HL Hunt

1.1 Purpose

The purpose of this DPA is to set forth the terms under which HL Hunt, acting as a processor and service provider, Processes Personal Data on behalf of Customer, acting as a controller and business, in the course of providing the Services, and to satisfy the contractual requirements imposed on controllers and processors, and on businesses and service providers, by Data Protection Laws.

1.2 Incorporation and Acceptance

• This DPA is incorporated into and forms an integral part of the Agreement.
• By accepting the Agreement, Customer accepts and agrees to be bound by this DPA on behalf of itself and, to the extent Customer's Affiliates use the Services under Customer's account, on behalf of such Affiliates.
• Capitalized terms used but not defined in this DPA have the meanings given in the Agreement.

1.3 Scope of Application

This DPA applies to the Processing of Personal Data by HL Hunt on behalf of Customer through the Services, including all End User Data and Verification Records. This DPA does not apply to Personal Data that HL Hunt Processes as an independent controller, including Customer's business contact information, account and billing data, Fraud Signals, and Aggregated Data, which are described in Section 3.3 and governed by HL Hunt's privacy policy and the Agreement.

1.4 Order of Precedence

In the event of any conflict or inconsistency between this DPA and the Agreement with respect to the Processing of Personal Data, this DPA shall control. In the event of any conflict between this DPA and the Standard Contractual Clauses, where applicable, the Standard Contractual Clauses shall control with respect to the transfer to which they apply. Nothing in this DPA shall be construed to reduce the limitations of liability, disclaimers, or Customer's indemnification obligations set forth in the Agreement.

2.1 Data Protection Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person that HL Hunt Processes on behalf of Customer in connection with the Services, and includes "personal information," "personal data," and equivalent terms as defined under Data Protection Laws. Personal Data includes all End User Data.
• "Processing" (and its cognates) means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, alignment, combination, restriction, erasure, and destruction.
• "Controller" means the entity that determines the purposes and means of the Processing of Personal Data, and includes a "business" as defined under the CCPA and equivalent terms under other Data Protection Laws.
• "Processor" means the entity that Processes Personal Data on behalf of a Controller, and includes a "service provider" and "contractor" as defined under the CCPA and equivalent terms under other Data Protection Laws.
• "Data Subject" means the identified or identifiable natural person to whom Personal Data relates, and includes a "consumer" as defined under the CCPA and equivalent terms under other Data Protection Laws. In this DPA, Data Subjects are End Users.
• "Data Protection Laws" means all Applicable Data Protection Laws as defined in the Agreement, including the CCPA, the U.S. State Privacy Laws, the Biometric Privacy Laws, the GLBA, the GDPR, and the UK GDPR, in each case to the extent applicable to the Processing of Personal Data under this DPA.
• "CCPA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, Cal. Civ. Code § 1798.100 et seq., and its implementing regulations.
• "U.S. State Privacy Laws" means the comprehensive consumer privacy laws of U.S. states other than California that are in effect and applicable to the Processing, including those of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island, and any similar law enacted thereafter.
• "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council, and "UK GDPR" means the GDPR as incorporated into the law of the United Kingdom by the Data Protection Act 2018 and the European Union (Withdrawal) Act 2018, each as amended.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914, and "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise Processed by HL Hunt or its Sub-Processors. A Personal Data Breach does not include unsuccessful attempts or activities that do not compromise the security of Personal Data, such as unsuccessful log-in attempts, pings, port scans, denial-of-service attacks, and other network attacks on firewalls or networked systems.
• "Sub-Processor" means any third party engaged by HL Hunt or its Affiliates to Process Personal Data on behalf of Customer in connection with the Services.
• "Sell," "Share," "Business Purpose," "Commercial Purpose," and "Sensitive Personal Information" have the meanings given in the CCPA, and equivalent terms under the U.S. State Privacy Laws shall be interpreted accordingly.

2.2 Service-Related Definitions

• "Biometric Data," "Biometric Privacy Laws," "Document Images," "Selfie Data," "Verification Records," "Verification Output," "Verification Session," "Fraud Signals," "Aggregated Data," and "Default Retention Period" have the meanings given in the Agreement.
• "Instructions" means Customer's documented instructions to HL Hunt regarding the Processing of Personal Data, as described in Section 5.1.
• "Retention Schedule" means the retention and destruction schedule set forth in Section 8 and Annex 4.
• "Security Measures" means the technical and organizational measures set forth in Section 9 and Annex 2.

3.1 Customer as Controller

With respect to End User Data and Verification Records, Customer is the Controller and, where the CCPA applies, the business. Customer determines the purposes and means of the Processing, including by deciding which End Users to verify, which verification workflows and supplemental checks to enable, which decision thresholds to apply, and how long Verification Records are to be retained within the parameters offered by the Services. Customer is responsible for all obligations imposed on Controllers under Data Protection Laws.

3.2 HL Hunt as Processor

With respect to End User Data and Verification Records, HL Hunt is the Processor and, where the CCPA applies, the service provider. HL Hunt Processes such Personal Data solely on behalf of Customer, in accordance with Customer's Instructions, and for the purpose of providing the Services to Customer. HL Hunt does not determine the purposes of the Processing of End User Data.

3.3 HL Hunt as Independent Controller for Limited Purposes

Customer acknowledges that HL Hunt acts as an independent Controller, and not as a Processor on Customer's behalf, with respect to the following limited categories of data, which are outside the scope of this DPA:

• Business contact information of Customer's personnel, Authorized Users, and representatives, Processed for account management, billing, support, security, and communications.
• Fraud Signals, which exclude Document Images, Selfie Data, and Biometric Data, Processed for the purpose of detecting and preventing fraud and abuse across the Veriface platform.
• Aggregated Data, which does not identify any Data Subject.
• Personal Data that HL Hunt is required to Process to comply with its own legal obligations, including responding to legal process, maintaining records required by law, and cooperating with regulators.

HL Hunt shall Process such data in accordance with Data Protection Laws and HL Hunt's privacy policy.

3.4 No Joint Controllership

The parties do not intend to be, and shall not be deemed to be, joint controllers with respect to any Personal Data. Each party is independently responsible for its own compliance with Data Protection Laws in the capacity described in this Section.

3.5 Customer Affiliates

Where a Customer Affiliate uses the Services under Customer's account, Customer enters into this DPA on behalf of such Affiliate, Customer remains fully responsible for the Affiliate's compliance with this DPA, and all rights of the Affiliate under this DPA shall be exercised by Customer on the Affiliate's behalf.

5.1 Documented Instructions

The following constitute Customer's complete and documented Instructions to HL Hunt for the Processing of Personal Data:

• The Agreement, including this DPA and any Order Form.
• Customer's configuration of the Services through the Dashboard, including workflow settings, enabled supplemental checks, decision thresholds, and retention settings.
• Each API call, SDK invocation, or Hosted Flow session initiated by or on behalf of Customer, which constitutes an Instruction to perform the Verification Session and to retain the resulting Verification Records in accordance with the Retention Schedule.
• The instruction to retain Verification Records for the Default Retention Period, as set forth in Section 8.1 and in Section 11.3 of the Agreement.
• Any additional written instruction issued by an Authorized User through the Dashboard or to the privacy contact in Section 18.7, provided that HL Hunt has confirmed in writing that it is able to comply with such instruction.

5.2 Lawfulness of Instructions

• Customer represents and warrants that its Instructions comply with Data Protection Laws and that it has the authority to issue them.
• HL Hunt is not obligated to review Customer's Instructions for legal compliance. If HL Hunt becomes aware that an Instruction infringes Data Protection Laws, HL Hunt shall inform Customer, and HL Hunt may suspend performance of the Instruction until the parties resolve the issue, without liability.
• Instructions that fall outside the scope of the Services, that require material changes to the Services, or that are inconsistent with the Agreement are subject to HL Hunt's written agreement and may be subject to additional fees.

5.3 Customer Compliance Obligations

Customer shall, at its sole cost and responsibility:

• Establish and document a lawful basis for the Processing of each category of Personal Data, including explicit consent where required for Biometric Data and other Sensitive Personal Information.
• Provide all notices to Data Subjects required by Data Protection Laws, including notice of the collection of Biometric Data, the purposes of Processing, the disclosure of Personal Data to HL Hunt as Customer's Processor, and the Retention Schedule.
• Obtain and maintain records of all consents, authorizations, and written releases required by Data Protection Laws and Biometric Privacy Laws, as further described in Section 7.
• Conduct and document any data protection impact assessment, risk assessment, or similar analysis required by Data Protection Laws with respect to its use of the Services, with HL Hunt's assistance as described in Section 12.4.
• Ensure that Personal Data submitted to the Services is accurate, relevant, and limited to what is necessary for identity verification.
• Respond to Data Subject requests and regulator inquiries in its capacity as Controller.
• Determine, based on the Data Subjects' jurisdictions and the Biometric Privacy Laws applicable to Customer, whether any retention period shorter than the Default Retention Period is required, and issue a corresponding Instruction under Section 8.3.

5.4 Prohibited Data

Customer shall not submit to the Services, and shall not instruct HL Hunt to Process, any of the following except to the extent such data appears on or is inherent in an Identity Document submitted for verification: protected health information subject to HIPAA; payment card numbers, bank account numbers, or other financial account credentials; Social Security numbers, except where a supported Identity Document or supplemental check expressly requires them; data concerning criminal convictions; data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, or sexual orientation; or Personal Data of any individual under thirteen (13) years of age. Customer shall not submit Personal Data of individuals between thirteen (13) and seventeen (17) years of age except in compliance with Section 5.3 of the Agreement.

6.1 Processing on Instructions

HL Hunt shall Process Personal Data only on behalf of Customer and in accordance with Customer's documented Instructions, including with respect to transfers of Personal Data to a third country, unless HL Hunt is required to Process Personal Data otherwise by Applicable Law, in which case HL Hunt shall inform Customer of that legal requirement before Processing, unless the law prohibits such information on important grounds of public interest.

6.2 Confidentiality of Personnel

HL Hunt shall ensure that all personnel authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, have received training appropriate to their role regarding the protection of Personal Data, and are granted access to Personal Data only to the extent necessary to perform their duties.

6.3 Security

HL Hunt shall implement and maintain the Security Measures described in Section 9 and Annex 2.

6.4 Sub-Processors

HL Hunt shall engage Sub-Processors only in accordance with Section 11.

6.5 Assistance

HL Hunt shall provide the assistance described in Section 12, taking into account the nature of the Processing and the information available to HL Hunt.

6.6 Deletion and Return

HL Hunt shall delete or return Personal Data in accordance with Section 8 and Section 16.

6.7 Information and Audits

HL Hunt shall make available to Customer the information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits in accordance with Section 15.

6.8 Restrictions on Use

• HL Hunt shall not Sell or Share Personal Data.
• HL Hunt shall not retain, use, or disclose Personal Data for any purpose other than the Business Purposes of providing the Services as specified in the Agreement and this DPA, including retaining, using, or disclosing Personal Data for a Commercial Purpose other than the Business Purposes specified in the Agreement.
• HL Hunt shall not retain, use, or disclose Personal Data outside of the direct business relationship between HL Hunt and Customer, except as permitted by Data Protection Laws.
• HL Hunt shall not combine Personal Data received from Customer with personal information that HL Hunt receives from or on behalf of another person or that HL Hunt collects from its own interactions with Data Subjects, except as permitted by Data Protection Laws for purposes of performing the Services, detecting security incidents, or protecting against fraudulent or illegal activity.
• HL Hunt shall not use Document Images, Selfie Data, or Biometric Data to train or improve machine learning models for use with other customers except as expressly authorized under Section 11.7 of the Agreement.

6.9 Records

HL Hunt shall maintain records of its Processing activities carried out on behalf of Customer to the extent required by Data Protection Laws and shall make such records available to Customer upon reasonable written request.

7.1 Nature of Biometric Processing

In performing facial comparison and liveness detection, the Services generate mathematical representations of facial geometry from Document Images and Selfie Data. Such representations, together with the images from which they are derived to the extent such images are used for identification, may constitute biometric identifiers or biometric information under Biometric Privacy Laws, and are treated as Biometric Data under this DPA. The Services do not generate voiceprints, fingerprints, retina or iris scans, or other biometric identifiers.

7.2 Customer Biometric Obligations

Before initiating any Verification Session for an End User to whom a Biometric Privacy Law applies, Customer shall:

• Inform the End User in writing that biometric identifiers and biometric information are being collected, stored, and used by Customer and by HL Hunt as Customer's service provider.
• Inform the End User in writing of the specific purpose for which the biometric identifiers and biometric information are being collected, stored, and used, and the length of term for which they will be retained, which shall be the Default Retention Period or such shorter period as Customer has instructed under Section 8.3.
• Obtain a written release from the End User, which may be executed electronically where permitted by Applicable Law, authorizing the collection, storage, and use of the biometric identifiers and biometric information for the stated purpose and term.
• Develop, maintain, and make publicly available Customer's own written policy establishing a retention schedule and guidelines for the permanent destruction of biometric identifiers and biometric information, consistent with the Retention Schedule.
• Retain documentary evidence of each End User's notice and written release for no less than the Default Retention Period and provide such evidence to HL Hunt within five (5) business days of written request.

7.3 HL Hunt Biometric Obligations

• HL Hunt shall not sell, lease, trade, or otherwise profit from any End User's Biometric Data.
• HL Hunt shall not disclose, redisclose, or otherwise disseminate any End User's Biometric Data unless the disclosure is required to complete a Verification Session requested by Customer, is required by Applicable Law or valid legal process, or is otherwise authorized by Customer's Instructions.
• HL Hunt shall store, transmit, and protect Biometric Data using the reasonable standard of care within HL Hunt's industry and in a manner that is the same as or more protective than the manner in which HL Hunt stores, transmits, and protects other confidential and sensitive information, including through encryption at rest and in transit and access restrictions as described in Annex 2.
• HL Hunt shall permanently destroy Biometric Data in accordance with the Retention Schedule.
• HL Hunt shall not use Biometric Data to identify, match, or track End Users across the accounts of different HL Hunt customers, to build profiles of End Users, or for any purpose other than performing Verification Sessions for Customer.

7.4 Retention of Biometric Data

HL Hunt shall retain Biometric Data for the Default Retention Period, or for such shorter period as Customer instructs under Section 8.3 for End Users subject to a Biometric Privacy Law that requires earlier destruction, and shall thereafter permanently destroy it as described in Section 8.5. Customer acknowledges that certain Biometric Privacy Laws require destruction of biometric identifiers when the initial purpose for collection has been satisfied or within a fixed period after the Data Subject's last interaction with Customer, whichever occurs first, and that Customer, not HL Hunt, is responsible for determining whether and when such a requirement applies to any End User and for issuing a timely Instruction.

7.5 Written Retention Policy

This Section 7, together with Section 8 and Annex 4, constitutes HL Hunt's publicly available written policy establishing its retention schedule and guidelines for permanently destroying biometric identifiers and biometric information in HL Hunt's possession as a service provider. This policy does not substitute for the written policy that Customer is required to maintain and make publicly available in its own capacity under Section 7.2.

7.6 Indemnification

Customer's indemnification obligations with respect to Biometric Privacy Laws are set forth in Section 19.1 of the Agreement and Section 17.2 of this DPA and are not subject to any limitation of liability.

8.1 Default Retention Period

Customer instructs HL Hunt to retain all Verification Records, including Document Images, Selfie Data, Biometric Data, extracted identity data, session metadata, and Verification Output, for a period of seven (7) years from the date of the applicable Verification Session. Customer acknowledges that this Instruction serves the purposes described in Section 11.3 of the Agreement, including maintaining an audit trail for Customer's regulatory recordkeeping, detecting and investigating fraud, responding to disputes and legal process, and demonstrating that verification was performed and consent was obtained. Customer represents and warrants that it has determined that the Default Retention Period is permitted under the Data Protection Laws applicable to its End Users and that it has disclosed the Default Retention Period to End Users.

8.2 Customer-Configured Shorter Periods

Where the Dashboard supports retention configuration, Customer may configure a retention period shorter than the Default Retention Period for all of its Verification Records or for a defined subset. Customer may also instruct deletion of Verification Records for a specified End User or Verification Session at any time through the Dashboard or by written notice to the privacy contact in Section 18.7. HL Hunt shall implement such deletion within thirty (30) days, subject to Section 8.4.

8.3 Jurisdictional Overrides

• Where a Biometric Privacy Law or other Data Protection Law applicable to an End User requires that Biometric Data or other Personal Data be destroyed before the expiration of the Default Retention Period, Customer shall instruct HL Hunt in writing of the required retention period and the criteria for identifying the affected End Users, such as state of residence or location of collection.
• HL Hunt shall apply the instructed period to the affected Personal Data, provided that Customer has supplied, through the API or Dashboard, the data necessary for HL Hunt to identify the affected End Users.
• Absent such an Instruction, HL Hunt shall apply the Default Retention Period, and Customer bears all responsibility for any resulting non-compliance.

8.4 Legal Holds and Extended Retention

Notwithstanding Sections 8.1 through 8.3, HL Hunt may retain Personal Data beyond the applicable retention period, or notwithstanding a deletion Instruction, to the extent that retention is required by Applicable Law, by a valid subpoena, court order, regulatory directive, or litigation hold, or is reasonably necessary to establish, exercise, or defend legal claims or to investigate or prevent fraud, security incidents, or violations of the Agreement. Personal Data retained under this Section shall be isolated from active Processing, protected by the Security Measures, and destroyed when the basis for extended retention no longer applies.

8.5 Destruction Method and Certification

Upon expiration of the applicable retention period, HL Hunt shall permanently destroy the Personal Data within ninety (90) days using cryptographic erasure, secure overwriting, or other methods consistent with NIST Special Publication 800-88, Guidelines for Media Sanitization, or an equivalent recognized standard, such that the Personal Data cannot be read or reconstructed. Upon Customer's written request, HL Hunt shall provide a written certificate of destruction identifying the categories of Personal Data destroyed and the date of destruction.

8.6 Backups

Personal Data contained in encrypted backup media shall be overwritten or rendered unreadable in accordance with HL Hunt's standard backup rotation schedule, which shall not exceed ninety (90) days following deletion from production systems. Backup media shall be protected by the Security Measures and shall not be restored to production except as necessary for disaster recovery, in which case any Personal Data that was previously deleted shall be deleted again promptly following restoration.

9.1 Security Program

HL Hunt shall maintain a written information security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of HL Hunt's business, the nature and scope of its activities, and the sensitivity of the Personal Data, and that is designed to protect the security, confidentiality, and integrity of Personal Data and to protect against anticipated threats and unauthorized access, use, or disclosure. The program shall be designed to satisfy the requirements of the GLBA Safeguards Rule, 16 C.F.R. Part 314, to the extent HL Hunt Processes nonpublic personal information on behalf of a financial institution.

9.2 Technical and Organizational Measures

The Security Measures implemented by HL Hunt are described in Annex 2. The Security Measures include, at a minimum, encryption of Personal Data in transit and at rest, role-based access controls with multi-factor authentication for privileged access, logging and monitoring of access to Personal Data, vulnerability management and periodic penetration testing, secure software development practices, personnel screening and training, and documented incident response and business continuity procedures.

9.3 Changes to Security Measures

HL Hunt may update the Security Measures from time to time to reflect technological developments, changes in threats, and changes in Data Protection Laws, provided that no such update shall materially reduce the overall level of protection afforded to Personal Data during the term of the Agreement.

9.4 Customer Responsibilities

Customer is responsible for the security of its own systems, for the secure integration of the SDK and API, for the protection of API Credentials and Dashboard credentials, for the security of Personal Data once retrieved from the Services, and for configuring the Services in a manner appropriate to the sensitivity of the Personal Data and the risks presented by Customer's use case. Customer acknowledges that the Security Measures are appropriate for the Processing contemplated by the Agreement and that Customer has independently assessed their adequacy for its purposes.

10.1 Notification

HL Hunt shall notify Customer of a Personal Data Breach without undue delay, and in any event within seventy-two (72) hours after HL Hunt has confirmed that a Personal Data Breach has occurred. Notification shall be made by email to the security or administrative contact designated in Customer's account. HL Hunt may provide notification in phases as information becomes available.

10.2 Content of Notification

To the extent known at the time of notification, and supplemented as further information becomes available, the notification shall describe:

• The nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and Personal Data records concerned.
• The name and contact details of HL Hunt's point of contact for the Personal Data Breach.
• The likely consequences of the Personal Data Breach.
• The measures taken or proposed to be taken by HL Hunt to address the Personal Data Breach, including measures to mitigate its possible adverse effects.

10.3 Investigation and Remediation

HL Hunt shall promptly investigate the Personal Data Breach, take reasonable steps to contain and remediate it, preserve relevant evidence, and provide Customer with reasonable cooperation and information reasonably requested by Customer in connection with Customer's own investigation and notification obligations.

10.4 Customer Notification Obligations

Customer, as Controller, is solely responsible for determining whether a Personal Data Breach must be reported to any supervisory authority, regulator, Data Subject, or other third party, for the timing, content, and method of any such report, and for all costs associated therewith, except to the extent Data Protection Laws impose a direct reporting obligation on HL Hunt. Customer shall not identify HL Hunt in any public statement regarding a Personal Data Breach without HL Hunt's prior written approval of the relevant content, except as required by Applicable Law.

10.5 No Admission

HL Hunt's notification of or response to a Personal Data Breach shall not be construed as an acknowledgment by HL Hunt of any fault, negligence, or liability.

10.6 Breaches Attributable to Customer

Customer shall notify HL Hunt without undue delay of any security incident affecting Customer's systems, API Credentials, or Customer Integrations that may affect Personal Data Processed by HL Hunt. HL Hunt shall have no obligation under this Section 10 with respect to any incident caused by Customer, its personnel, its systems, compromised API Credentials, or Customer Integrations, and Customer shall bear all costs associated with such incidents.

11.1 General Authorization

Customer provides a general written authorization for HL Hunt to engage Sub-Processors to Process Personal Data in connection with the Services, subject to the requirements of this Section 11. Customer specifically authorizes the engagement of HL Hunt's Affiliates and the Sub-Processors in the categories described in Annex 3.

11.2 Current Sub-Processors

The categories of Sub-Processors engaged by HL Hunt as of the Effective Date are set forth in Annex 3. HL Hunt maintains a current list of named Sub-Processors, including each Sub-Processor's identity, location, and the Processing it performs, which HL Hunt shall make available through the Dashboard or the Veriface section of HL Hunt's website and shall provide to Customer upon written request.

11.3 Notice of New Sub-Processors

HL Hunt shall notify Customer of any intended addition or replacement of a Sub-Processor that will Process Personal Data at least thirty (30) days before the new Sub-Processor begins Processing, by updating the Sub-Processor list and by notice through the Dashboard or by email to Customer's administrative contact. Customer is responsible for maintaining a current administrative contact and for subscribing to any Sub-Processor notification mechanism HL Hunt makes available.

11.4 Right to Object

• Customer may object in writing to the engagement of a new Sub-Processor within thirty (30) days of notice, provided the objection is based on reasonable, documented grounds relating to data protection.
• Upon receipt of a timely objection, the parties shall discuss the objection in good faith, and HL Hunt may, at its discretion, propose a commercially reasonable change to the Services or to the Sub-Processor's role to address the objection.
• If HL Hunt is unable or unwilling to address the objection within thirty (30) days of receipt, Customer may, as its sole and exclusive remedy, terminate the affected portion of the Services upon written notice, and HL Hunt shall refund any prepaid fees attributable to the terminated Services for the period following termination.
• If Customer does not object within the thirty (30) day period, Customer is deemed to have authorized the new Sub-Processor.

11.5 Sub-Processor Obligations

HL Hunt shall enter into a written agreement with each Sub-Processor that imposes data protection obligations on the Sub-Processor that are no less protective of Personal Data than those set forth in this DPA, to the extent applicable to the Processing performed by the Sub-Processor. HL Hunt shall remain responsible to Customer for the performance of each Sub-Processor's obligations and shall be liable for the acts and omissions of its Sub-Processors to the same extent HL Hunt would be liable if performing the services of each Sub-Processor directly under this DPA, subject to the limitations of liability in the Agreement.

11.6 Emergency Replacement

HL Hunt may replace a Sub-Processor without advance notice where the replacement is necessary to address a security incident, a Sub-Processor's unavailability, or a legal or regulatory requirement, provided that HL Hunt notifies Customer of the replacement as soon as reasonably practicable and Customer's objection rights under Section 11.4 apply from the date of such notice.

12.1 Requests Received by HL Hunt

If HL Hunt receives a request from a Data Subject to exercise any right under Data Protection Laws with respect to Personal Data Processed on behalf of Customer, HL Hunt shall, to the extent legally permitted, promptly notify Customer and refer the Data Subject to Customer. HL Hunt shall not respond to such request except on Customer's documented Instructions or as required by Applicable Law, in which case HL Hunt shall inform Customer of the legal requirement where permitted.

12.2 Assistance with Requests

• HL Hunt shall make available through the Dashboard or API the functionality necessary for Customer to access, export, correct where technically feasible, and delete Verification Records for identified End Users, so that Customer may respond to Data Subject requests to access, obtain a copy of, correct, or delete Personal Data.
• Where Customer is unable to fulfill a Data Subject request using such functionality, HL Hunt shall provide reasonable assistance upon written request, within a timeframe that enables Customer to meet its statutory response deadline.
• HL Hunt shall assist Customer in responding to requests to opt out of or restrict Processing by implementing deletion or restriction Instructions issued by Customer.
• Customer acknowledges that correction of Document Images, Selfie Data, and Biometric Data is not technically feasible, and that a request to correct such data shall be addressed by deletion and re-verification at Customer's election.

12.3 Scope and Cost of Assistance

HL Hunt's assistance under this Section 12 is limited to assistance reasonably necessary for Customer to comply with its obligations under Data Protection Laws, taking into account the nature of the Processing and the information available to HL Hunt. Where assistance is requested beyond the functionality of the Services, is excessive or repetitive, or results from Customer's failure to use available functionality, HL Hunt may charge Customer for such assistance at HL Hunt's then-current professional services rates.

12.4 Data Protection Impact Assessments and Prior Consultation

Taking into account the nature of the Processing and the information available to HL Hunt, HL Hunt shall provide reasonable assistance to Customer in conducting any data protection impact assessment or risk assessment required under Data Protection Laws with respect to Customer's use of the Services, and in any prior consultation with a supervisory authority, by making available documentation describing the Services, the Processing, and the Security Measures. HL Hunt is not responsible for conducting Customer's assessment or for the conclusions Customer reaches.

12.5 Automated Decision-Making

Where a Data Subject exercises a right under Data Protection Laws to opt out of, obtain human review of, or receive an explanation of a decision based solely on automated Processing, Customer is responsible for responding to such request. HL Hunt shall, upon written request, provide Customer with a general description of the logic involved in generating Verification Output sufficient to enable Customer to provide meaningful information to the Data Subject, without disclosing HL Hunt's trade secrets or proprietary models.

13.1 Processing Location

HL Hunt stores Verification Records in data centers located in the United States and Processes Personal Data primarily from the United States. Customer acknowledges and authorizes the transfer of Personal Data to, and its Processing in, the United States and any other location in which HL Hunt or its Sub-Processors maintain operations, subject to this Section 13.

13.2 Transfers from the European Economic Area, United Kingdom, and Switzerland

To the extent Customer transfers Personal Data to HL Hunt that is subject to the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection, and such transfer is not otherwise covered by an adequacy decision or another valid transfer mechanism, the parties agree as follows:

• The Standard Contractual Clauses, Module Two (transfer controller to processor), are hereby incorporated into this DPA by reference, with Customer as the data exporter and HL Hunt as the data importer.
• For purposes of the SCCs: the optional docking clause in Clause 7 shall apply; Option 2 of Clause 9(a) shall apply with a notice period of thirty (30) days; the optional language in Clause 11(a) shall not apply; the governing law under Clause 17 shall be the law of Ireland; the courts under Clause 18(b) shall be the courts of Ireland; Annex I of the SCCs shall be completed by reference to Annex 1 of this DPA; Annex II of the SCCs shall be completed by reference to Annex 2 of this DPA; and Annex III of the SCCs shall be completed by reference to Annex 3 of this DPA and the Sub-Processor list.
• For transfers subject to the UK GDPR, the UK Addendum is incorporated by reference and shall apply to the SCCs as modified thereby, with the tables of the UK Addendum completed by reference to the information in this DPA, and with the exporter and importer each able to end the UK Addendum as set out in Section 19 thereof.
• For transfers subject to the Swiss Federal Act on Data Protection, the SCCs shall apply as modified to reference the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, Swiss law as the governing law to the extent required, and Swiss courts as the competent courts, and the term "member state" shall not be interpreted to exclude Swiss data subjects from suing for their rights in Switzerland.
• In the event the SCCs are superseded, invalidated, or amended, the parties shall cooperate in good faith to implement a replacement transfer mechanism, and HL Hunt may update this Section 13 upon notice to Customer to reflect such replacement.

13.3 Government Access Requests

If HL Hunt receives a legally binding request from a public authority for access to Personal Data transferred under the SCCs, HL Hunt shall, to the extent legally permitted, notify Customer, review the legality of the request, and challenge the request where HL Hunt reasonably concludes that there are grounds to do so, in accordance with Clause 15 of the SCCs. HL Hunt represents that, as of the Effective Date, it has not received any such request and that it is not aware of any law or practice that would prevent it from fulfilling its obligations under the SCCs.

13.4 Other Jurisdictions

To the extent Data Protection Laws of any other jurisdiction impose requirements on the transfer of Personal Data to HL Hunt, Customer shall notify HL Hunt in writing before transferring such Personal Data, and the parties shall cooperate in good faith to implement any additional transfer mechanism required. HL Hunt may decline to Process Personal Data from any jurisdiction where HL Hunt determines that compliance with local transfer requirements is not commercially practicable.

14.1 CCPA Service Provider Terms

To the extent the CCPA applies to Personal Data Processed under this DPA, HL Hunt certifies that it understands and shall comply with the following restrictions, and the parties agree that:

• Customer discloses Personal Data to HL Hunt solely for the limited and specified Business Purposes of providing the Services as set forth in the Agreement and Annex 1.
• HL Hunt shall not Sell or Share Personal Data.
• HL Hunt shall not retain, use, or disclose Personal Data for any purpose, including any Commercial Purpose, other than the Business Purposes specified in the Agreement, or as otherwise permitted by the CCPA and its regulations.
• HL Hunt shall not retain, use, or disclose Personal Data outside of the direct business relationship between HL Hunt and Customer.
• HL Hunt shall not combine Personal Data received from Customer with personal information that HL Hunt receives from or on behalf of another person or persons, or that HL Hunt collects from its own interactions with consumers, except as expressly permitted by the CCPA regulations.
• HL Hunt shall comply with all applicable obligations under the CCPA and shall provide the same level of privacy protection as is required of businesses by the CCPA.
• Customer has the right to take reasonable and appropriate steps to ensure that HL Hunt uses Personal Data in a manner consistent with Customer's obligations under the CCPA, including through the audit rights in Section 15.
• HL Hunt shall notify Customer within ten (10) business days after HL Hunt determines that it can no longer meet its obligations under the CCPA.
• Customer has the right, upon notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Data by HL Hunt.
• HL Hunt shall cooperate with Customer in responding to verifiable consumer requests as described in Section 12.
• HL Hunt shall flow down the obligations of this Section 14.1 to any Sub-Processor that Processes Personal Data subject to the CCPA.

14.2 Other U.S. State Privacy Laws

To the extent any U.S. State Privacy Law applies to Personal Data Processed under this DPA, HL Hunt shall: adhere to Customer's Instructions regarding the nature, purpose, and duration of Processing as set forth in this DPA and Annex 1; ensure that each person Processing Personal Data is subject to a duty of confidentiality; delete or return Personal Data at the end of the provision of Services in accordance with Section 16, unless retention is required by law; make available to Customer all information in HL Hunt's possession necessary to demonstrate HL Hunt's compliance; allow and cooperate with reasonable assessments by Customer or its designated assessor, or arrange for a qualified independent assessor to conduct an assessment, in accordance with Section 15; and engage Sub-Processors only pursuant to a written contract that requires the Sub-Processor to meet HL Hunt's obligations with respect to Personal Data, in accordance with Section 11.

14.3 Sensitive Data

Customer acknowledges that Biometric Data and government identification numbers appearing on Identity Documents constitute Sensitive Personal Information under the CCPA and sensitive data under the U.S. State Privacy Laws, that the Processing of such data may require the Data Subject's consent or an opportunity to limit its use and disclosure, and that Customer is solely responsible for obtaining such consent and for honoring any request to limit the use of Sensitive Personal Information to the extent required by Data Protection Laws. HL Hunt uses Sensitive Personal Information solely for the purposes of performing the Services, which the parties agree are purposes for which a consumer's right to limit does not apply to the extent permitted by the CCPA regulations.

14.4 Gramm-Leach-Bliley Act

To the extent Customer is a financial institution subject to the GLBA and discloses nonpublic personal information to HL Hunt, HL Hunt shall: use such information solely to perform the Services for Customer; maintain the Security Measures, which are designed to satisfy the requirements applicable to service providers under the Safeguards Rule; not disclose such information to any third party except as necessary to perform the Services, as permitted by the GLBA, or as required by law; and notify Customer of any Personal Data Breach involving such information in accordance with Section 10. Customer represents that its disclosure of nonpublic personal information to HL Hunt is permitted under an exception set forth in 15 U.S.C. § 6802(e).

14.5 Washington My Health My Data Act and Similar Laws

To the extent the Washington My Health My Data Act, the Nevada consumer health data law, or any similar law treats Biometric Data as consumer health data, Customer is the regulated entity and HL Hunt is the processor. Customer is responsible for obtaining any consent required for the collection and sharing of such data and for providing any required consumer health data privacy policy. HL Hunt shall Process such data only pursuant to a binding contract and Customer's Instructions as set forth in this DPA.

15.1 Documentation and Reports

Upon Customer's written request, not more than once in any twelve (12) month period unless required by a supervisory authority or following a Personal Data Breach, HL Hunt shall make available to Customer, subject to confidentiality obligations: a summary description of the Security Measures; the executive summary of HL Hunt's most recent third-party penetration test; any third-party security audit report or certification HL Hunt holds; and written responses to a reasonable security questionnaire. Customer agrees to exercise its audit rights first by reviewing such documentation.

15.2 On-Site and Remote Audits

If the documentation provided under Section 15.1 is insufficient to demonstrate HL Hunt's compliance with this DPA, or if an audit is required by Data Protection Laws or a supervisory authority, Customer may conduct an audit of HL Hunt's relevant controls, subject to the following conditions:

• Audits shall be conducted not more than once in any twelve (12) month period, except following a Personal Data Breach affecting Customer's Personal Data or where required by a supervisory authority.
• Customer shall provide at least thirty (30) days' prior written notice, together with a proposed audit scope and plan, which the parties shall agree in good faith before the audit commences.
• Audits shall be conducted during HL Hunt's normal business hours, in a manner that does not unreasonably interfere with HL Hunt's operations, and remotely wherever practicable.
• Audits shall be limited to the systems, facilities, and records relevant to the Processing of Customer's Personal Data and shall not extend to the data of other HL Hunt customers, HL Hunt's proprietary models and source code, or HL Hunt's internal financial information.
• Customer may use an independent third-party auditor, provided the auditor is not a competitor of HL Hunt, is bound by written confidentiality obligations acceptable to HL Hunt, and is subject to HL Hunt's reasonable security requirements.
• Customer shall bear all costs of the audit, including reimbursement of HL Hunt's reasonable internal costs at HL Hunt's then-current professional services rates, unless the audit reveals a material breach of this DPA by HL Hunt.
• All audit results constitute HL Hunt's Confidential Information and may be used by Customer solely to assess compliance with this DPA and to satisfy Customer's regulatory obligations.

15.3 Regulator Audits

Where a supervisory authority or regulator with jurisdiction over Customer requires an audit of HL Hunt's Processing of Customer's Personal Data, HL Hunt shall cooperate reasonably with such audit, subject to the conditions of Section 15.2 to the extent consistent with the regulator's requirements and to reimbursement of HL Hunt's reasonable costs by Customer.

15.4 Findings and Remediation

Customer shall provide HL Hunt with a copy of any audit findings. If an audit identifies a material non-conformity with this DPA, HL Hunt shall develop and implement a remediation plan within a commercially reasonable period and shall keep Customer informed of its progress.

16.1 Export During Term and Transition Period

During the term of the Agreement and for thirty (30) days following its expiration or termination, Customer may export Verification Records through the Dashboard or API in a commonly used, machine-readable format, subject to Customer's compliance with the Agreement and payment of all outstanding fees.

16.2 Post-Termination Retention

Following expiration or termination of the Agreement, HL Hunt shall continue to retain Verification Records for the remainder of the Default Retention Period, or any shorter period instructed under Section 8, in accordance with Customer's standing Instruction in Section 8.1 and for the purposes described therein, and shall destroy such Verification Records in accordance with Section 8.5 upon expiration of the applicable period. Customer acknowledges that this post-termination retention is a documented Instruction and is not a retention by HL Hunt for its own purposes.

16.3 Deletion on Instruction

Customer may, at any time following termination, instruct HL Hunt in writing to delete all or any portion of its Verification Records before the expiration of the applicable retention period. HL Hunt shall complete such deletion within thirty (30) days of receipt, subject to Section 8.4, and shall provide a certificate of destruction upon request.

16.4 Exceptions

HL Hunt may retain Personal Data following termination to the extent required by Applicable Law, as provided in Section 8.4, and may retain Fraud Signals and Aggregated Data as an independent Controller in accordance with Section 3.3. Any Personal Data retained under this Section shall remain subject to the confidentiality and security obligations of this DPA for so long as it is retained.

17.1 Limitation of Liability

Each party's liability arising out of or related to this DPA, including the SCCs where applicable, is subject to the exclusions and limitations of liability set forth in Section 18 of the Agreement. The limitation of liability in Section 18.2 of the Agreement applies in the aggregate to all claims arising under the Agreement and this DPA together, and not separately to each. Nothing in this Section 17.1 limits liability to Data Subjects under the SCCs to the extent such limitation is prohibited by the SCCs.

17.2 Indemnification by Customer

In addition to and without limiting Section 19.1 of the Agreement, Customer shall defend, indemnify, and hold harmless the HL Hunt Indemnified Parties from and against all Losses arising out of or related to: (a) Customer's failure to provide any notice, obtain any consent, or secure any written release required by Data Protection Laws or Biometric Privacy Laws; (b) any claim by a Data Subject, supervisory authority, or regulator arising from Customer's Instructions, including the Default Retention Period, or from Customer's failure to issue an Instruction required under Section 8.3; (c) Customer's submission of Prohibited Data in violation of Section 5.4; (d) any Processing by HL Hunt in accordance with Customer's Instructions that is alleged to violate Data Protection Laws; and (e) Customer's breach of this DPA. Customer's obligations under this Section 17.2 are not subject to any limitation of liability.

17.3 Claims by Data Subjects

Customer shall be responsible for, and shall handle in the first instance, all claims and complaints brought by Data Subjects relating to the Processing of Personal Data under this DPA. To the extent a Data Subject brings a claim directly against HL Hunt arising from Customer's Instructions or Customer's failure to comply with Data Protection Laws, Customer shall indemnify HL Hunt in accordance with Section 17.2.

18.1 Term

This DPA shall take effect on the Effective Date and shall remain in effect for so long as HL Hunt Processes Personal Data on behalf of Customer, including throughout the Default Retention Period and any extended retention under Section 8.4, notwithstanding the expiration or termination of the Agreement.

18.2 Amendments

HL Hunt may update this DPA from time to time upon notice to Customer in accordance with Section 22 of the Agreement to reflect changes in Data Protection Laws, changes in the Services, or changes in HL Hunt's Sub-Processors or Security Measures, provided that no such update shall materially reduce the level of protection afforded to Personal Data during a committed term without Customer's consent. Where an update is required by Data Protection Laws, it shall take effect on the date specified in the notice.

18.3 Severability

If any provision of this DPA is held to be invalid or unenforceable, such provision shall be modified to the minimum extent necessary to make it valid and enforceable, or if modification is not possible, severed, and the remaining provisions shall continue in full force and effect.

18.4 Governing Law and Dispute Resolution

This DPA shall be governed by the laws of the Commonwealth of Kentucky, and any dispute arising under this DPA shall be resolved in accordance with Section 20 of the Agreement, except to the extent the SCCs require the application of the law of, or the jurisdiction of the courts of, an EU member state or the United Kingdom with respect to the transfer to which they apply.

18.5 Relationship to the Agreement

Except as expressly modified by this DPA, the Agreement remains in full force and effect. This DPA does not create any obligation on HL Hunt that is not required by Data Protection Laws or expressly set forth herein, and shall not be construed to expand HL Hunt's obligations or liability beyond those set forth in the Agreement.

18.6 Survival

Sections 7, 8, 10, 16, 17, and 18, and any other provision that by its nature is intended to survive, shall survive the expiration or termination of this DPA for so long as HL Hunt retains any Personal Data.

18.7 Privacy Contact

All Instructions, deletion requests, Data Subject request referrals, Sub-Processor objections, audit requests, and other notices under this DPA shall be sent to:

A. List of Parties

B. Description of Transfer and Processing

C. Competent Supervisory Authority

Where the SCCs apply, the competent supervisory authority shall be determined in accordance with Clause 13 of the SCCs. Where the data exporter is established in an EU member state, the supervisory authority of that member state shall be competent. Where the data exporter is not established in the EU but is subject to the GDPR under Article 3(2) and has appointed a representative, the supervisory authority of the member state in which the representative is established shall be competent. Customer shall identify the applicable supervisory authority in writing upon request.