Data Processing Agreement

1.Background

This Data Processing Agreement ("DPA") supplements the Terms and Conditions or other written or electronic agreement between Bigfoot Analytics, Inc. ("Bigfoot," "Processor") and the customer identified in the applicable order form or statement of work ("Customer," "Controller") (together, the "Agreement"). This DPA applies to the extent Bigfoot processes personal data on behalf of Customer in the course of providing the Bigfoot platform and related services. In the event of a conflict between this DPA and the Agreement with respect to data protection matters, this DPA controls.

2.Definitions

Capitalized terms not defined here have the meaning given in the Agreement. Where Customer is subject to GDPR or the UK GDPR, "personal data," "processing," "controller," "processor," "data subject," "supervisory authority," and "personal data breach" have the meanings given in those laws. Where Customer is subject to other applicable data protection law (such as the California Consumer Privacy Act as amended by the California Privacy Rights Act, "CCPA"), equivalent defined terms under that law apply.

"Sub-processor" means any third party engaged by Bigfoot to process personal data in connection with providing the Service.

"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission (Commission Implementing Decision (EU) 2021/914), as may be updated from time to time. "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner's Office.

3.Roles of the Parties

As between the parties, Customer is the controller (or processor acting on behalf of a controller) and Bigfoot is the processor with respect to personal data contained in Customer Data. Customer is solely responsible for the accuracy, quality, and legality of personal data it submits to the Service, for the means by which it acquired that personal data, and for providing any notices to, and obtaining any consents from, interview participants that applicable law requires. Bigfoot will supply its standard participant notice and interview introduction for Customer's use.

4.Processing on Instructions

Bigfoot will process personal data only on documented instructions from Customer, including with respect to transfers, unless required to do otherwise by law applicable to Bigfoot. The Agreement, this DPA, and Customer's configuration and use of the Service constitute Customer's instructions. Bigfoot will inform Customer if, in its opinion, an instruction infringes applicable data protection law.

No model training. Neither Bigfoot nor any Sub-processor will use personal data processed under this DPA, including interview transcripts, audio recordings, or derived analysis, to train, retrain, or fine-tune any artificial intelligence or machine learning model, whether Bigfoot's own or a third party's. Personal data is processed solely to deliver the Service and the specific outputs Customer has requested.

No decisions about individuals. Outputs of the Service are aggregated findings about Customer's organization. Bigfoot does not use personal data to make, and the Service is not designed to support, decisions producing legal or similarly significant effects on individual data subjects.

5.Confidentiality

Bigfoot will ensure that personnel authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Redaction before human access. Interview conversations are redacted, with names and other directly identifying details removed, before any Bigfoot personnel work with them. Bigfoot personnel work only with redacted transcripts and aggregated findings, each bound by confidentiality obligations. Any materials, reports, or findings shared with Customer will have direct identifiers removed and/or be aggregated unless the parties agree otherwise in writing for a specific purpose. Redacted or aggregated information that could still identify an individual from context remains personal data under this DPA.

6.Security of Processing

Bigfoot will implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, as described in Annex II. Bigfoot will update these measures as needed to maintain a level of security appropriate to the risk, including as part of its SOC 2 program.

7.Sub-processors

Customer provides general authorization for Bigfoot to engage Sub-processors to process personal data in connection with the Service, subject to the terms of this Section. Bigfoot's current Sub-processors are listed in Annex III.

Bigfoot will impose data protection terms on each Sub-processor that are no less protective than those in this DPA, and will remain liable to Customer for a Sub-processor's performance of its obligations. Bigfoot will notify Customer of any intended addition or replacement of a Sub-processor with reasonable advance notice, and Customer may object on reasonable data protection grounds within fifteen (15) days of notice, in which case the parties will work in good faith to reach a resolution.

8.Assistance with Data Subject Rights

Taking into account the nature of the processing, Bigfoot will provide reasonable assistance to Customer, by appropriate technical and organizational measures, to enable Customer to respond to requests from data subjects seeking to exercise their rights under applicable data protection law. If Bigfoot receives a request directly from a data subject, it will promptly redirect the request to Customer without responding to it, unless legally required to do otherwise.

9.Personal Data Breach Notification

Bigfoot will notify Customer without undue delay, and in any event within seventy-two (72) hours of becoming aware of a personal data breach affecting Customer Data. Bigfoot will provide the information reasonably available to it regarding the nature of the breach, likely consequences, and measures taken or proposed to address it, and will cooperate with Customer's reasonable requests related to the breach, including any notification obligations Customer may have to supervisory authorities or affected individuals.

10.International Data Transfers

Bigfoot hosts and processes Customer Data in the United States and directs its Sub-processors to United States endpoints. Where Customer's use of the Service involves the transfer of personal data protected by GDPR out of the EEA or Switzerland to Bigfoot in the United States, the parties agree that the Standard Contractual Clauses (Module Two: Controller to Processor) are incorporated by reference into this DPA to govern that transfer, with Customer as "data exporter" and Bigfoot as "data importer," and with Annex I and Annex II serving as the required annexes to the SCCs. Where personal data protected by the UK GDPR is transferred, the UK Addendum is incorporated by reference on the same basis. Where a specific executed copy of the SCCs or UK Addendum is required, the parties will execute one on request.

11.California and Other U.S. State Laws

Where the CCPA or a similar U.S. state privacy law applies, Bigfoot acts as a service provider to Customer. Bigfoot will not sell or share personal data, will not retain, use, or disclose it for any purpose other than the business purposes specified in the Agreement or outside the direct business relationship with Customer, and will not combine it with personal data received from another source except as permitted by law. Bigfoot will notify Customer if it determines it can no longer meet its obligations under applicable law, and Customer may take reasonable steps to stop and remediate unauthorized use of personal data.

12.Audit Rights

On reasonable written request, no more than once per twelve (12)-month period (except following a personal data breach, or where required by a supervisory authority), Bigfoot will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, which may include a summary of Bigfoot's most recent SOC 2 report (once available) or responses to a written security questionnaire, in lieu of an on-site audit. Any on-site audit will be conducted during business hours, with reasonable advance notice, subject to confidentiality obligations, and at Customer's expense.

13.Return or Deletion of Data

Raw interview transcripts, audio recordings, and other identifiable Customer Data will be retained only as long as needed to complete the applicable statement of work. Unless the parties agree otherwise in writing, such data will be deleted within thirty (30) days after the earlier of: (a) Customer's acceptance of the final deliverable(s) under the applicable statement of work, or (b) termination or expiration of the engagement. Any post-termination export period in the Agreement applies only to Customer Data still retained under this Section and does not extend this deletion deadline. This Section does not require deletion where applicable law requires longer retention. Delivered findings with direct identifiers removed or in aggregated form are not subject to this deletion deadline, but remain subject to Section 5 where they could still identify an individual from context.

Upon termination or expiration of the Agreement, Bigfoot will, at Customer's choice, delete or return all remaining personal data processed on Customer's behalf, and delete existing copies, within the timeframe set out in the Agreement, unless applicable law requires continued storage.

14.Liability

Each party's liability arising out of or related to this DPA is subject to the limitations of liability set out in the Agreement.

15.General

This DPA is governed by the same governing law as the Agreement. If any provision of this DPA is found unenforceable, the remaining provisions remain in effect. This DPA may be updated by Bigfoot from time to time to reflect changes in applicable law or Bigfoot's processing activities, with notice to Customer; updates do not reduce the protections applicable to an order form or statement of work in progress without Customer's written agreement.

Annex I. Details of Processing

Annex II. Technical and Organizational Measures

Bigfoot maintains a security program that includes, at a minimum:

• Encryption of personal data in transit (TLS) and at rest.
• Role-based access controls and the principle of least privilege for access to production systems and Customer Data; redaction of interview conversations before any human access.
• Infrastructure hosted on Render, a managed cloud application hosting provider, with logical isolation between customer environments. Bigfoot has completed preparation to deploy production infrastructure on Microsoft Azure for customers who require it.
• Logging and monitoring of access to production systems.
• A documented incident response process, including the breach notification commitments in Section 9.
• Regular review of access permissions and prompt revocation on personnel offboarding.
• A SOC 2 program (Type I report targeted for October 2026, Type II for January 2027) and controls aligned with GDPR and the UK GDPR.
• Contractual no-training and confidentiality commitments flowed down to the AI and voice Sub-processors used to conduct and analyze interviews (see Annex III).

Bigfoot will update these measures as its security program matures, and will not materially decrease the overall level of protection during the term of the Agreement.

Annex III. Sub-processors

Under Bigfoot's account terms with each provider, neither Inworld nor Anthropic uses data submitted through the Service to train that provider's models, consistent with Section 4. Bigfoot selects United States endpoints for each provider.

Bigfoot will update this Annex III and notify Customer in accordance with Section 7 before any new Sub-processor, including Microsoft Azure, begins processing Customer Data in production. Sub-processors used for functions such as email delivery, customer support, or analytics will be added here as they are engaged, with notice to Customer in accordance with Section 7.