Data Processing Addendum

This Data Processing Addendum (the "DPA") governs Stern Bench's processing of DPA Data that Stern Bench processes on Your behalf as a processor under Stern Bench Research.

1. Scope

1.1. This DPA forms part of the applicable Terms only to the extent Stern Bench acts as a processor of DPA Data on Your behalf under a paid subscription, pilot arrangement, order form, or other written agreement.

1.2. As between You and Stern Bench, You are the controller and Stern Bench is the processor with respect to DPA Data covered by this DPA.

1.3. Stern Bench acts as an independent controller with respect to:

• publicly sourced case law and judicial decisions that Stern Bench independently collects, processes, and makes available through the Service;
• Stern Bench's own operational, security, analytics, attribution, reliability, abuse-prevention, and similar processing described in the Privacy Policy that is not performed on Your behalf; and
• data processing carried out outside the scope of processor-role paid services or another written processor relationship.

1.4. For Stern Bench Research, DPA Data is limited to retained account information and other personal data Stern Bench expressly agrees in writing to process on Your behalf under an applicable paid arrangement. Session-scoped prompts, unsaved interactions, default session-visible outputs, and general operational metadata are not DPA Data unless the parties expressly agree otherwise in writing.

2. Processing Requirements

Stern Bench will:

• process DPA Data only on Your documented instructions and as necessary to provide the Service;
• notify You if it cannot comply with this DPA;
• inform You if, in Stern Bench's opinion, an instruction infringes applicable data protection law; and
• ensure that persons authorized to process DPA Data are subject to confidentiality obligations.

3. Subprocessors

3.1. Stern Bench may use subprocessors to provide the Service.

3.2. Stern Bench will impose contractual obligations on subprocessors requiring them to provide an appropriate level of data protection and confidentiality for DPA Data they process on Stern Bench's behalf.

3.3. Stern Bench will remain responsible for the acts and omissions of its subprocessors to the extent provided in the Terms and this DPA.

4. Notice and Data Subject Requests

To the extent legally permitted, Stern Bench will inform You if it receives:

• a legally binding request for disclosure of DPA Data by a law enforcement authority;
• a notice, inquiry, or investigation by a supervisory authority with respect to DPA Data; or
• a complaint or request from a data subject exercising rights under applicable data protection law with respect to DPA Data.

Other than requesting more information or identifying the data subject, Stern Bench will not respond to a data subject request regarding DPA Data without prior written authorization from You unless required by law.

5. Personal Data Breach

If Stern Bench experiences a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to DPA Data, Stern Bench will notify You without undue delay and, where applicable, within 72 hours of becoming aware of the breach.

6. Security

Stern Bench will implement and maintain appropriate technical and organizational measures to protect DPA Data against unauthorized or accidental access, loss, alteration, disclosure, or destruction, including measures relating to encryption in transit, access controls, and incident response appropriate to the Service and the applicable paid arrangement.

7. Cross-Border Data Transfers

Unless You and Stern Bench agree otherwise in writing, DPA Data may be processed in Canada, the United Kingdom, the United States, or other jurisdictions where Stern Bench's subprocessors operate.

Where required by applicable law, Stern Bench will use appropriate contractual or legal transfer mechanisms for cross-border transfers of DPA Data.

8. Retention and Deletion

This DPA remains in effect until (i) the applicable Service is terminated and (ii) Stern Bench no longer processes DPA Data on Your behalf.

Following termination or Your reasonable written request, Stern Bench will return or delete DPA Data within a commercially reasonable period, taking into account the applicable architecture, backup cycling, and any retention required by law.

9. Contact

For data protection inquiries relating to this DPA, contact founder@sternbench.com.