Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between TrackBase, Inc. and the customer and applies where TrackBase processes personal data on the customer's behalf as a processor.

The customer is the data controller and TrackBase is the data processor for personal data processed in connection with the services. Each party will comply with applicable data-protection laws.

• Subject matter: provision of price-intelligence services.
• Duration: for the term of the agreement.
• Nature and purpose: hosting, monitoring, alerting, and analytics.
• Types of data and data subjects: as configured by the customer.

TrackBase uses vetted sub-processors to deliver the services and remains responsible for their compliance. A current list of sub-processors is available on request, and we provide notice of changes.

TrackBase maintains technical and organizational measures including encryption in transit and at rest, access controls, and audit logging, consistent with our Security & Trust commitments.

Where personal data is transferred across borders, TrackBase relies on appropriate safeguards such as Standard Contractual Clauses.

TrackBase will provide reasonable assistance to the customer in responding to data-subject requests and in meeting obligations such as data-protection impact assessments.

Upon termination, TrackBase will delete or return personal data in accordance with the agreement, subject to legal retention requirements. To request the signed DPA, contact [email protected].