Acceptable Use Policy. Customers shall not:

• Copy, translate, disassemble, decompile, create derivative works, or engage in reverse engineering of the Cloud Service or Cloud Materials (or attempt any of the foregoing);
• Input, store, collect, or transmit any content or data on or through the Cloud Service that is unlawful or infringes upon any intellectual property, privacy, publicity, or other rights;
• Employ the Cloud Service in a manner that evades Usage Metrics;
• Gain access to the Cloud Service through unauthorized means (e.g., scraping, crawling, or penetration testing);
• Evade or jeopardize the operation or security of the Cloud Service; or
• Remove Chisquares LLC's copyright and authorship notices from the Cloud Service or Cloud Materials.

Subject to your compliance with all obligations outlined in this Agreement, we hereby grant you a limited, revocable, nonexclusive, non-assignable, and non-sublicensable right to access and utilize the Chisquares Platform. This right may be exercised solely through a generally available web browser, mobile device, or application, excluding any methods such as scraping, spidering, crawling, or other technologies or software employed to access data without the explicit written consent of Chisquares LLC. Your access and usage of the Chisquares Platform must adhere to these Terms of Use, the Acceptable Use Policy, and any usage limitations specific to the Chisquares Platform plan you have subscribed to. Any unauthorized use of the Chisquares Platform is strictly prohibited and will be considered a violation of the Terms of Use. We retain all rights that are not expressly granted in this agreement.

1. To be eligible to use the Chisquares Platform, you must meet the following criteria and confirm that you:
2. are 13 years of age or older
3. are a human – accounts created by “bots” or other automated methods are not allowed unless explicitly authorized or enabled by Chisquares LLC
4. are not currently restricted from using the Chisquares Platform
5. are not a competitor of Chisquares LLC or using the Services for competitive purposes against the Chisquares Platform
6. have the full power and authority to enter into this Agreement without violating any other agreements you may have
7. will not infringe upon any rights of Chisquares LLC, including intellectual property rights such as copyright or trademark rights
8. will comply with the Terms of Use and Acceptable Use Policy, as they may be amended from time to time, in addition to adhering to Chisquares' website terms of use as referenced above
9. agree to provide, at your own expense, all necessary equipment, software, and internet access required to utilize the Chisquares Platform.

2.1 As defined in the GDPR:

• Data processing — Any action performed on data, whether automated or manual. The examples cited in the text include collecting, recording, organizing, structuring, storing, using, erasing… so basically anything.
• Data subject — The person whose data is processed. These are customers or site visitors.
• Data controller — The person who decides why and how personal data will be processed. If you’re an owner or employee in your organization who handles data, this is you.
• Data processor — A third party that processes personal data on behalf of a data controller.
• Customer” or “you” ― The customer that is identified on, and/or is a party to, the Agreement.
• " Sub-processor" refers to either a Chisquares LLC affiliate or a third party contracted by Chisquares LLC, in each instance responsible for handling Personal Data in compliance with this Data Processing Agreement (DPA).

2.2 “Data Protection Legislation” means:

1. the General Data Protection Regulation (Regulation (EU) 2016/679)("GDPR") and all other applicable EU, EEA or European single market Member State laws or regulations or any update, amendment or replacement of same that applies to processing of personal data under the Agreement;
2. the Swiss Federal Act on Data Protection Act ("FADP"), or the new Federal Act on Data Protection Act that shall come into force on January 1, 2023 ("nFADP");
3. all U.S. laws and regulations that apply to processing of personal data under the Agreement including but not limited to the California Consumer Privacy Act of 2018 (Cal. Civ. Code §§ 1798.100 - 1798.199)("CCPA");
4. all laws and regulations that apply to processing of personal data under the Agreement from time to time in place in the United Kingdom (including the UK GDPR); and
5. the Personal Information Protection and Electronic Documents Act ("PIPEDA"), or any update, amendment, or replacement of same that applies to processing of personal data in Canada

2.3 The terms "controller", "data protection impact assessment", “process”, “processing”, “processor”, "supervisory authority" have the same meanings as in the GDPR or the UK GDPR.

2.4 The terms “Business”, “Business Purpose(s)”, “Commercial Purpose(s)”, “Personal Information”,

2.5 “Service Provider”, “Sell”, and “Share” have the same meanings as defined in the CCPA.

2.6 "Personal Data" refers to information pertaining to a living individual who can reasonably be identified from the information itself or in conjunction with other data, known as a "Data Subject."

2.7 "Services" denotes the services requested by the Customer from Chisquares LLC under the terms of the Agreement.

2.8 The "SCCs" or "Standard Contractual Clauses" are those specified in the European Commission Decision either dated 4 June 2021, relating to the transfer of personal data to third countries in accordance with the GDPR, or dated 5 February 2010, concerning the transfer of Customer Personal Data to Processors in Third Countries under Directive 95/46/EC. In cases where the FADP/nFADP applies, all references within the SCCs should be interpreted as equivalent references within the FADP/nFADP, with definitions aligned accordingly.

2.9 The "UK Addendum" comprises either:

1. The addendum template issued by the UK Information Commissioner's Office, presented to the UK Parliament as mandated by section 119A of the UK Data Protection Act 2018 on 2 February 2022. This addendum template may undergo revisions under section 18 of the Mandatory Clauses periodically. The document referred to in this definition corresponds to the "International Data Transfer Addendum to the EU Commission Standard Contractual," version B1.0, effective as of 21 March 2022; or
2. If Chisquares LLC has not yet entered into the UK Addendum outlined at (i), the European Commission Decision dated 5 February 2010, pertaining to the transfer of personal data to processors established in third countries under Directive 95/46/EC.

The "UK GDPR" refers to the EU GDPR as it has been adopted into the laws of England and Wales, Scotland, and Northern Ireland through section 3 of the European Union (Withdrawal) Act 2018. This adoption has been further amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 and 2020, along with any subsequent legislation applicable in the United Kingdom that may amend or replace the UK GDPR.

2.10 The term "Agreement" signifies any contract entered into between Chisquares LLC and a customer, encompassing the provision of Services. This agreement may take on different titles, including but not limited to "Order Form," "Sales Order," "Terms of Use," or "Master or Governing Services Agreement," among others.

2.11 Article 28” means article 28 of GDPR and the UK GDPR as applicable to the processing of Customer Personal Data.

2.12 Customer Data” means any content, materials, data, and information that Authorized Users enter or collect into the production system of a Cloud Service or that Customer derives from its use of and stores in the Cloud Service. Customer Data and its derivatives will not include Chisquares LLC’s Confidential Information.

2.13 In relation to CCPA, if applicable, Chisquares LLC and the Customer mutually acknowledge that Chisquares LLC functions as a "Service Provider," while the Customer assumes the role of the "Business" in relation to Personal Information.

Purposes and Nature of Processing:

Chisquares LLC may process Customer Personal Data as necessary to technically perform the Services, including where applicable:

• Hosting and storage
• Backup and disaster recovery
• Technically improve the service
• Service change management
• Issue resolution
• Providing secure, encrypted Services
• Applying new product or system versions, patches, updates and upgrades
• Monitoring and testing system use and performance.
• Proactively detect and remove bugs.
• IT security purposes including incident management.
• Maintenance and performance of technical support systems and IT infrastructure.
• Migration, implementation, configuration and performance testing.
• Making product recommendations
• Providing customer support; transferring data
• Assisting with data subject requests (as necessary).

Purposes and Nature of Personal Data Processing, Categories of Personal Data, Data Subjects

The Customer may submit Customer Personal Data to the Services, and may request for the Customer’s respondents to submit personal data to the Services, the extent of which is determined and controlled by the Customer in its sole discretion, and which may include, without limitation:

• Personal Data: This is often a key category and includes information that can identify individuals, such as names, age, gender, profession, financial status, personal preferences, geolocation data and other similar data.
• Personal data of all types that may be included in forms and surveys hosted on the Services for the Customer (such as may be included in survey questions).
• Contact Data: This subset of personal data includes information used for communication, such as email addresses, phone numbers, physical addresses, and mailing addresses.
• Device Information: Information about the devices users use to access the Chisquares Platform, including device type, operating system, and IP addresses.
• Sensitive Data: Health data or data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs.
• Providing secure, encrypted Services

4. Chisquares LLC Obligations

• Chisquares LLC shall process Personal Data exclusively in accordance with documented instructions provided by Customer. The Agreement, inclusive of this Data Processing Addendum (DPA), constitutes the primary documented instructions. Further instructions are issued with each utilization of the Cloud Service. In cases where Customer's instructions extend beyond those outlined in the Agreement or this DPA, Chisquares LLC will make reasonable efforts to adhere to them, provided they comply with Data Protection Laws, are technically feasible, and do not necessitate modifications to the Cloud Service. If Chisquares LLC cannot comply with an instruction or believes that an instruction violates Data Protection Laws, Chisquares LLC will promptly notify Customer through permissible mediums such as email communication.
• Chisquares LLC shall refrain from collecting, retaining, utilizing, disclosing, or otherwise processing Personal Information, unless expressly required for the specific Business and Commercial Purposes detailed below:
  1. Provision of our Services in accordance with the terms outlined in this Agreement.
  2. Enhancement of our existing services and development of new services, including research endeavors aimed at innovating new products or features.
  3. Utilization for our operational needs and those of our vendors and integration partners.
  4. Maintenance of data security and integrity, limited to the extent necessary and proportionate to fulfil these objectives.
  5. Debugging to identify and rectify errors that may disrupt the intended functionality of our services.
  6. Short-term and transient utilization, such as customizing content displayed by us or our vendors on our services.
  7. Any additional purposes we may communicate to you, in compliance with the applicable Data Protection Legislation.
• Chisquares LLC pledges not to retain, employ, amalgamate, or divulge the Personal Information obtained pursuant to this Agreement beyond the direct business relationship between Chisquares LLC and the Customer, unless explicitly sanctioned by relevant regulations.
• In adherence to Data Protection Legislation, Chisquares LLC will promptly notify the Customer if it becomes aware that any instructions received from the Customer violate the provisions of Data Protection Legislation. However, it's important to note that Chisquares LLC bears no responsibility to routinely scrutinize or assess the legality of instructions issued by the Customer. In the event Chisquares LLC determines that it can no longer fulfil its obligations under the CCPA, it will duly inform the Customer.
• Chisquares LLC affirms its comprehension of the constraints and responsibilities delineated within this Data Processing Agreement (DPA) and all pertinent Data Protection Legislation, pledging full compliance with these standards.
• Chisquares LLC may also process Personal Data if mandated by applicable laws. In such circumstances, Chisquares LLC will notify Customer of the legal obligation before processing, unless the law explicitly prohibits such notification.
• Chisquares LLC shall not Sell or Share any Personal Information
• Chisquares LLC will furnish the Customer with essential information required to substantiate its compliance with Article 28 obligations or analogous requirements as stipulated in Data Protection Legislation, in cases where said information is within Chisquares LLC's possession and not otherwise accessible to the Customer via its account, user areas, or the Chisquares LLC websites. However, Chisquares LLC will do so provided that the Customer provides Chisquares LLC with a minimum of 14 days' advance written notice regarding such a request for information.
• Chisquares LLC shall ensure that any personnel engaged in data processing activities have committed themselves to confidentiality.
• To handle Personal Data, Chisquares LLC will only grant access to authorized personnel who have pledged to maintain confidentiality. Chisquares LLC will periodically train personnel with access to Personal Data in relevant data security and data privacy practices.
• Upon Customer's request, Chisquares LLC will reasonably cooperate with Customer in addressing requests from Data Subjects or regulatory authorities regarding Chisquares LLC's processing of Personal Data or any Personal Data Breach.
• If Chisquares LLC receives a request from a Data Subject related to Personal Data, Chisquares LLC will promptly inform Customer (if the Data Subject has provided information to identify the Customer and if such notification is permitted by applicable law) via email.
• In the event of a dispute with a Data Subject concerning Chisquares LLC's processing of Personal Data under this DPA, the parties will maintain open communication and, when appropriate, collaborate in resolving the dispute amicably with the Data Subject.
• Chisquares LLC will provide functionality within production systems to enable Customer to rectify, delete, anonymize, or restrict the processing of Personal Data in line with Data Protection Laws. If such functionality is not available, Chisquares LLC will rectify, delete, anonymize, or restrict the processing of any Personal Data in accordance with Customer's instructions and Data Protection Laws.
• Unless legally required, neither party will inform any third party or make any public announcement concerning an incident involving Personal Data or any Personal Data Breach in a manner that would identify the other party without obtaining the other party's written consent (which will not be withheld unreasonably).
• If Data Protection Laws necessitate Customer or its Controllers to conduct a data protection impact assessment or engage in prior consultation with a regulator, Chisquares LLC, at Customer's request, will supply generally available documents related to the Cloud Service (e.g., this DPA, the Agreement, and audit reports and certifications). The parties will mutually agree, in good faith and reasonably, on any additional assistance required.
• Sub-processors: Chisquares LLC shall not engage any sub-processors without the prior written consent of the Data Processor. In the event sub-processors are engaged, the Chisquares LLC shall impose the same data protection obligations on the sub-processor as set out in this Agreement.
• Chisquares LLC will not discriminate against consumers who exercise their CCPA rights
• Chisquares LLC shall maintain records as required by applicable data protection laws, reflecting their respective roles and responsibilities.

5. Customer Obligations

• The Customer shall guarantee and affirm that it possesses the right to convey Customer Data to Chisquares LLC, enabling Chisquares LLC to legitimately manage and transmit the Personal Data in accordance with this Data Processing Agreement (DPA).
• The Customer shall take steps to ensure that all pertinent data subjects have been duly informed about this utilization, processing, and transmission, in compliance with the Data Protection Legislation, and that requisite lawful consents have been secured, where necessary.
• The Customer shall further ensure that any handling or transmission of Personal Data to Chisquares LLC adheres to all applicable Data Protection Legislation.
• Security: The Customer shall uphold reasonable security protocols for the utilization of the Cloud Service by its Authorized Users. The Customer shall refrain from conducting or permitting penetration tests on the Cloud Service without obtaining prior written consent from Chisquares LLC.

6. Data Subject Rights

Chisquares shall cooperate in responding to requests from data subjects to exercise their rights under the GDPR, including the right to access, rectification, erasure, and data portability, as appropriate to their respective roles.

7. Data Breach Notification

Chisquares LLC will promptly notify Customer upon becoming aware of any Personal Data Breach and will provide relevant information within its possession to assist Customer in fulfilling its obligations to report such breaches as required by Data Protection Laws. Chisquares LLC may provide this information incrementally as it becomes available. Such notification will not be construed as an acknowledgment of fault or liability by Chisquares LLC.

8. Audits and Inspections

Chisquares LLC may have the right to conduct audits or inspections of the Data Processor's data processing activities to ensure compliance with GDPR requirements.

• In situations where Chisquares LLC is processing Customer Personal Data on behalf of the Customer as a processor (solely), the Customer shall furnish Chisquares LLC with a written notice of at least one month in advance, indicating the intention to conduct an audit. This audit may be carried out by the Customer itself or an independent auditor appointed by the Customer, with the condition that the auditor shall not have any affiliation with or act on behalf of a competitor of Chisquares LLC ("Auditor"). The scope of such an audit will encompass the following:

• Both parties acknowledge that, unless otherwise mandated by an order or a binding decree from a supervisory authority or regulatory body with jurisdiction over the Customer, this Section delineates the entire scope of the Customer's audit rights concerning Chisquares LLC.

9. International Data Transfers

• Where Chisquares LLC is involved in the transfer of Customer Personal Data from the European Economic Area (“EEA”), Switzerland, or the United Kingdom to locations outside these regions, which do not possess adequate data protection standards as determined by the European Commission or relevant Data Protection Legislation, Chisquares LLC relies on the following mechanisms:

• If required, the parties hereby adopt the SCCs and the UK Addendum. The SCCs are incorporated into this Agreement by reference and apply as follows:

10. Sub-processing Details

Governing Law and Jurisdiction

This Agreement shall be governed by and construed in accordance with the laws of Atlanta, GA, US. Any disputes arising out of or in connection with this Agreement shall be subject to the exclusive jurisdiction of the courts of Atlanta, GA, US.

Governing Law and Jurisdiction

This Agreement shall be governed by and construed in accordance with the laws of Atlanta, GA, US. Any disputes arising out of or in connection with this Agreement shall be subject to the exclusive jurisdiction of the courts of Atlanta, GA, US.

Effective Date

This Agreement shall take effect on the date of its execution by both Parties.

(a) Domain: Organization of Information Security

• Security Roles and Responsibilities: Chisquares LLC enforces strict confidentiality obligations for our personnel who have access to data.
• Risk Management Program: Prior to data processing, Chisquares LLC conducts thorough risk assessments as needed.

(b) Domain: Asset Management

Asset Handling:

• We maintain an up-to-date inventory of all hardware housing Customer Data.

(c) Domain: Human Resources Security

Security Training:

• Chisquares LLC educates our personnel about relevant security procedures and their respective roles, including the potential consequences of breaching these rules and procedures.

(d) Domain: Physical and Environmental Security

Asset Handling:

• Protection from Disruptions: We employ industry-standard systems to safeguard against data loss caused by power supply failure or line interference.
• Component Disposal: Chisquares LLC follows industry-standard processes to securely delete Customer Data when it is no longer needed.

(e) Domain: Communications and Operations Management

Operational Policy: Chisquares LLC maintains comprehensive security documents outlining our security measures, procedures, and personnel responsibilities for those with access to Customer Data.

Getting Copies

All records and documents provided or made available to you through the Chisquares platform will be accessible electronically. As an authorized user of the Chisquares platform, you will have the ability to download and print these documents through your Chisquares user account for a limited period (typically 30 days) after their initial availability. We do not offer paper copies of these documents for delivery from our office, and there is no associated fee for electronic access.

If you wish to receive paper copies of any notices or disclosures provided by Chisquares LLC, please contact us using the information provided in the "How to Contact Chisquares LLC" section below.

Withdrawing Your Consent

You have the right to withdraw your consent to receive electronic notices and disclosures at any time. To do so, please follow the instructions outlined in the "To Withdraw Your Consent with Chisquares LLC" section below. In the body of such request you must state your e-mail address, full name, account reference number, and telephone number

Consequences of Changing Your Mind

If you decide to withdraw your consent to receive electronic notices and disclosures, Chisquares LLC will provide electronic copies of any future notices or disclosures to you in accordance with your request. Please note that withdrawing your consent may affect your ability to access certain services electronically.

All Notices and Disclosures Will Be Sent to You Electronically

By agreeing to this consumer disclosure agreement, you acknowledge that all notices and disclosures required under Data Protection Legislation will be sent to you electronically, as permitted by applicable law. To minimize the risk of you unintentionally missing any notices or disclosures, we choose to deliver all necessary notices and disclosures to the same address and through the same method you have provided us.

How to Contact Chisquares LLC

You can reach out to us to inform us of any changes in your electronic contact preferences, request electronic copies of specific information, and withdraw your previous consent to receive electronic notices and disclosures. Please use the following contact information for these purposes: info@chisquares.com

To Advise Chisquares LLC of Your New Email Address

It is your responsibility to promptly notify Chisquares LLC of any changes to your email address to ensure you continue to receive electronic notices and disclosures. To do so, please follow the instructions in the "How to Contact Chisquares LLC" section above.

Acknowledging Your Access and Consent to Receive Materials Electronically

To confirm that you can access information electronically, which will be consistent with other electronic notices and disclosures provided by the Chisquares platform, please verify the following:

1. 1. You were able to read this electronic disclosure.
2. 2. You were able to print this page on paper or electronically save it for future reference and access.
3. 3. You were able to email this disclosure and consent to an address where you can print it on paper or save it for future reference and access.

Further, by indicating your consent to receive notices and disclosures exclusively in electronic format based on the terms and conditions described below, please acknowledge the following by clicking the "I agree" button:

By checking the "I Agree" box, I confirm that:

• I can access and read this Electronic CONSENT TO ELECTRONIC RECEIPT OF ELECTRONIC CONSUMER DISCLOSURES document.
• I can print this disclosure on paper or save/send it to a location where I can print it for future reference and access.
• Unless I notify Chisquares LLC otherwise, I consent to receive exclusively through electronic means all notices, disclosures, authorizations, acknowledgments, and other documents required to be provided or made available to me by Chisquares LLC during our ongoing relationship.

By acknowledging these points and clicking "I Agree," you affirm your ability and consent to receive materials electronically from the Chisquares platform.