 Data Transfer. Data transfers to the Sub-Processor, if applicable, shall be conducted in accordance with the terms and conditions of the Google Cloud Data Processing Addendum.

3.7 Security Measures. The Provider shall ensure that appropriate technical and organizational measures are in place to protect the security and confidentiality of the personal data of Customers.

3.8 Data Subject Rights. Customers have the rights to access, rectify, erase, or restrict the processing of their personal data, as well as the right to data portability and the right to object to processing, in accordance with applicable data protection laws.

4. Governing Law.

This Addendum shall be governed by and construed in accordance with the laws of the jurisdiction where the Provider is located.

‍