Data Processing Addendum

This Data Processing Addendum (this “DPA”) is between Grand Adventures LLC, an Arizona limited liability company, doing business as Sagecraft (“Sagecraft”), and the customer that has accepted the Sagecraft Terms of Service or signed another agreement with Sagecraft for the Services (“Customer”). That agreement is the “Agreement.” This DPA forms part of the Agreement. It takes effect automatically when Customer accepts the Agreement, and no separate signature is needed. Customers who want a countersigned copy may sign below and send it to legal@sagecraft.net.

1. Definitions

Capitalized terms not defined in this DPA have the meanings given in the Agreement.

1.1 Customer Personal Data means personal data in Customer Content that Sagecraft processes on Customer’s behalf in providing the Services.

1.2 Data Protection Laws means all laws that apply to the processing of Customer Personal Data under the Agreement. These include, where applicable: the EU General Data Protection Regulation 2016/679 (“GDPR”); the GDPR as it forms part of UK law, and the UK Data Protection Act 2018 (“UK GDPR”); the Swiss Federal Act on Data Protection (“FADP”); the California Consumer Privacy Act, as amended (“CCPA”); and other U.S. state comprehensive privacy laws.

1.3 Controller, Processor, Data Subject, Personal Data, Processing, Supervisory Authority, and Business Purpose have the meanings given in the applicable Data Protection Laws. “Service Provider” has the meaning given in the CCPA.

1.4 Personal Data Breach means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by Sagecraft or its Subprocessors.

1.5 Restricted Transfer means a transfer of Customer Personal Data from the European Economic Area (“EEA”), the United Kingdom, or Switzerland to a country that has not been found to provide adequate protection under the applicable Data Protection Laws.

1.6 SCCs means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.

1.7 Subprocessor means a third party that Sagecraft engages to process Customer Personal Data. It does not include (a) an Integration that Customer connects, such as GitHub or Microsoft 365, or (b) an AI Provider account that Customer connects under its own agreement with that provider. These are Customer’s own providers.

1.8 UK Addendum means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the UK Information Commissioner under the UK Data Protection Act 2018.

2. Scope and Roles

2.1 Roles. For Customer Personal Data, Customer is the Controller and Sagecraft is its Processor. If Customer processes Customer Personal Data as a Processor on behalf of its own customer, Sagecraft is Customer’s Subprocessor, and Customer confirms that its instructions to Sagecraft are authorized by its Controller.

2.2 Out of scope. This DPA does not apply to personal data for which Sagecraft is the Controller, such as account, billing, marketing, and website data, and Usage Data. Sagecraft’s Privacy Policy governs that data.

2.3 Details of processing. Annex I describes the subject matter, nature, purpose, and duration of the processing, the types of personal data, and the categories of Data Subjects.

3. Sagecraft’s Obligations

3.1 Instructions. Sagecraft will process Customer Personal Data only on Customer’s documented instructions, unless the law requires otherwise. If the law requires otherwise, Sagecraft will tell Customer before processing unless the law prohibits it. Customer’s documented instructions are the Agreement, this DPA, and Customer’s use and configuration of the Services, including the Integrations and AI Features Customer chooses to use. Sagecraft will tell Customer promptly if it believes an instruction violates Data Protection Laws.

3.2 Data use commitments. Customer instructs and authorizes Sagecraft to process Customer Personal Data as described in Section 8 of the Terms of Service, subject to these limits:

• (a) Sagecraft will not permit any AI Provider it engages to use Customer Personal Data to train or improve that AI Provider’s models.
• (b) Sagecraft will not train or fine-tune any generative or foundation AI model on Customer Personal Data.
• (c) Sagecraft will not use Customer Personal Data in any model, algorithm, or dataset made available to or used for any other customer, and will not disclose it to any other customer.
• (d) Sagecraft may generate Derived Signals in the course of processing. Sagecraft will apply de-identification and aggregation measures so that Derived Signals contain no Customer Personal Data and cannot reasonably be used to identify any Data Subject. Once generated, Derived Signals are not Customer Personal Data.
• (e) Sagecraft may use Customer Content, including Customer Personal Data, to tune algorithms that serve only Customer.

3.3 Personnel. Sagecraft will restrict access to Customer Personal Data to its founders. Sagecraft employees and contractors may also have access, but only where it is necessary to (a) provide managed services that Customer has engaged Sagecraft to perform, or (b) provide support that Customer requests. Everyone with access is bound by written confidentiality obligations.

3.4 Security. Sagecraft will implement and maintain the technical and organizational measures described in Annex II. Those measures are designed to protect Customer Personal Data against Personal Data Breaches and to ensure a level of security appropriate to the risk. Sagecraft may update the measures if the updates do not materially reduce the overall level of protection.

3.5 Assistance with Data Subject requests. If Sagecraft receives a request from a Data Subject about Customer Personal Data, it will refer the Data Subject to Customer and will not respond directly except to do so, unless the law requires otherwise. Taking into account the nature of the processing, Sagecraft will assist Customer in responding to Data Subject requests through the functionality of the Services and, where that is not enough, by other reasonable means. Sagecraft may charge reasonable fees for assistance beyond what the Services provide.

3.6 Other assistance. Taking into account the nature of the processing and the information available to Sagecraft, Sagecraft will provide reasonable assistance with Customer’s data protection impact assessments and prior consultations with Supervisory Authorities, where the law requires them.

4. Subprocessors

4.1 Authorization. Customer gives Sagecraft general authorization to engage Subprocessors. The Subprocessors in Annex III are approved as of the Effective Date. The current list is Annex III of this DPA, as updated under Section 4.2.

4.2 New Subprocessors. Sagecraft will notify Customer at least 30 days before a new Subprocessor begins processing Customer Personal Data. Notice is given by updating Annex III on this page and emailing the account owner’s address.

4.3 Objection. Customer may object to a new Subprocessor on reasonable data protection grounds by emailing legal@sagecraft.net within 30 days after notice. The parties will discuss the objection in good faith. If Sagecraft cannot reasonably accommodate it, Customer may terminate the affected Services by written notice and receive a prorated refund of prepaid Fees for the unused portion of the Subscription Term.

4.4 Subprocessor obligations. Sagecraft will impose data protection obligations on each Subprocessor by written contract that are at least as protective of Customer Personal Data as this DPA, to the extent applicable to the services the Subprocessor provides. Sagecraft remains responsible to Customer for its Subprocessors’ performance of those obligations.

5. Personal Data Breaches

5.1 Notice. Sagecraft will notify Customer of a Personal Data Breach without undue delay, and in any event within 72 hours after becoming aware of it.

5.2 Contents. The notice will include, to the extent known: the nature of the breach; the categories and approximate number of Data Subjects and records affected; the likely consequences; and the measures taken or proposed to address the breach and reduce its effects. Sagecraft will provide information in phases as it becomes available.

5.3 Response. Sagecraft will take reasonable steps to contain and investigate the breach and reduce its effects, and will cooperate reasonably with Customer. Sagecraft’s notice is not an admission of fault or liability.

6. Deletion and Return

6.1 Export. During the Subscription Term, and for 30 days after the Agreement ends, Customer may export Customer Content, including Customer Personal Data, using the tools the Services provide.

6.2 Deletion. After the 30-day export period, Sagecraft will delete Customer Personal Data from the Services within 30 days. Copies in backups are deleted as the backups expire, within 90 days. Sagecraft will keep backup copies protected under this DPA, and will not otherwise process them, until they are deleted. Sagecraft may keep Customer Personal Data where the law requires, and will protect it under this DPA for as long as it does.

6.3 Confirmation. On Customer’s written request, Sagecraft will confirm deletion in writing.

7. Audits

7.1 Information. On Customer’s written request, no more than once in any 12-month period, Sagecraft will provide information reasonably necessary to demonstrate its compliance with this DPA. This includes written responses to a reasonable security questionnaire.

7.2 Audits. If the information under Section 7.1 does not reasonably demonstrate compliance, Customer may conduct an audit, or have an independent auditor conduct one, in any of these circumstances: (a) a Supervisory Authority requires it; (b) after a Personal Data Breach affecting Customer Personal Data; or (c) as the SCCs require. The audit must take place on at least 30 days’ written notice, during normal business hours, and without unreasonable disruption to Sagecraft’s operations. It is conducted at Customer’s expense and under confidentiality obligations. It may not give access to other customers’ data or to Sagecraft’s or its Subprocessors’ facilities beyond what is necessary. Audits of Subprocessors are satisfied by the reports and certifications those Subprocessors make available.

8. International Transfers

8.1 Location. Sagecraft stores Customer Personal Data in the United States. Sagecraft’s application servers, which process Customer Personal Data while handling requests, are located in Canada. Subprocessors process Customer Personal Data in the locations listed in Annex III.

8.2 EEA transfers. For Restricted Transfers from the EEA, the SCCs are incorporated into this DPA as follows:

• (a) Module Two (Controller to Processor) applies where Customer is a Controller. Module Three (Processor to Processor) applies where Customer is a Processor.
• (b) Clause 7 (docking clause) applies.
• (c) Under Clause 9, Option 2 (general written authorization) applies, with the notice period in Section 4.2.
• (d) The optional language in Clause 11 does not apply.
• (e) Under Clause 13, the competent Supervisory Authority is the one identified in Annex I.C.
• (f) Under Clause 17, Option 1 applies, and the SCCs are governed by the law of Ireland.
• (g) Under Clause 18, disputes are resolved in the courts of Ireland.
• (h) Annexes I, II, and III of this DPA complete Annexes I, II, and III of the SCCs.

8.3 UK transfers. For Restricted Transfers from the United Kingdom, the SCCs apply as amended by the UK Addendum. Tables 1 through 3 of the UK Addendum are completed with the information in Section 8.2 and Annexes I through III. In Table 4, either party may end the UK Addendum as described in its Section 19.

8.4 Swiss transfers. For Restricted Transfers from Switzerland, the SCCs apply with these changes: references to the GDPR mean the FADP; the competent Supervisory Authority is the Swiss Federal Data Protection and Information Commissioner; and “Member State” includes Switzerland, so Data Subjects there can enforce their rights.

8.5 Order of precedence. If the SCCs conflict with this DPA, the SCCs control.

9. U.S. State Privacy Laws

To the extent the CCPA or a similar U.S. state law applies to Customer Personal Data, Sagecraft acts as Customer’s Service Provider or Processor. Sagecraft will:

• (a) not sell or share Customer Personal Data;
• (b) not retain, use, or disclose Customer Personal Data for any purpose other than the Business Purposes in the Agreement, including outside the direct business relationship with Customer, except as the law permits;
• (c) not combine Customer Personal Data with personal data it receives from or on behalf of others, except as the law permits;
• (d) comply with the applicable obligations of those laws and give Customer the same level of privacy protection they require; and
• (e) notify Customer if it determines it can no longer meet these obligations.

Customer may take reasonable steps to stop and remediate unauthorized use of Customer Personal Data. Sagecraft certifies that it understands and will comply with this Section.

10. Customer’s Obligations

Customer is responsible for:

• having a lawful basis for the processing and giving any notices required for it, including notices to individuals whose personal data appears in Integrations Customer connects, such as repository contributors;
• the accuracy and lawfulness of Customer Personal Data; and
• not submitting the sensitive data prohibited by Section 5(c) of the Terms of Service.

11. Liability, Term, and Precedence

11.1 Liability. Each party’s liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws or the SCCs do not allow those limitations.

11.2 Term. This DPA lasts as long as Sagecraft processes Customer Personal Data, including after the Agreement ends.

11.3 Precedence. If this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA controls. The SCCs control over both.

11.4 Changes. Sagecraft may update this DPA as Data Protection Laws require, or in ways that do not materially reduce the protection of Customer Personal Data. Section 18 of the Terms of Service governs other changes.

---

Annex I: Details of Processing

A. Parties

B. Description of Processing

C. Competent Supervisory Authority

The Supervisory Authority of the EEA member state where Customer is established. For example, for a Customer established in Portugal, this is the Comissão Nacional de Proteção de Dados. If Customer is not established in the EEA, it is the Supervisory Authority of the member state where the Data Subjects whose data is transferred are located.

Annex II: Technical and Organizational Security Measures

Annex III: Approved Subprocessors

---

Signature (optional countersigned copy)