Data processing addendum

Version 1.0 · Effective October 29, 2026

This Data Processing Addendum (this "DPA") forms part of the Client Services & Subscription Agreement at sapiura.com/client-agreement (the "Client Agreement") between Sapiura Systems LLC, a Wyoming limited liability company ("Sapiura"), and the client named in the Client Agreement ("Client" or "Agency"). Each is a "party."

Client accepts this DPA when it accepts the Client Agreement. This DPA is incorporated into the Client Agreement and needs no separate signature. On request, Sapiura will countersign a copy for Client's records.

Plain-English summary (not a substitute for the terms below): Client's website visitors and prospects belong to Client. Sapiura handles their information only to run Client's website and forms, only as Client instructs, and only as a service provider. Sapiura never sells it, never markets to them, never feeds quote-form contents to AI, keeps a 30-day backup only, protects it, tells Client within 72 hours if something goes wrong, and helps Client meet its insurance-law and privacy-law duties. Each forwarded submission carries its consent record, and Client (not Sapiura) keeps those records long-term.

1. Definitions

Capitalized terms not defined here have the meanings given in the Client Agreement.

1.1 "Applicable Data Protection Law" means every U.S. federal and state law and regulation that applies to the Processing of Client Personal Information under the Client Agreement, as amended from time to time. It includes, as applicable:

• Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. §6801 et seq. ("GLBA"), and its implementing regulations and rules;
• state insurance privacy laws and regulations based on the NAIC Privacy of Consumer Financial and Health Information Regulation (Model 672) or the NAIC Insurance Information and Privacy Protection Model Act (Model 670);
• state insurance data security laws based on the NAIC Insurance Data Security Model Law (Model 668) ("Insurance Data Security Laws");
• 23 NYCRR Part 500 ("NY DFS Cybersecurity Regulation");
• the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, Cal. Civ. Code §1798.100 et seq., and its regulations, Cal. Code Regs. tit. 11, §7000 et seq. (together, "CCPA");
• the comprehensive consumer privacy laws of other states, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, and those of any state that takes effect during the term ("State Privacy Laws");
• state data-breach notification and data-security laws, including the Florida Information Protection Act of 2014, Fla. Stat. §501.171 ("FIPA"); and
• Section 5 of the FTC Act.

1.2 "Client Personal Information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, and that Sapiura Processes on behalf of Client under the Client Agreement. It includes NPI, and it includes the categories listed in Annex 1. It does not include:

• information Sapiura collects for its own purposes as described in Sapiura's Privacy Policy (sapiura.com/privacy), such as Client's own billing contacts and signer details; or
• aggregated or de-identified information that cannot reasonably be linked to an individual, as permitted by Section 4.5.

1.3 "Nonpublic Personal Information" or "NPI" has the meaning given in GLBA and the state insurance privacy laws that apply to Client. It also includes "nonpublic information" as defined in the Insurance Data Security Laws and the NY DFS Cybersecurity Regulation. In practice, NPI includes information a consumer gives Client to obtain an insurance product, such as names, contact details, coverage interests and current-policy renewal dates in a quote request.

1.4 "Process" or "Processing" means any operation performed on Client Personal Information, such as collecting, receiving, recording, storing, forwarding, retrieving, using, disclosing, backing up or deleting it.

1.5 "Security Incident" means either of the following:

• any confirmed unauthorized access to, or acquisition, use, disclosure, modification, loss or destruction of, Client Personal Information while it is in Sapiura's or a Subprocessor's possession or control; or
• a "cybersecurity event" (as defined in an Insurance Data Security Law) or a "cybersecurity incident" (as defined in 23 NYCRR §500.1) that directly affects Client's Information Systems or Client Personal Information held by Sapiura or a Subprocessor.

It does not include unsuccessful attempts or activities that do not compromise the security of Client Personal Information. Examples are pings, port scans, blocked log-in attempts, denial-of-service attacks that do not lead to access to data, and spam.

1.6 "Subprocessor" means any third party, other than Sapiura personnel, that Sapiura engages to Process Client Personal Information.

1.7 "Services" means The Site, form forwarding, the AI Assistant and the related services Sapiura provides under the Client Agreement.

1.8 "Consumer" means an individual whose Client Personal Information is Processed under this DPA. The term includes "consumer" and "customer" under GLBA and state insurance laws, and "consumer" under the CCPA and State Privacy Laws.

1.9 "Information Systems" has the meaning given in the Insurance Data Security Laws and the NY DFS Cybersecurity Regulation.

1.10 The terms "business," "service provider," "sell," "share," "business purpose," "controller," "processor," "licensee" and "third-party service provider" have the meanings given in Applicable Data Protection Law.

2. Roles and scope

2.1 Roles. For Client Personal Information:

• Client is the "business," "controller," "financial institution" and "licensee" (as applicable).
• Sapiura is Client's "service provider," "processor," non-affiliated third party under the GLBA service-provider exception (12 C.F.R. §1016.13 and its state-insurance-law counterparts), and "third-party service provider" under the Insurance Data Security Laws and the NY DFS Cybersecurity Regulation.

2.2 Not an insurance producer. Sapiura is not a licensed insurance producer. Sapiura does not solicit, negotiate, sell or advise on insurance. It does not contact Consumers, and it receives no compensation that depends on any insurance transaction. Nothing in this DPA makes Sapiura a joint controller, an agent of Client for any insurance purpose, or a "third party" to which Client "sells" or "shares" personal information.

2.3 Client's responsibilities. Client is responsible for:

• having a lawful basis for collecting Client Personal Information and directing Sapiura to Process it;
• giving all notices and obtaining all consents Applicable Data Protection Law requires of Client, including its own privacy notice, its GLBA and state insurance privacy notices, and its form notices and consent text;
• the accuracy of Client Personal Information;
• deciding which forms, fields and integrations to use; and
• its own compliance with Applicable Data Protection Law, including its own information security program, its own oversight of third-party service providers, and its own notifications to regulators and Consumers.

Client will not instruct Sapiura to collect sensitive information, such as Social Security numbers, driver's license numbers, health information or financial account numbers, through Sapiura-built forms unless the parties first agree in writing on additional safeguards.

2.3A Consent records. Each form submission Sapiura forwards includes its consent record: at least the version identifier of the consent text shown, the state of each consent checkbox (ticked or not), and the time of submission, together with the other fields listed in Annex 1. Client is responsible for keeping these records, for example in its CRM, for as long as it needs them to prove consent. Sapiura recommends at least 4 years (the TCPA's limitations period), and the Agency Website Legal Template Kit recommends 5. Sapiura's own copies are deleted with the 30-day backup under Section 11. Sapiura is not the custodian of Client's TCPA or other consent records and does not keep them beyond that 30-day period.

2.4 Sapiura's own data. Sapiura's Processing of personal information for its own purposes, such as Client's billing contacts, signer records, and Client's own checkout and automatic-renewal consent records, is governed by Sapiura's Privacy Policy and not by this DPA.

3. Processing instructions

3.1 Documented instructions. Sapiura will Process Client Personal Information only:

• (a) on Client's documented instructions. These are this DPA, the Client Agreement, Annex 1, and any written instruction Client gives that is consistent with them and that Sapiura accepts, such as an approval given through the AI Assistant or an email from an authorized approver; or
• (b) as required by law. In that case, unless the law prohibits it, Sapiura will tell Client before Processing, and in any case within 48 hours after receiving the legal requirement.

Sapiura will tell Client promptly if it believes an instruction violates Applicable Data Protection Law. Sapiura may then suspend that Processing until Client confirms or changes the instruction.

3.2 Specified business purposes. Client discloses Client Personal Information to Sapiura, and Sapiura will Process it, only for the following specific business purposes. Annex 1 describes them in more detail.

• (a) Form forwarding. Receiving submissions from quote, contact and similar forms on Client's website, and delivering them to the destinations Client chooses (CRM, email inbox and producer alerts), including through vendor integrations Client authorizes.
• (b) Temporary backup. Keeping a backup copy of each form submission for 30 days after receipt, solely so that a submission is not lost if delivery fails, and so that Client can re-send or export it. Sapiura then deletes it.
• (c) Website build, hosting support and maintenance. Building, configuring, testing, launching and maintaining Client's website, including team pages, licensing disclosures and listings, using the information Client provides about its personnel.
• (d) AI Assistant. Carrying out change requests Client approves, which may involve sending the request text and the affected website content (including published personnel information, such as team names and bios) to AI model providers listed on the Subprocessor List. Producing aggregate counts of visits, form submissions, referrers and AI-tool visits from the website's cookie-free analytics. The AI Assistant reports counts only, and does not Process the contents of form submissions. If Client puts Consumer information into a request despite the Acceptable Use Policy, Sapiura will delete it from its own systems on notice where possible, and Processing it as part of the request is not a breach of this DPA by Sapiura.
• (e) Onboarding and support. Communicating with Client's authorized approvers and team members to deliver and support the Services.
• (f) Security and integrity. Detecting and preventing security incidents, spam, bots and fraud affecting Client's forms and website, and debugging to fix errors.
• (g) Legal compliance. Complying with law, and keeping the records this DPA requires.

4. Service-provider commitments (CCPA, State Privacy Laws and GLBA)

Sapiura will:

4.1 No selling or sharing. Not sell or share Client Personal Information.

4.2 Purpose limitation. Not retain, use or disclose Client Personal Information:

• for any purpose other than the business purposes in Section 3.2, including for any other commercial purpose; or
• outside the direct business relationship between Sapiura and Client,

except as the CCPA and its regulations (including Cal. Code Regs. tit. 11, §7050) and other Applicable Data Protection Law expressly permit.

4.3 No combining. Not combine Client Personal Information with personal information Sapiura receives from or on behalf of another person, or collects from its own interactions with a Consumer, except as Cal. Code Regs. tit. 11, §7050(a) permits.

4.4 No marketing, no contact, no AI training. Not:

• use Client Personal Information to market to Consumers, or contact Consumers;
• build profiles of Consumers;
• send the contents of form submissions to any AI model; or
• use Client Personal Information to train or improve any AI model.

4.5 De-identified and aggregated data. Use aggregated or de-identified information derived from the Services only to operate and improve the Services. Sapiura will keep that information de-identified and will not attempt to re-identify it. It will contractually require any recipient to do the same. It will take the other measures Cal. Civ. Code §1798.140(m) requires.

4.6 GLBA reuse and redisclosure limits. Use and disclose NPI only in the ordinary course of business to carry out the activity for which Client disclosed it. Not redisclose NPI to anyone other than:

• Client, or Client's affiliates;
• Subprocessors acting under Section 7; or
• as required by law.

This is consistent with 12 C.F.R. §1016.11 and the corresponding state insurance privacy regulations. Sapiura will not disclose any account number or similar access number for a Consumer's account to any non-affiliated third party for marketing (12 C.F.R. §1016.12).

4.7 Compliance and equal protection. Comply with the obligations that Applicable Data Protection Law places on service providers, processors and third-party service providers. Provide the same level of privacy protection the CCPA and State Privacy Laws require of Client.

4.8 Confidentiality of personnel. Ensure that every person Sapiura authorizes to Process Client Personal Information:

• is bound by a written duty of confidentiality;
• receives appropriate privacy and security training; and
• has access only to the extent needed for the Services.

4.9 Notice of inability to comply. Notify Client in writing within five (5) Business Days if Sapiura determines it can no longer meet its obligations under this DPA or Applicable Data Protection Law. Client may then exercise the rights in Sections 4.10 and 13.3.

4.10 Client's right to take reasonable steps. Client may take reasonable and appropriate steps to ensure that Sapiura uses Client Personal Information consistently with Client's obligations under Applicable Data Protection Law, through the assessments in Section 10. On notice, including notice under Section 4.9, Client may also take reasonable and appropriate steps to stop and remediate any unauthorized use of Client Personal Information. These steps include directing Sapiura to stop the Processing, delete or return the data, and give written confirmation that data subject to a deletion request is no longer retained or used.

4.11 Certification. Sapiura certifies that it understands the restrictions in this Section 4 and in Section 3, and will comply with them.

4.12 Disclosure to authorities. If a government authority or any other third party asks Sapiura for Client Personal Information, Sapiura will:

• refer the request to Client unless the law prohibits it;
• notify Client within 48 hours unless the law prohibits it;
• disclose only what is legally required; and
• reasonably cooperate if Client seeks to challenge the request, at Client's expense.

5. Information security program

5.1 Written program. Sapiura will implement and maintain a written information security program. The program will:

• contain administrative, technical and physical safeguards that are appropriate to Sapiura's size and complexity, to the nature and scope of its activities, and to the sensitivity of Client Personal Information;
• be designed to protect the security, confidentiality, integrity and availability of Client Personal Information;
• protect against reasonably anticipated threats or hazards, and against unauthorized access or use that could result in substantial harm or inconvenience to any Consumer;
• provide for the secure disposal of Client Personal Information; and
• satisfy the reasonable-security requirements of Cal. Civ. Code §1798.81.5, Fla. Stat. §501.171(2) and the Insurance Data Security Laws, to the extent they apply to a third-party service provider.

5.2 Minimum controls. The program will include at least the measures in Annex 2. These include:

• access controls based on least privilege;
• multi-factor authentication for any individual who accesses Sapiura systems containing Client Personal Information, consistent with 23 NYCRR §500.12;
• encryption of Client Personal Information in transit over external networks and at rest, consistent with 23 NYCRR §500.15;
• security logging and monitoring;
• vulnerability and patch management;
• secure development and change control;
• personnel confidentiality and training;
• vendor oversight; and
• a written incident response plan.

5.3 Updates. Sapiura may update its security measures over time, but it will not materially reduce the overall protection of Client Personal Information during the term.

5.4 Representations and warranties. Sapiura represents and warrants that, throughout the term:

• (a) it maintains the program described in this Section 5 and Annex 2;
• (b) it does not request or store Client's passwords. Client grants Sapiura access through delegated or invited user roles in Client's own accounts, and may revoke that access at any time; and
• (c) its descriptions of its security practices in this DPA and in any questionnaire response are accurate in all material respects when given.

5.5 No certification promised. Sapiura does not represent that it holds SOC 2, ISO 27001 or any similar certification. Nothing in this DPA requires it to obtain one.

6. Security Incidents

6.1 Notice. Sapiura will notify Client of a Security Incident without undue delay, and in any event no later than seventy-two (72) hours after Sapiura confirms it, or determines that it has reason to believe it occurred.

• Florida. This period is intended to satisfy, and is shorter than, the 10-day period that FIPA (Fla. Stat. §501.171(6)) gives a third-party agent to notify a covered entity.
• Other states. It is also intended to satisfy the "immediately," "as soon as practicable" and similar service-provider notice requirements of other state breach laws.
• Regulator deadlines. It is intended to give Client time to meet its own regulator deadlines, such as the 72-hour notice to the insurance commissioner under the Insurance Data Security Laws and to the NY DFS superintendent under 23 NYCRR §500.17.

If Sapiura has reasonable grounds to suspect a Security Incident but has not yet confirmed it, Sapiura will alert Client promptly when the suspected incident is likely to require Client to act.

6.2 Method. Sapiura will send notice by email to Client's designated security or privacy contact, or to its primary account contact if none is designated. It will also call that contact or send a text message when the incident is serious.

6.3 Content. The notice will include as much of the following as is then known, and Sapiura will add the rest as it becomes known:

• (a) the date, or estimated date, of the Security Incident and the date it was discovered;
• (b) a description of what happened, including how the information was exposed, accessed or used, and whether it has been contained;
• (c) the types of Client Personal Information involved;
• (d) the approximate number of Consumers affected, and their states of residence if known;
• (e) the Information Systems involved;
• (f) whether any law enforcement or government agency has been notified;
• (g) what Sapiura has done and plans to do to contain, investigate and remediate the incident;
• (h) the Subprocessor involved, if any; and
• (i) a contact person at Sapiura.

Sapiura will give Client all information reasonably needed to meet Client's notice obligations, including under Fla. Stat. §501.171(6), Model 668 §6 as adopted, and 23 NYCRR §500.17.

6.4 Investigation and cooperation. Sapiura will:

• promptly investigate the incident, take reasonable steps to contain and remediate it, and preserve relevant evidence and logs;
• cooperate reasonably with Client, its insurers, forensic investigators and regulators; and
• give Client updates at least every five (5) Business Days until the incident is resolved, followed by a written post-incident summary that includes the measures taken to prevent recurrence.

Notification by Sapiura is not an admission of fault or liability.

6.5 Who notifies. Client decides whether, when and how to notify Consumers, regulators, credit reporting agencies and others. Client is responsible for giving those notices unless the parties agree in writing that Sapiura will give them on Client's behalf. If the parties agree that Sapiura will give them, Sapiura will follow Client's reasonable instructions and Client's approved text.

6.6 No public statements. Without Client's prior written consent, Sapiura will not make any public statement, or notify any Consumer, that names Client or identifies Client's data, except as required by law. Where the law requires a statement, Sapiura will give Client as much advance notice as the law allows.

6.7 Costs. If a Security Incident results from Sapiura's or its Subprocessor's breach of this DPA, Sapiura will reimburse Client's reasonable, documented out-of-pocket costs of the following, subject to Section 14:

• legally required notices to Consumers and regulators;
• legally required credit monitoring or identity-protection services; and
• reasonable forensic investigation.

7. Subprocessors

7.1 General authorization. Client gives general written authorization for Sapiura to engage Subprocessors, including those listed on the Subprocessor List at sapiura.com/subprocessors on the date Client accepts this DPA.

7.2 Subprocessor contracts. Before any Subprocessor Processes Client Personal Information, Sapiura will put in place a written contract with it that:

• limits its Processing to the purposes in Section 3.2;
• contains privacy and security obligations at least as protective as those in this DPA, including the restrictions in Section 4 and the requirements of Cal. Code Regs. tit. 11, §7051 and the State Privacy Laws; and
• requires it to notify Sapiura of security incidents promptly enough for Sapiura to meet Section 6.

Where a Subprocessor is a large provider that offers only its own standard terms (for example, a cloud infrastructure provider), Sapiura may rely on those terms, provided Sapiura has assessed them and found that they give substantially equivalent protection. Sapiura will carry out reasonable due diligence on each Subprocessor's security before engaging it, and periodically afterward.

7.3 Responsibility. Sapiura remains responsible to Client for its Subprocessors' performance of their obligations, as if it had performed them itself.

7.4 Notice of new Subprocessors. Sapiura will give at least thirty (30) days' notice before a new Subprocessor begins Processing Client Personal Information. It will give the notice by updating sapiura.com/subprocessors and by emailing Client's primary contact. The notice will state the Subprocessor's name, its purpose, the data involved and where it Processes the data.

Emergency replacements. If a Subprocessor must be replaced urgently, for example because it has failed, been compromised or discontinued its service, Sapiura may replace it sooner. Sapiura will then give notice as soon as practicable and in any case within five (5) Business Days.

7.5 Objection. Client may object to a new Subprocessor on reasonable data-protection grounds by emailing info@sapiura.com within the 30-day notice period. The parties will then work in good faith to resolve the objection, for example by changing configuration or using an alternative. If the objection is not resolved within 30 days after Client raises it, Client may terminate the affected Services by written notice, without penalty. That termination is treated as a discontinuation of the affected Service by Sapiura, so Sapiura will refund the unused prepaid portion pro rata by day, as Client Agreement Section 11.9(c) provides. This remedy is in addition to Client's walk-away rights under the Deed-in-Your-Name Terms.

8. Assistance

8.1 Consumer requests. Taking into account the nature of the Processing, Sapiura will reasonably assist Client to respond to Consumer requests under Applicable Data Protection Law, including requests to access, delete, correct, port or opt out. Sapiura will:

• (a) forward to Client, within five (5) Business Days, any request Sapiura receives that relates to Client Personal Information. Sapiura will not respond to the request itself, except to tell the Consumer that it has been forwarded to Client;
• (b) within ten (10) Business Days after Client's written instruction, or sooner if Client's legal deadline requires it, search for, provide, correct or delete the relevant Client Personal Information. This includes its backup copies, subject to Section 11.3;
• (c) instruct its Subprocessors to do the same, and notify any service providers or contractors that received the information from or through Sapiura, as Cal. Civ. Code §1798.105(c)(3) requires; and
• (d) give Client written confirmation when it has completed the instruction.

8.2 Assessments and regulators. Sapiura will provide information Client reasonably requests to help it:

• (a) carry out risk assessments, data protection assessments and cybersecurity audits required of Client under the CCPA regulations (Cal. Code Regs. tit. 11, §§7120–7157), State Privacy Laws, Insurance Data Security Laws and the NY DFS Cybersecurity Regulation;
• (b) complete its annual certifications of compliance to insurance regulators; and
• (c) respond to an inquiry, examination or investigation by a regulator, including a state insurance department, the NY DFS, a state attorney general or the California Privacy Protection Agency. Sapiura will notify Client promptly if a regulator contacts Sapiura about Client Personal Information, unless the law prohibits it.

8.3 Cost. Sapiura provides the assistance in Sections 8.1 and 8.2(a)–(b) at no extra charge, as long as it is reasonable in scope. Assistance that requires substantial effort beyond the ordinary may be charged at Sapiura's then-current reasonable hourly rate, but only if Sapiura gives Client a written estimate first and Client approves it. Assistance needed because of Sapiura's own breach is always free.

9. Records

Sapiura will keep records of:

• the categories of Processing it carries out for Client;
• its Subprocessors;
• Security Incidents affecting Client Personal Information; and
• the Consumer requests it forwards or carries out for Client.

These records will be kept for at least the life of the Client Agreement plus 24 months (the period the CCPA regulations require for consumer-request records), except that records of Security Incidents are kept for at least five (5) years (Annex 3, Part C.7), and longer where the law requires it. They contain no form-submission contents beyond the 30-day backup period. Sapiura will make them available to Client on reasonable request.

10. Assessments and audits

10.1 Annual questionnaire. Once every twelve (12) months, on Client's written request, Sapiura will complete one reasonable written security and privacy questionnaire, or provide a written summary of its security controls and its compliance with this DPA. Sapiura may answer with its standard security summary where that answers the question asked. This satisfies Client's right to take reasonable steps under Section 4.10 and Cal. Code Regs. tit. 11, §7051(a)(7). It also supports Client's due diligence and periodic assessment obligations under 23 NYCRR §500.11 and the Insurance Data Security Laws.

10.2 Additional documentation. Sapiura will also give Client reasonable further documentation that is necessary to demonstrate compliance, such as:

• relevant policies, presented in summary or redacted form;
• Subprocessor terms that it is permitted to share; and
• confirmation of deletion.

10.3 On-site or live audits. Client, or an independent auditor bound by confidentiality, may conduct an on-site or live remote audit of Sapiura's Processing of Client Personal Information only:

• (a) after a Security Incident affecting Client Personal Information; or
• (b) when a regulator with authority over Client demands it in writing.

Any such audit must:

• be on at least thirty (30) days' written notice, or the shorter period the regulator requires;
• take place during normal business hours;
• be limited in scope to Client's data and the controls protecting it;
• not access other clients' data or Sapiura's privileged materials; and
• not unreasonably interfere with Sapiura's operations.

Client bears the cost of the audit, including Sapiura's reasonable time at its then-current rates. If the audit reveals a material breach of this DPA by Sapiura, Sapiura bears its own costs and reimburses Client's reasonable audit costs.

10.4 Remediation. If an assessment or audit reveals a material non-compliance, Sapiura will correct it promptly and give Client a written remediation plan within thirty (30) days.

10.5 Confidentiality. Everything Sapiura provides under this Section 10 is Sapiura's Confidential Information under the Client Agreement. Client may share it with its regulators, auditors and legal advisers as needed.

11. Retention, return and deletion

11.1 During the term.

• Form-submission backups are deleted thirty (30) days after receipt.
• Other Client Personal Information is kept only as long as needed for the purposes in Section 3.2.
• Security logs that contain Client Personal Information, such as IP addresses of form submitters, are deleted after thirty (30) days.

11.2 At the end of the Services, or on request. Client may export Client Personal Information at any time. Because form-submission backups are kept for only 30 days, an export covers at most the last 30 days of submissions. Every submission was also delivered to Client's CRM or inbox when it arrived. If Client walks away under the Deed-in-Your-Name Terms, Sapiura will, within 5 Business Days, remove its access and confirm in writing, provide the export, and on request point the form directly to Client's email or CRM. It will then delete its remaining copies within 30 days after the export. Within thirty (30) days after the Services end, or after Client's written request, Sapiura will at Client's choice return Client Personal Information to Client in a commonly used format, or delete or destroy it securely, or de-identify it irreversibly. Sapiura will instruct its Subprocessors to do the same. On request, Sapiura will certify the deletion in writing.

11.3 Exceptions. Sapiura may keep Client Personal Information only:

• (a) for as long as the law requires, in which case this DPA continues to apply to it; or
• (b) in backups that are not readily accessible, until they roll off on their normal schedule, which is no more than thirty (30) days.

Any information kept under (a) or (b) is kept confidential, protected, isolated and not further Processed.

11.3A Stopping form forwarding. If Sapiura decides to stop providing form forwarding to Client (other than at Client's request), it will give Client at least 60 days' written notice and point Client's forms directly to Client's inbox or CRM before forwarding stops, so that no submission is lost.

11.4 Client's own systems. Client's website code, domain, listings and hosting accounts belong to Client, and they stay in Client's own accounts under the Deed-in-Your-Name Terms. Deleting them is Client's decision. Sapiura will remove its own access when the Services end.

12. Data location

12.1 United States. Sapiura will store Client Personal Information that it holds at rest in its own systems, including form-submission backups, only in data centers located in the United States. It will not transfer Client Personal Information for storage outside the United States without Client's prior written consent. Operational and security logs that a global Subprocessor keeps under its own terms are covered by Section 12.2.

12.2 Transit and transient processing. Some Subprocessors operate globally and may route data through, or process it transiently in, facilities outside the United States. Examples are Cloudflare's content-delivery and security network, and the AI model providers that process AI Assistant requests. Client acknowledges this, subject to those Subprocessors' safeguards and Section 7. Form-submission contents are never sent to AI model providers.

12.3 Remote access. Sapiura personnel and contractors will access Client Personal Information only from within the United States, unless Client agrees otherwise in writing.

13. Term and termination

13.1 Term. This DPA starts when the Client Agreement starts. It continues for as long as Sapiura Processes Client Personal Information, including after the Client Agreement ends.

13.2 Survival. Sections 4, 6, 8, 10, 11, 14 and 15 survive for as long as Sapiura holds any Client Personal Information, and afterward as needed to give them effect.

13.3 Termination for non-compliance. Client may suspend Sapiura's Processing of Client Personal Information, or terminate the affected Services on written notice, if:

• Sapiura notifies Client under Section 4.9 that it cannot comply; or
• Sapiura materially breaches this DPA and does not cure the breach within thirty (30) days after written notice. No cure period applies where cure is not possible.

Termination under this Section 13.3 does not affect Client's ownership rights or walk-away rights under the Deed-in-Your-Name Terms. Termination for Sapiura's uncured material breach is a termination under Client Agreement Section 23.3, and refunds follow Client Agreement Sections 11.9(d) and 23.4. Termination after a notice under Section 4.9 is treated as a discontinuation of the affected Service by Sapiura, with a pro-rata refund under Client Agreement Section 11.9(c).

14. LIABILITY

14.1 Client Agreement governs. EACH PARTY'S LIABILITY UNDER THIS DPA IS SUBJECT TO THE EXCLUSIONS AND LIMITATIONS OF LIABILITY IN THE CLIENT AGREEMENT. THIS DPA DOES NOT CREATE ANY SEPARATE OR ADDITIONAL CAP.

14.2 Data-security super-cap. UNDER THE CLIENT AGREEMENT, SAPIURA'S AGGREGATE LIABILITY FOR CLAIMS ARISING FROM ITS BREACH OF ITS DATA-SECURITY OR CONFIDENTIALITY OBLIGATIONS, INCLUDING THIS DPA, IS LIMITED TO TWO TIMES (2x) THE FEES CLIENT PAID SAPIURA IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM. FOR THOSE CLAIMS, THIS HIGHER CAP REPLACES, AND IS NOT IN ADDITION TO, THE GENERAL CAP (CLIENT AGREEMENT SECTION 20.3). IT APPLIES TO THE COST REIMBURSEMENT IN SECTION 6.7 AND THE AUDIT-COST REIMBURSEMENT IN SECTION 10.3.

14.3 Exceptions. THE LIMITATIONS IN THIS SECTION 14 DO NOT LIMIT THE MATTERS LISTED IN CLIENT AGREEMENT SECTION 20.4, INCLUDING LIABILITY FOR FRAUD OR WILLFUL MISCONDUCT AND ANY LIABILITY THAT THE LAW DOES NOT ALLOW TO BE LIMITED. THEY NEVER REDUCE ANY REFUND PROMISED IN THE GUARANTEE TERMS OR THE CLIENT AGREEMENT.

14.4 No third-party beneficiaries. This DPA does not give any Consumer or other third party any right to enforce it, except where Applicable Data Protection Law requires otherwise.

15. General

15.1 Order of precedence. If documents conflict, they control in this order: (1) the Order (checkout summary) for price and what was bought; (2) the Guarantee Terms and the Deed-in-Your-Name Terms, on their subjects; (3) this DPA, on Client Personal Information; (4) the Client Agreement; (5) the Acceptable Use Policy; and (6) the Terms of Service (website use only, and never controlling for paying clients). Within this DPA, Annex 3 controls over the rest of this DPA for the matters it covers. Liability caps and dispute resolution are governed by the Client Agreement, as Sections 14 and 15.4 provide.

15.2 Changes in law. If Applicable Data Protection Law changes in a way that requires changes to this DPA, Sapiura may update it by giving thirty (30) days' notice under the Client Agreement. Sapiura will not reduce the protection of Client Personal Information without Client's written consent, except where the law requires it. If a change materially and adversely affects Client, Client may terminate the affected Services under Section 13.3.

15.3 Severability. If any provision of this DPA is found unenforceable, the rest remains in effect, and the provision will be enforced to the maximum extent permitted.

15.4 Disputes and governing law. This DPA is governed by the law of the State of Florida. Disputes under it are resolved as provided in the Client Agreement, subject to any mandatory law that applies to Client's regulated status.

15.5 Notices. Notices under this DPA go to the contacts in the Client Agreement. For Sapiura, notices go to info@sapiura.com and to Sapiura Systems LLC, 7345 W Sand Lake Rd, Ste 210, Office 3330, Orlando, FL 32819. Client should designate a security or privacy contact in its intake form, and keep it up to date.

Annex 1 — Description of Processing

Annex 2 — Technical and Organizational Security Measures

Sapiura is a small company. The measures below are appropriate to its size, the limited categories of Client Personal Information it handles, and the risk. They are designed to satisfy the third-party service provider expectations of the Insurance Data Security Laws and 23 NYCRR §500.11.

A. Governance

1. A written information security program (WISP), approved by Sapiura's principal, reviewed at least annually, and updated after any material change or Security Incident.
2. A named individual responsible for information security.
3. An annual written risk assessment covering the systems that Process Client Personal Information.

B. Access control

4. Least-privilege, role-based access. Only personnel who need Client Personal Information to perform the Services can reach it.
5. Multi-factor authentication on all accounts that can reach Client Personal Information or Sapiura's production systems. This covers hosting, database, Coolify, email (including Google Workspace), analytics, GitHub, Cloudflare, Stripe, OpenRouter and domain accounts. Phishing-resistant MFA is used where it is available.
6. Unique accounts; no shared administrator credentials.
7. Passwords managed in a password manager, with strong unique passwords.
8. Access is reviewed at least quarterly, and removed within 24 hours after a person leaves or no longer needs it.
9. No collection of Client passwords. Access to Client systems is by delegated or invited roles that Client can revoke.

C. Encryption

10. TLS 1.2 or higher for all data in transit over public networks, including form submissions and API calls.
11. Encryption at rest for databases, backups and storage holding Client Personal Information, using provider-managed AES-256 or equivalent.
12. Secrets and API keys are stored in encrypted secret stores, not in source code.

D. Data minimization and retention

13. Forms are built to collect only the fields Client approves.
14. Form-submission backups are automatically deleted after 30 days.
15. Security logs are automatically deleted after 30 days.
16. Form-submission contents are excluded from AI Assistant prompts and from analytics. AI routing is restricted by configuration to the AI model providers named on the Subprocessor List, with provider data-training and prompt logging turned off.

E. Logging and monitoring

17. Logging of administrative access to systems holding Client Personal Information.
18. Alerting on suspicious log-ins and on failed form deliveries.
19. Logs are protected from alteration.

F. Vulnerability and change management

20. Security patches applied to servers and dependencies promptly. Critical patches are applied within 14 days of release, or sooner where they are actively exploited.
21. Automated dependency and vulnerability scanning on code repositories.
22. Changes to Client websites go through preview, approval and one-click rollback.
23. Changes to Sapiura's production infrastructure are version-controlled.
24. Separation of development and production environments.

G. Network and application security

25. Cloudflare web application firewall, DDoS protection and bot mitigation (Turnstile) on Sapiura's forms and endpoints.
26. Server firewalls allow only required ports; administrative interfaces are not exposed publicly.
27. Form endpoints use input validation, rate limiting and honeypot fields.

H. Resilience

28. Backups of configuration and form-forwarding systems, with periodic restore tests.
29. Failed form deliveries are retried and queued so that submissions are not lost.

I. Personnel

30. Written confidentiality agreements with all personnel and contractors who can reach Client Personal Information.
31. Security and privacy awareness training at onboarding and annually, including phishing awareness and the handling of NPI.
32. Background checks where permitted by law, for personnel with administrative access.

J. Vendor (Subprocessor) management

33. Security due diligence before engaging a Subprocessor, and a periodic review afterward.
34. Written terms with each Subprocessor, as Section 7 of this DPA requires.
35. Preference for Subprocessors that hold independent security attestations, such as SOC 2 or ISO 27001, and that offer U.S. data storage.

K. Incident response

36. A written incident response plan covering detection, containment, investigation, eradication and recovery; notice to Client within 72 hours (Section 6); preservation of evidence; and a post-incident review.
37. The plan is tested at least annually through a tabletop exercise.

L. Secure disposal

38. Data is deleted through provider-supported secure deletion.
39. Devices that held Client Personal Information are wiped or destroyed before disposal.

M. Endpoint security

40. Full-disk encryption, screen lock, automatic operating-system updates and endpoint protection on all devices used to reach Client Personal Information.

Annex 3 — State-Specific Terms

These terms apply in addition to the rest of this DPA when the named law applies. If they conflict with the rest of this DPA, they control for the matters they cover.

A. California (CCPA)

1. Sapiura is a "service provider" under Cal. Civ. Code §1798.140(ag). Sections 3.2 and 4 contain the terms that Cal. Civ. Code §§1798.100(d) and 1798.140(ag) and Cal. Code Regs. tit. 11, §7051(a) require. Specifically:
   • the specified business purposes (Section 3.2);
   • no selling or sharing (Section 4.1);
   • no retention, use or disclosure for other purposes, other commercial purposes or outside the direct business relationship (Section 4.2);
   • no combining (Section 4.3);
   • compliance and the same level of protection (Section 4.7);
   • Client's right to take reasonable steps, including assessments at least once every 12 months (Sections 4.10 and 10.1);
   • notice of inability to comply (Section 4.9);
   • the right to stop and remediate (Section 4.10);
   • cooperation with consumer requests (Section 8.1);
   • flow-down to Subprocessors (Section 7.2); and
   • certification (Section 4.11).
2. Opt-out signals. Where Client is subject to the CCPA, Sapiura will process opt-out requests that Client forwards. If Client's website receives an opt-out preference signal, such as Global Privacy Control, Sapiura will configure the website to honor it as Client directs. Sapiura does not sell or share Client Personal Information in any case.
3. Assessments. Sapiura will reasonably cooperate with Client's risk assessments and cybersecurity audits under Cal. Code Regs. tit. 11, §§7120–7157, as Section 8.2 provides.
4. Insurance Code data. Where information is governed by the California Insurance Code (including the Insurance Information and Privacy Protection Act, Ins. Code §791 et seq.), Sapiura will also comply with the service-provider limits of that law.

B. Colorado, Connecticut, Virginia and other State Privacy Laws (processor terms)

Where Client is a "controller" under a State Privacy Law, including the laws of Colorado (C.R.S. §6-1-1305), Connecticut (Conn. Gen. Stat. §42-521), Virginia (Va. Code §59.1-579), Texas (Tex. Bus. & Com. Code §541.104), Oregon, Delaware, Iowa, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Rhode Island, Tennessee, Utah, and any state law that takes effect during the term, Sapiura as "processor" will:

1. Process personal data only on Client's documented instructions, as this DPA and Annex 1 set out. Annex 1 states the nature and purpose of Processing, the type of data, the duration of Processing, and the rights and obligations of both parties.
2. Ensure each person Processing the data is subject to a duty of confidentiality (Section 4.8).
3. Engage subcontractors only under a written contract that requires the subcontractor to meet the processor's obligations, after giving Client notice and an opportunity to object (Section 7).
4. At Client's direction, delete or return all personal data when the Services end, unless the law requires retention (Section 11).
5. Make available to Client all information in its possession that is necessary to demonstrate compliance (Sections 9 and 10).
6. Allow, and cooperate with, reasonable assessments by Client or Client's designated assessor. Alternatively, Sapiura may arrange, at its own expense, an independent assessment against an appropriate and accepted control standard, and give Client the report on request (Section 10).
7. Assist Client with its data protection assessments and impact assessments, its security and breach-notification obligations, and its responses to consumer rights requests, taking into account the nature of the Processing (Sections 6 and 8).
8. Implement appropriate technical and organizational measures (Annex 2).
9. Where Minnesota law applies, give Client the processor information the Minnesota Consumer Data Privacy Act requires, including data inventory information, and comply with its processor duties.
10. Not process any Client Personal Information as a "controller." If Sapiura ever begins to determine the purposes and means of Processing Client Personal Information, it will be a controller for that Processing and will comply with controller obligations.

C. New York (23 NYCRR Part 500) and the Insurance Data Security Laws

Where Client is a "covered entity" under 23 NYCRR Part 500, or a "licensee" under an Insurance Data Security Law, Sapiura acknowledges that it is a third-party service provider and agrees to the following. This applies to small licensees as well, because Section 500.11 continues to apply to entities that qualify for the limited exemption in Section 500.19(a).

1. Access controls and MFA. Sapiura maintains the access controls and multi-factor authentication in Annex 2, Part B, consistent with 23 NYCRR §500.12.
2. Encryption. Sapiura encrypts Client's nonpublic information in transit and at rest as Annex 2, Part C describes, consistent with 23 NYCRR §500.15.
3. Notice of cybersecurity events. Sapiura will notify Client of any cybersecurity event that directly impacts Client's Information Systems or Client's nonpublic information held by Sapiura (a blocked attempt with no impact is not covered). It will do so within 72 hours, with the content in Section 6.3, so that Client can meet 23 NYCRR §500.17 and Model 668 §6 as adopted, including the 72-hour notice to the superintendent or commissioner.
4. Representations and warranties. Sapiura makes the representations and warranties in Section 5.4 about its cybersecurity policies and procedures that relate to the security of Client's Information Systems and nonpublic information.
5. Due diligence and periodic assessment. Sapiura will support Client's due diligence and periodic reassessment through Section 10. It will promptly update Client on any material change to its security practices that would reasonably affect that assessment.
6. Ransomware and extortion payments. If Sapiura makes or facilitates any extortion payment in connection with a cybersecurity event affecting Client's data, it will tell Client within 24 hours, and give Client the information Client needs to make its own reports under 23 NYCRR §500.17(c).
7. Records. Sapiura will keep records relating to cybersecurity events affecting Client's nonpublic information for at least five (5) years, so that Client can meet its own record-keeping and certification obligations.

D. Florida

1. Sapiura is a "third-party agent" of Client under Fla. Stat. §501.171(1)(h). Sapiura will notify Client of a "breach of security" (as Fla. Stat. §501.171(1)(a) defines it) affecting Client's covered personal information within 72 hours after Sapiura determines that the breach occurred or has reason to believe it occurred. This is well within the 10-day maximum in Fla. Stat. §501.171(6)(a). Sapiura will give Client all information Client needs to meet its own notice obligations under Fla. Stat. §501.171(3)–(5), including the 30-day notice to individuals and to the Florida Department of Legal Affairs where 500 or more Floridians are affected.
2. Sapiura will take reasonable measures to protect and secure the data in electronic form that contains personal information, as Fla. Stat. §501.171(2) requires (Section 5 and Annex 2).
3. Sapiura will dispose of customer records containing personal information securely, consistent with Fla. Stat. §501.171(8) (Section 11 and Annex 2, Part L).

E. Other state breach-notification laws

Where a state law requires a person that maintains computerized data for an owner or licensee to notify the owner or licensee of a breach "immediately," "as soon as practicable," "without unreasonable delay," or within a set number of days, Section 6.1 applies. If any such law that applies to Sapiura sets a fixed period shorter than 72 hours, Sapiura will meet that shorter period.