Data Processing Addendum

Effective August 29, 2026

How Blockit processes personal data on behalf of enterprise customers.

This Data Processing Addendum (including its Exhibits) (“Addendum”) forms part of and is subject to the terms and conditions of the Blockit Enterprise Customer Subscription Agreement available at https://www.blockit.com/enterprise-agreement between the entity specified in the applicable Order Form (“Customer”) and Blockit AI, Inc. (“Blockit”), or other written agreement between Customer and Blockit that expressly references this Addendum (the “Agreement”). The version of this Addendum in effect as of the Effective Date of the applicable Order Form (or, if applicable, the effective date of such other written agreement) governs for the Term of that Order Form or agreement, unless the parties expressly agree otherwise in writing.

Subject Matter and Duration

1(a) Subject Matter

This Addendum reflects the parties’ commitment to abide by Data Protection Laws concerning the Processing of Customer Personal Data in connection with Blockit’s execution of the Agreement. In this context, Blockit will act as a processor to Customer, who will act as controller of Customer Personal Data. All capitalized terms that are not expressly defined in this Addendum will have the meanings given to them in the Agreement. If and to the extent language in this Addendum or any of its Exhibits conflicts with the Agreement, this Addendum shall control with respect to the Processing of Customer Personal Data.

1(b) Duration and Survival

This Addendum is effective as of, and becomes legally binding upon, the effective date of the Agreement, and the parties’ entry into the Agreement constitutes execution of this Addendum by both parties. Blockit will Process Customer Personal Data until the relationship terminates as specified in the Agreement.

Definitions

For the purposes of this Addendum, the following terms and those defined within the body of this Addendum apply.

2(a) “Customer Personal Data” means Personal Data Processed by Blockit on behalf of Customer under the Agreement.

2(b) “Data Protection Laws” means the applicable data privacy, data protection, and cybersecurity laws, rules and regulations to which the Customer Personal Data are subject. “Data Protection Laws” may include, but are not limited to, the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act) (“CCPA”); the EU General Data Protection Regulation 2016/679 (“GDPR”) and its respective national implementing legislations; the Swiss Federal Act on Data Protection; the United Kingdom General Data Protection Regulation; and the United Kingdom Data Protection Act 2018 (in each case, as amended, adopted, or superseded from time to time).

2(c) “Personal Data” has the meaning assigned to the term “personal data” or “personal information” under applicable Data Protection Laws.

2(d) “Process” or “Processing” means any operation or set of operations which is performed on Personal Data or sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.

2(e) “Security Incident(s)” means the breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data attributable to Blockit.

2(f) “Services” means the services that Blockit performs under the Agreement.

2(g) “Subprocessor(s)” means a vendor that Blockit has engaged to Process Customer Personal Data.

Processing Terms for Customer Personal Data

3(a) Documented Instructions

Blockit shall Process Customer Personal Data to provide the Services in accordance with the Agreement, this Addendum, any applicable Order Form, and any instructions agreed upon by the parties. Blockit will, unless legally prohibited from doing so, inform Customer in writing if it reasonably believes that there is a conflict between Customer’s instructions and applicable law or otherwise seeks to Process Customer Personal Data in a manner that is inconsistent with Customer’s instructions.

3(b) Authorization to Use Subprocessors

To the extent necessary to fulfill Blockit’s contractual obligations under the Agreement, Customer hereby authorizes Blockit to engage Subprocessors. Customer acknowledges that Subprocessors may further engage vendors.

3(c) Blockit and Subprocessor Compliance

Blockit shall (i) enter into a written agreement with Subprocessors regarding such Subprocessors’ Processing of Customer Personal Data that imposes on such Subprocessors data protection requirements for Customer Personal Data that are consistent with this Addendum; and (ii) remain responsible to Customer for Blockit’s Subprocessors’ failure to perform their obligations with respect to the Processing of Customer Personal Data.

3(d) Right to Object to Subprocessors

A current list of Subprocessors is available at https://trust.blockit.com/subprocessors (the “Subprocessor List”), which contains a mechanism for Customer to subscribe to notifications of new Subprocessors. Customer is responsible for subscribing to such notifications, and notifications sent through this mechanism are Blockit’s means of providing notice of new Subprocessors, including for purposes of the Standard Contractual Clauses. Blockit will send each such notification at least ten (10) days before the new Subprocessor begins Processing Customer Personal Data, via email to the subscribed email address(es), identifying the Subprocessor. Customer may object in writing to Blockit’s engagement of a new Subprocessor within ten (10) days from the date Blockit’s notification is sent (the “Objection Period”), provided that the objection is based on reasonable grounds relating to data protection. If Customer raises legitimate objections to the appointment of any new Subprocessor within the Objection Period, the parties will work together in good faith to resolve the grounds for the objection.

3(e) Confidentiality

Any person authorized to Process Customer Personal Data must be subject to a duty of confidentiality, contractually agree to maintain the confidentiality of such information, or be under an appropriate statutory obligation of confidentiality.

3(f) Personal Data Inquiries and Requests

Where required by Data Protection Laws, Blockit agrees to provide reasonable assistance and comply with reasonable instructions from Customer related to any validated requests from individuals exercising their rights in Customer Personal Data granted to them under Data Protection Laws.

3(g) Data Protection Assessment, Data Protection Impact Assessment, and Prior Consultation

Where required by Data Protection Laws, Blockit agrees to provide reasonable assistance and information to Customer where, in Customer’s judgement, the type of Processing performed by Blockit requires a data protection assessment, data protection impact assessment, and/or prior consultation with the relevant data protection authorities. Customer shall reimburse Blockit for reasonable, pre-approved out-of-pocket costs that materially exceed routine assistance.

3(h) Demonstrable Compliance

Blockit agrees to provide information reasonably necessary to demonstrate compliance with this Addendum upon Customer’s reasonable request.

3(i) California Specific Terms

To the extent that Blockit’s Processing of Customer Personal Data is subject to the CCPA, this Section shall also apply. Customer discloses or otherwise makes available Customer Personal Data to Blockit for the limited and specific purpose of Blockit providing the Services to Customer in accordance with the Agreement and this Addendum. Blockit shall: (i) comply with its applicable obligations under the CCPA; (ii) provide the same level of protection as required under the CCPA; (iii) notify Customer if it can no longer meet its obligations under the CCPA; (iv) not “sell” or “share” (as such terms are defined by the CCPA) Customer Personal Data; (v) not retain, use, or disclose Customer Personal Data for any purpose (including any commercial purpose) other than to provide the Services under the Agreement or as otherwise permitted under the CCPA; (vi) not retain, use, or disclose Customer Personal Data outside of the direct business relationship between Customer and Blockit; and (vii) unless otherwise permitted by the CCPA, not combine Customer Personal Data with Personal Data that Blockit (a) receives from, or on behalf of, another person, or (b) collects from its own, independent consumer interaction. Customer may: (1) take reasonable and appropriate steps agreed upon by the parties to help ensure that Blockit Processes Customer Personal Data in a manner consistent with Customer’s CCPA obligations; and (2) upon notice, take reasonable and appropriate steps agreed upon by the parties to stop and remediate unauthorized Processing of Customer Personal Data by Blockit.

3(j) Service Optimization

Blockit shall Process Customer Personal Data solely for the limited and specific purpose of providing the Services to Customer under the Agreement and this Addendum, which includes providing technical support, troubleshooting, maintenance, and security of the Services. Blockit shall not: (i) use Customer Personal Data to develop or improve any products or services (except to the extent such improvement is a by-product of resolving Customer’s specific support request); or (ii) use Customer Personal Data to train artificial intelligence or machine learning models. Nothing in this Addendum restricts Blockit from creating or using Aggregate Data (as defined in the Agreement) in compliance with Data Protection Laws and the Agreement.

Information Security Program

Blockit shall implement and maintain appropriate administrative, technical, and physical safeguards designed to protect Customer Personal Data. Such safeguards shall include: (i) encryption of Customer Personal Data in transit and at rest; (ii) restricting access to Customer Personal Data to those Blockit personnel that require such access to perform the Services, consistent with the principles of least privilege and need-to-know; and (iii) multi-factor authentication for remote network and system access to Blockit systems.

Security Incidents

Upon becoming aware of a Security Incident, Blockit agrees to provide written notice without undue delay and in any event within seventy-two (72) hours after becoming aware of the Security Incident, to Customer. Where possible, such notice will include all available details required under Data Protection Laws for Customer to comply with its own notification obligations to regulatory authorities or individuals affected by the Security Incident. Blockit will reasonably cooperate with Customer’s investigation and response to the Security Incident and take reasonable steps to mitigate its effects as it relates to Blockit’s impacted systems.

Cross-Border Transfers of Customer Personal Data

6(a) Cross-Border Transfers of Customer Personal Data

Customer authorizes Blockit and its Subprocessors to transfer Customer Personal Data across international borders, including from the European Economic Area, Switzerland, and/or the United Kingdom to the United States.

6(b) EEA, Swiss, and UK Standard Contractual Clauses

If Customer Personal Data originating in the European Economic Area, Switzerland, and/or the United Kingdom is transferred by Customer to Blockit in a country that has not been found to provide an adequate level of protection under applicable Data Protection Laws, the parties agree that the transfer shall be governed by Module Two’s obligations in the Annex to the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (“Standard Contractual Clauses”) as supplemented by Exhibit A attached hereto, the terms of which are incorporated herein by reference. Each party’s signature to the Agreement shall be considered a signature to the Standard Contractual Clauses to the extent that the Standard Contractual Clauses apply hereunder.

Audits and Assessments

Upon request, Blockit will supply (on a confidential basis) Blockit’s SOC 2 Type II report to Customer so that Customer can verify Blockit’s compliance with this Addendum. If Customer cannot reasonably verify Blockit’s compliance with the terms of this Addendum, Blockit will provide written responses (on a confidential basis) to all reasonable requests for information made by Customer related to Blockit’s Processing of Customer Personal Data, provided that Customer will not exercise this right more than once per calendar year.

Customer Personal Data Deletion

At the expiry or termination of the Agreement, Blockit will delete all Customer Personal Data within 30 days (excluding any back-up or archival copies which shall be deleted in accordance with Blockit’s data retention schedule, but in no event later than 90 days following expiry or termination of the Agreement, during which time such back-up copies shall be isolated, encrypted, and protected from any further Processing), except where Blockit is required to retain copies under applicable laws, in which case Blockit will isolate and protect that Customer Personal Data from any further Processing except to the extent required by applicable laws.

Customer’s Obligations

Customer represents and warrants that: (i) it has complied and will comply with Data Protection Laws; (ii) it has provided data subjects whose Customer Personal Data will be Processed in connection with the Agreement with a privacy notice or similar document that clearly and accurately describes Customer’s practices with respect to the Processing of Customer Personal Data; (iii) it has obtained and will obtain and continue to have, during the term, all necessary rights, lawful bases, authorizations, consents, and licenses for the Processing of Customer Personal Data as contemplated by the Agreement; and (iv) Blockit’s Processing of Customer Personal Data in accordance with the Agreement will not violate Data Protection Laws or cause a breach of any agreement or obligations between Customer and any third party.

Processing Details

10(a) Subject Matter

The subject matter of the Processing is the Services pursuant to the Agreement.

10(b) Duration

The Processing will continue until the expiration or termination of the Agreement.

10(c) Categories of Data Subjects

Customer's employees, contractors, end users of the Services, and external recipients included in end users' email threads or calendar events.

10(d) Nature and Purpose of the Processing

The purpose of the Processing of Customer Personal Data by Blockit is the performance of the Services.

10(e) Types of Customer Personal Data

Name, email address, account information, calendar data, scheduling information, and email and messaging content.

Exhibit A to the Data Processing Addendum

This Exhibit A forms part of the Addendum and supplements the Standard Contractual Clauses. Capitalized terms not defined in this Exhibit A have the meaning set forth in the Addendum.

The parties agree that the following terms shall supplement the Standard Contractual Clauses:

Supplemental Terms. The parties agree that: (i) a new Clause 1(e) is added to the Standard Contractual Clauses which shall read: “To the extent applicable hereunder, these Clauses also apply mutatis mutandis to the Parties’ processing of personal data that is subject to the Swiss Federal Act on Data Protection. Where applicable, references to EU Member State law or EU supervisory authorities shall be modified to include the appropriate reference under Swiss law as it relates to transfers of personal data that are subject to the Swiss Federal Act on Data Protection.”; (ii) a new Clause 1(f) is added to the Standard Contractual Clauses which shall read: “To the extent applicable hereunder, these Clauses, as supplemented by Annex III, also apply mutatis mutandis to the Parties’ processing of personal data that is subject to UK Data Protection Laws (as defined in Annex III).”; (iii) the optional text in Clause 7 is deleted; (iv) Option 1 in Clause 9 is struck and Option 2 is kept, and data importer must notify data exporter of any new subprocessors in accordance with Section 3(d) of the Addendum; (v) the optional text in Clause 11 is deleted; and (vi) in Clauses 17 and 18, the governing law and the competent courts are those of Ireland (for EEA transfers), Switzerland (for Swiss transfers), or England and Wales (for UK transfers).
Annex I. Annex I to the Standard Contractual Clauses shall read as follows:

A. List of Parties

Data ExporterCustomer.

AddressAs set forth in the applicable Order Form.

Contact person’s name, position, and contact detailsAs set forth in the applicable Order Form.

Activities relevant to the data transferred under these ClausesThe Services.

RoleController.

Data ImporterBlockit.

AddressAs set forth in the applicable Order Form.

Contact person’s name, position, and contact detailsprivacy@blockit.com

Activities relevant to the data transferred under these ClausesThe Services.

RoleProcessor.

B. Description of the Transfer

Categories of data subjects whose personal data is transferredThe categories of data subjects whose personal data is transferred under the Clauses including, but not limited to, Customer’s employees, contractors, end users of the Services, and external recipients included in end users’ email threads or calendar events.

Categories of personal data transferredThe categories of personal data transferred under the Clauses including, but not limited to, name, email address, account information, calendar data, scheduling information, and email and messaging content.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measuresTo the parties’ knowledge, no sensitive data is transferred.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)Personal data is transferred in accordance with the standard functionality of the Services, or as otherwise agreed upon by the parties.

Nature of the processingThe Services.

Purpose(s) of the data transfer and further processingThe Services.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that periodData importer will retain personal data in accordance with the Addendum.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processingData importer will provide its list of subprocessors upon data exporter’s written request.

C. Competent Supervisory Authority

The supervisory authority mandated by Clause 13. If no supervisory authority is mandated by Clause 13, then the Irish Data Protection Commission (DPC), and if this is not possible, then as otherwise agreed by the parties consistent with the conditions set forth in Clause 13.

Annex II. Annex II of the Standard Contractual Clauses shall read as follows:

Data importer shall implement and maintain appropriate technical and organizational measures designed to protect personal data in accordance with the Addendum and SOC 2 Type II requirements.

Pursuant to Clause 10(b), data importer will provide data exporter assistance with data subject requests in accordance with the Addendum.

Annex III. A new Annex III shall be added to the Standard Contractual Clauses and shall read as follows:

The UK Information Commissioner’s Office International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (“UK Addendum”) is incorporated herein by reference.

Table 1The start date in Table 1 is the effective date of the Addendum. All other information required by Table 1 is set forth in Annex I, Section A of the Clauses.

Table 2The UK Addendum forms part of the version of the Approved EU SCCs which this UK Addendum is appended to including the Appendix Information, effective as of the effective date of the Addendum.

Table 3The information required by Table 3 is set forth in Annex I and II to the Clauses.

Table 4The parties agree that both the Importer and the Exporter may end the UK Addendum as set out in Section 19.

End of Data Processing AddendumAll legal documents →