Data Processing Addendum

THIS DATA PROCESSING ADDENDUM ("DPA") IS INCORPORATED INTO AND FORMS PART OF THE AGREEMENT GOVERNING SUBSCRIBER'S ACCESS TO AND USE OF THE SERVICES, INCLUDING THE SANITY TERMS OF SERVICE AVAILABLE AT https://www.sanity.io/legal/tos AND EACH APPLICABLE ORDER. BY ENTERING INTO AN ORDER, CLICKING TO ACCEPT THE AGREEMENT, CREATING AN ACCOUNT, OR ACCESSING OR USING THE SERVICES, SUBSCRIBER AGREES TO BE BOUND BY THIS DPA. THE PERSON ACCEPTING THIS DPA ON BEHALF OF SUBSCRIBER REPRESENTS THAT THE PERSON HAS AUTHORITY TO BIND SUBSCRIBER.

This DPA applies only to the extent Sanity Processes Personal Data on behalf of Subscriber in connection with the Services. The Sanity entity that is a party to the Agreement is referred to as "Sanity." Subscriber and Sanity are each a "Party" and together the "Parties." Capitalized terms not defined in this DPA have the meanings given in the Agreement. Except as expressly modified by this DPA, the Agreement remains in full force and effect. If there is a conflict, this DPA controls only with respect to the Processing of Personal Data and only to the extent of the conflict. If there is a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses control.

1. DEFINITIONS

1.1 "Affiliate" means an entity that directly or indirectly controls, is controlled by, or is under common control with a Party, where "control" means ownership of more than fifty percent (50%) of the voting interests or the power to direct the management of the entity.

1.2 "Applicable Data Protection Law" means the data protection and privacy laws and regulations applicable to Sanity's Processing of Personal Data under the Agreement, including, as applicable, the EU GDPR, UK GDPR, the Swiss Federal Act on Data Protection ("FADP"), and United States state privacy laws that impose processor, service provider, or contractor obligations on Sanity. For clarity, Applicable Data Protection Law does not include laws that apply to Subscriber but do not apply to Sanity's Processing of Personal Data.

1.3 "Controller" means the entity that determines the purposes and means of Processing Personal Data, and includes a "business" or similar term under Applicable Data Protection Law.

1.4 "Data Subject" means an identified or identifiable natural person to whom Personal Data relates, and includes a "consumer" or similar term under Applicable Data Protection Law.

1.5 "EEA" means the European Economic Area.

1.6 "EU GDPR" means Regulation (EU) 2016/679, as incorporated into EEA law and as amended or replaced.

1.7 "Personal Data" means personal data, personal information, or a similar term defined by Applicable Data Protection Law, but only to the extent such information is included in Subscriber Data and Processed by Sanity on behalf of Subscriber in connection with the Services. Personal Data excludes Service Usage Data and information that has been aggregated or deidentified so that it cannot reasonably identify Subscriber or any Data Subject.

1.8 "Process," "Processing," or "Processed" means any operation performed on Personal Data, whether or not by automated means, including collection, recording, organization, storage, alteration, retrieval, use, disclosure, transmission, restriction, deletion, or destruction.

1.9 "Processor" means an entity that Processes Personal Data on behalf of a Controller, and includes a "service provider," "contractor," or similar term under Applicable Data Protection Law.

1.10 "Security Incident" means a confirmed breach of Sanity's security that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data in Sanity's possession or control. Security Incident does not include unsuccessful attempts or activities that do not compromise Personal Data, such as pings, denial-of-service attacks, network scans, unsuccessful log-in attempts, or attacks blocked by firewalls or other security controls, or incidents caused by Subscriber, Permitted Users, or third-party products not controlled by Sanity, except to the extent such incident compromises Sanity systems.

1.11 "Service Usage Data" means data relating to the provision, use, performance, configuration, support, security, and operation of the Services, including account, device, telemetry, log, diagnostic, and analytics data, as further described in the Agreement.

1.12 "Standard Contractual Clauses" or "SCCs" means (a) the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 ("EU SCCs") and (b) the UK International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner ("UK Addendum"), in each case as amended, replaced, or superseded.

1.13 "Subprocessor" means an Affiliate or third party engaged by Sanity to Process Personal Data on behalf of Subscriber in connection with the Services.

1.14 "UK GDPR" means the EU GDPR as incorporated into the laws of the United Kingdom by the European Union (Withdrawal) Act 2018 and the Data Protection Act 2018, as amended or replaced.

2. ROLES; SCOPE

2.1 Roles of the Parties. As between the Parties, Subscriber is the Controller of Personal Data and Sanity is the Processor. If Subscriber is a Processor acting on behalf of another Controller, Sanity is Subscriber's Subprocessor. Each Party will comply with the obligations of Applicable Data Protection Law that apply to it in its respective role.

2.2 Documented Instructions. Sanity will Process Personal Data only to provide, secure, support, and maintain the Services; to perform the Agreement; in accordance with Subscriber's documented instructions; or as otherwise permitted or required by Applicable Data Protection Law. Subscriber's documented instructions include the Agreement, this DPA, Subscriber's use and configuration of the Services, and other written instructions that are consistent with the Agreement. Sanity may decline or suspend an instruction that Sanity reasonably believes violates Applicable Data Protection Law or is outside the scope of the Services. If an instruction requires material changes to the Services or imposes material additional costs, the Parties will agree in writing on the scope, fees, and implementation before Sanity is required to comply.

2.3 Legally Required Processing. Sanity may Process Personal Data as required by applicable law. Unless legally prohibited, Sanity will notify Subscriber before such Processing or, if advance notice is not legally permitted, as soon as legally permitted thereafter.

2.4 U.S. Privacy Requirements. To the extent Applicable Data Protection Law in the United States applies, Subscriber discloses Personal Data to Sanity only for the limited and specified business purposes described in the Agreement and this DPA. Sanity will not: (a) sell or share Personal Data; (b) retain, use, or disclose Personal Data outside the direct business relationship between the Parties or for any purpose other than the purposes specified in the Agreement and this DPA; or (c) combine Personal Data with personal information received from or on behalf of another person, or collected from Sanity's own interactions with a Data Subject, except as permitted by Applicable Data Protection Law. Sanity certifies that it understands and will comply with the restrictions in this Section. Sanity will notify Subscriber if Sanity determines it can no longer meet its obligations under applicable United States privacy law, and Subscriber may take reasonable and appropriate steps, subject to Section 8, to stop and remediate unauthorized use of Personal Data.

2.5 Confidentiality. Sanity will ensure that personnel authorized to Process Personal Data are subject to appropriate confidentiality obligations and receive appropriate privacy and security training.

2.6 Service Usage Data. Sanity may Process Service Usage Data as an independent Controller for billing and account administration; support and customer relationship management; analytics; monitoring, investigating, preventing, and detecting fraud, abuse, Security Incidents, and other misuse; identity and access management; compliance with legal obligations; and developing, improving, optimizing, and operating the Services and other Sanity products and services. Sanity may aggregate or deidentify Service Usage Data and use and disclose the resulting data for any lawful business purpose, provided the data does not identify Subscriber or any Data Subject.

3. SUBSCRIBER RESPONSIBILITIES

3.1 Compliance and Lawful Basis. Subscriber is responsible for: (a) complying with Applicable Data Protection Law in its use of the Services; (b) providing all required notices and obtaining all required consents, authorizations, and other lawful bases for Sanity to Process Personal Data as contemplated by the Agreement; (c) ensuring the lawfulness, accuracy, quality, and integrity of Personal Data; and (d) ensuring its instructions to Sanity comply with Applicable Data Protection Law. Subscriber will provide only Personal Data reasonably necessary to use the Services.

3.2 Security and Configuration. Subscriber is responsible for configuring the Services appropriately, managing user permissions and authentication, protecting account credentials, and using the Services in a manner consistent with the Documentation. Sanity is not responsible for a Security Incident or other compromise caused by Subscriber, a Permitted User, Subscriber's instructions or configuration, or a third-party product or integration not controlled by Sanity.

4. ASSISTANCE AND COOPERATION

4.1 Data Subject Requests. If Sanity receives a request from a Data Subject relating to Personal Data, Sanity may direct the Data Subject to Subscriber and will not independently respond unless required by law. Taking into account the nature of the Processing, Sanity will provide reasonable assistance, including available self-service functionality, to enable Subscriber to respond. Subscriber is responsible for responding to Data Subject requests and for Sanity's reasonable costs of assistance, except to the extent the request results from Sanity's material breach of this DPA.

4.2 Impact Assessments and Prior Consultation. Taking into account the nature of the Processing and the information available to Sanity, Sanity will provide reasonable information and assistance required by Applicable Data Protection Law for Subscriber to conduct a data protection impact assessment or consult with a Privacy Authority, in each case solely as related to Subscriber's use of the Services. Subscriber will reimburse Sanity for reasonable costs of assistance that is not included in the standard Services, except to the extent caused by Sanity's material breach of this DPA.

4.3 Regulatory Inquiries. Sanity will provide reasonable cooperation in connection with a legally binding inquiry, order, or investigation by a Privacy Authority concerning Sanity's Processing of Personal Data. Unless prohibited by law, Subscriber will promptly notify Sanity of any such matter and will not make any admission on Sanity's behalf.

5. SECURITY

5.1 Security Measures. Sanity will maintain appropriate technical, organizational, and administrative measures designed to protect Personal Data against Security Incidents, as described in Sanity's then-current security documentation available at https://www.sanity.io/security ("Security Measures"). Sanity may update the Security Measures from time to time, provided that the updates do not materially decrease the overall security of the Services during the applicable Subscription Term.

6. SUBPROCESSORS

6.1 General Authorization. Subscriber generally authorizes Sanity to engage Subprocessors, including the Subprocessors listed at https://www.sanity.io/third-party-sub-processors. Sanity will enter into a written agreement with each Subprocessor that imposes data protection obligations appropriate to the nature of the services and no less protective in all material respects than the obligations imposed on Sanity under this DPA. Sanity remains responsible for the performance of its Subprocessors to the extent required by Applicable Data Protection Law and subject to the limitations and exclusions in the Agreement.

6.2 Notice of Changes. Sanity will provide notice of a new or replacement Subprocessor by updating its Subprocessor list. Subscriber is responsible for subscribing to available update notifications and maintaining current contact information.

6.3 Objections. Subscriber may object to a new Subprocessor only on reasonable and documented data protection grounds by notifying Sanity within ten (10) calendar days after notice. If Subscriber does not object within that period, Subscriber is deemed to have approved the Subprocessor. The Parties will work in good faith to resolve a timely objection. Sanity may, in its discretion: (a) not use the Subprocessor for Personal Data; (b) take reasonable steps to address the objection; (c) make available a commercially reasonable change to the affected Services, which may be subject to additional fees; or (d) terminate the affected portion of the Services upon written notice. Subscriber's sole and exclusive remedy for an unresolved objection is to terminate the affected portion of the Services.

7. SECURITY INCIDENTS

7.1 Notification. Sanity will notify Subscriber without undue delay after becoming aware of a Security Incident affecting Personal Data. Sanity may provide information in phases as it becomes available. To the extent known and legally permitted, the notice will describe the nature of the Security Incident, the categories of Personal Data and Data Subjects affected, likely consequences, measures taken or proposed, and a contact for additional information.

7.2 Investigation and Mitigation. Sanity will take reasonable steps to investigate, contain, and mitigate the Security Incident and to prevent recurrence, as appropriate to the circumstances.

7.3 Subscriber Notices. Subscriber is responsible for determining whether to notify Data Subjects, Privacy Authorities, or others and for the content and timing of any notice. Sanity will provide reasonable assistance as required by Applicable Data Protection Law. Unless required by law, Subscriber will not issue a public statement that identifies Sanity without first consulting with Sanity. Each Party will bear its own costs related to a Security Incident, except to the extent otherwise provided in the Agreement or caused by that Party's breach of this DPA.

8. AUDITS AND COMPLIANCE INFORMATION

8.1 Compliance Materials. Upon reasonable written request and subject to the confidentiality obligations in the Agreement, Sanity will make available information reasonably necessary to demonstrate compliance with this DPA.

8.2 Additional Audits. No more than once in any twelve (12)-month period, and upon at least thirty (30) days' prior written notice, Subscriber may request an audit if the materials under Section 8.1 are not reasonably sufficient or if an additional audit is required by Applicable Data Protection Law or a Privacy Authority. Any audit must: (a) be limited to Sanity's Processing of Personal Data and compliance with this DPA; (b) be conducted during normal business hours in a manner that does not unreasonably interfere with Sanity's operations; (c) be performed by Subscriber or an independent auditor that is not a competitor of Sanity and is bound by confidentiality obligations acceptable to Sanity; and (d) not provide access to data of other customers, source code, internal vulnerability information, or information that would compromise Sanity's security or confidentiality obligations.

8.3 Costs and Results. Subscriber will bear all costs of an audit, and Sanity may charge reasonable fees for time and resources required to support an audit, except where an audit identifies Sanity's material breach of this DPA. Audit results and all related information are Sanity Confidential Information.

9. RETURN AND DELETION

9.1 During the Term. Subscriber may access, export, or delete Personal Data using available Service functionality, subject to the Agreement and Documentation. Subscriber is responsible for exporting Personal Data it wishes to retain before expiration or termination of the Agreement.

9.2 After Termination. Following expiration or termination of the Agreement, Sanity will delete or return Personal Data in accordance with the Agreement and Sanity's standard retention and deletion procedures, unless applicable law requires or permits retention. Sanity may retain Personal Data in backups and archives until deletion in the ordinary course, provided the retained Personal Data remains protected under this DPA.

10. INTERNATIONAL DATA TRANSFERS

10.1 Lawful Transfer Mechanisms. Sanity may Process Personal Data in any country where Sanity or its Subprocessors operate, subject to this DPA. Where Applicable Data Protection Law restricts an international transfer, the Parties will rely on an applicable adequacy decision, recognized certification or framework, the SCCs, or another valid transfer mechanism. The SCCs apply only to the extent the transfer is not otherwise lawfully made under Applicable Data Protection Law.

10.2 EU SCCs. For a restricted transfer of Personal Data subject to the EU GDPR, the EU SCCs are incorporated by reference and completed as follows:

(a) Module Two (Controller to Processor) applies when Subscriber is a Controller.

(b) Subscriber is the data exporter and the applicable Sanity entity is the data importer.

(c) Clause 7 (Docking Clause) applies.

(d) For Clause 9, Option 2 (General Written Authorization) applies, and the notice period is the period stated in Section 6.3 of this DPA.

(e) The optional language in Clause 11(a) does not apply.

(f) For Clause 17, Option 1 applies and the EU SCCs are governed by the laws of Ireland.

(g) For Clause 18(b), disputes will be resolved by the courts of Ireland.

(h) The competent supervisory authority is determined under Clause 13 and set forth in Schedule A, Section C.

(i) Annex I is completed with the information in Schedule A, Sections A and B; Annex II is completed with the Security Measures; and Annex III is completed with the Subprocessor list referenced in Section 6.1.

(j) If a provision of this DPA contradicts the EU SCCs, the EU SCCs control for the restricted transfer.

10.3 United Kingdom. For a restricted transfer subject to the UK GDPR, the UK Addendum is incorporated and applies to the EU SCCs as completed in Section 10.2. Table 1 is completed with Schedule A, Section A; Table 2 identifies the EU SCCs, including the applicable Module under Section 10.2(a); Table 3 is completed with Schedule A, Sections B and D and the Subprocessor list; and Table 4 provides that either Party may terminate the UK Addendum as permitted by Section 19 of the UK Addendum. The mandatory clauses in Part 2 of the UK Addendum apply. Sanity may provide an executed copy upon written request.

10.4 Switzerland. For a restricted transfer subject to the FADP, the EU SCCs apply as modified as follows: (a) references to the GDPR include the FADP; (b) references to "Member State" include Switzerland; (c) the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; (d) governing law under Clause 17 is Swiss law; and (e) disputes under Clause 18 may be brought before the competent courts of Switzerland. Data Subjects in Switzerland may enforce their rights under the EU SCCs in Switzerland.

10.5 Alternative Mechanisms. If a transfer mechanism relied upon by the Parties is invalidated, amended, or replaced, the Parties will reasonably cooperate to implement another valid mechanism. Sanity may implement a replacement mechanism by updating this DPA in accordance with Section 12.2.

11. LIABILITY

11.1 Agreement Limitations Apply. Each Party's and its Affiliates' aggregate liability arising out of or relating to this DPA and the SCCs is subject to the limitations of liability in the Agreement to the maximum extent permitted by Applicable Data Protection Law.

11.2 Affiliate Claims. Any claim by a Subscriber Affiliate arising under this DPA must be brought by Subscriber, and all claims of Subscriber and its Affiliates will be aggregated for purposes of applying the Agreement's limitations of liability. No Subscriber Affiliate is a third-party beneficiary of this DPA, except to the extent required by the SCCs.

12. TERM; UPDATES; MISCELLANEOUS

12.1 Term. This DPA takes effect when it is incorporated into the Agreement or when Sanity first Processes Personal Data on behalf of Subscriber, whichever occurs first, and remains in effect for as long as Sanity Processes Personal Data.

12.2 Updates. Notwithstanding any contrary provision of the Agreement, Sanity may update this DPA from time to time by posting an updated version at the same URL or a successor URL. An update required by law, required to maintain a valid transfer mechanism, or that does not materially reduce the overall protection of Personal Data is effective upon posting. Any other material update is effective thirty (30) days after Sanity provides notice by email, through the Services, or by posting notice on its website. Subscriber's continued use of the Services after the effective date constitutes acceptance of the updated DPA. If Subscriber reasonably objects to a material update that materially reduces Subscriber's rights, Subscriber's sole remedy is to terminate the affected Services before the update takes effect, subject to the Agreement.

12.3 Electronic Acceptance; No Separate Signature. The Parties agree that electronic acceptance of the Agreement, an Order, or this DPA constitutes execution of this DPA and the SCCs, including their annexes. No separate signature is required. The acceptance date is the signature date for purposes of the SCCs.

12.4 Entire Agreement on Processing. This DPA, the Agreement, and the SCCs constitute the Parties' entire agreement regarding the Processing of Personal Data and supersede prior or contemporaneous agreements on that subject. Except as modified by this DPA, the Agreement remains unchanged.

SCHEDULE A

A. LIST OF PARTIES

Data exporter

Data importer

B. DESCRIPTION OF PROCESSING

C. COMPETENT SUPERVISORY AUTHORITY

The competent supervisory authority is the supervisory authority that has jurisdiction over the data exporter.

D. TECHNICAL AND ORGANIZATIONAL MEASURES

The technical and organizational measures are the Security Measures described at https://www.sanity.io/security, as updated in accordance with Section 5.1.