Data Processing Addendum

This DPA applies only to Carta’s processing of Customer Personal Data on Customer’s behalf in providing Evergreen. It does not apply to the Other Carta Services.

If this DPA conflicts with the Terms regarding the processing of Customer Personal Data, this DPA controls. If the Standard Contractual Clauses conflict with this DPA, the Standard Contractual Clauses control.

As between the parties, Customer is the controller of Customer Personal Data, or a processor acting for a third-party controller. Carta is a processor or subprocessor and, for purposes of the CCPA, a service provider.

Carta processes Account Data and Usage Data as an independent controller under the Evergreen Privacy Notice. Carta uses that data to operate, bill for, secure, support, and improve Evergreen, to prevent fraud and abuse, and to comply with law. This DPA does not apply to that processing.

If Customer acts as a processor for a third-party controller, Customer is Carta’s sole point of contact and gives all instructions on that controller’s behalf. Customer warrants that the controller has authorized those instructions and Carta’s engagement.

The Terms, this DPA, and Customer’s configuration and use of Evergreen, including instructions given to Agents by Customer and its Authorized Users, are Customer’s complete instructions to Carta. Additional instructions require Carta’s written agreement and may be subject to additional fees.

Customer is solely responsible for (a) the accuracy, quality, and legality of Customer Personal Data and how Customer obtained it, (b) providing all required notices and obtaining all required consents and other legal bases for the processing, and (c) ensuring that its instructions comply with Data Protection Laws and will not cause Carta to violate them.

Customer will not submit any data prohibited by Section 9.5 of the Terms or any special categories of personal data. If Customer does so, Customer is solely responsible for that submission, and Carta assumes no obligations for that data beyond those in this DPA.

When Customer or its Authorized Users direct Evergreen to send Customer Personal Data to a Third-Party Service, including a Model Provider accessed with BYOK Credentials, a code host, or another integration Customer connects, that third party is not Carta’s Subprocessor. The transfer is made on Customer’s instruction under Section 8.3 of the Terms, and Customer’s agreement with that third party governs its processing.

Carta will process Customer Personal Data only to provide Evergreen under Customer’s instructions, to secure Evergreen and enforce the Terms, and as Data Protection Laws require. If law requires other processing, Carta will notify Customer before processing unless the law prohibits notice.

Carta will not (a) sell or share Customer Personal Data, (b) retain, use, or disclose Customer Personal Data for any purpose other than the business purposes in the Terms, or outside the direct business relationship between Carta and Customer, or (c) combine Customer Personal Data with personal data Carta receives from other sources, except as the CCPA permits. Carta will notify Customer if it determines it can no longer meet its obligations under the CCPA. Customer may then take reasonable steps to stop and remediate unauthorized use of Customer Personal Data.

Carta will not use Customer Personal Data to train or fine-tune AI models, consistent with Section 9.3 of the Terms. For Carta-Provided Models, Carta will maintain contractual terms or configurations with the applicable Model Provider that prohibit it from using Customer Personal Data to train its models.

If Carta de-identifies Customer Personal Data as the Data Protection Laws permit, Carta will take reasonable measures to prevent re-identification, will not attempt to re-identify the data, and will contractually require any recipient to do the same.

Carta will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations.

Carta will inform Customer if, in Carta’s opinion, an instruction violates Data Protection Laws. Carta may suspend processing under that instruction without liability.

Customer gives Carta general authorization to engage Subprocessors, including Carta’s affiliates, its hosting providers, and the Model Providers for Carta-Provided Models. Carta’s current Subprocessors for Evergreen are listed at evergreen.carta.com/subprocessors (the “Subprocessor List”).

Carta will enter into a written agreement with each Subprocessor imposing data protection obligations no less protective of Customer Personal Data than those in this DPA, to the extent applicable to the Subprocessor’s services. Subject to Section 13, Carta remains responsible for each Subprocessor’s performance of those obligations.

Carta will update the Subprocessor List at least 7 days before a new Subprocessor begins processing Customer Personal Data. Customer may subscribe to updates at evergreen.carta.com/subprocessors, and Customer is responsible for subscribing.

Customer may object to a new Subprocessor in writing within 7 days after the update, on reasonable grounds relating to data protection. The parties will discuss the objection in good faith. If they cannot resolve it within a reasonable time, Customer’s sole and exclusive remedy is to stop using the affected part of Evergreen or to close its Account under Section 15.2 of the Terms. Customer remains responsible for Fees incurred before that time, and Section 6.6 of the Terms applies to unused Credits. If Customer does not object in time, it is deemed to have approved the Subprocessor.

Section 3.3 of the Terms permits Carta to add, change, or remove Models. If an emergency replacement of a Carta-Provided Model is needed for security, availability, or legal reasons, Carta may engage the replacement Model Provider immediately and will update the Subprocessor List promptly afterward.

Carta will maintain the technical and organizational measures described in Annex II. Carta may update them, provided the updates do not materially reduce the overall protection of Customer Personal Data. Section 11.1 of the Terms continues to apply to Carta’s responsibility for unauthorized access to Customer Personal Data, subject to Section 13.

Customer is responsible for its own security decisions, including its Account credentials, the access, credentials, and permissions it gives Agents under Section 5 of the Terms, its Collaborator permissions, and the security of its Customer Repositories and systems. Customer acknowledges that Annex II provides appropriate security for its intended processing.

Carta will notify Customer without undue delay after becoming aware of a Personal Data Breach. Carta will send notice to the email address on the Account.

Carta will provide information reasonably available to it about the Personal Data Breach, including, where known, the categories of data and data subjects affected. Carta will take steps it considers reasonable to contain and remediate the Personal Data Breach, and will give reasonable assistance to help Customer meet its own notification obligations.

Carta’s notice of or response to a Personal Data Breach is not an acknowledgment of fault or liability.

Sections 8.1 and 8.2 do not apply to incidents caused by Customer or its Authorized Users, including Agent actions within permissions they granted, compromise of Customer credentials, or incidents within Third-Party Services Customer directs Evergreen to use.

If Carta receives a request from a data subject about Customer Personal Data, Carta will direct the data subject to Customer and, where lawful and the request identifies Customer, notify Customer. Carta will not otherwise respond unless law requires. Customer is responsible for responding, including by using Evergreen’s functionality.

If Customer cannot respond to a request, or cannot meet its obligations to conduct data protection impact assessments or consult supervisory authorities, using the information available to it, Carta will give reasonable assistance, taking into account the nature of the processing. Customer will reimburse Carta’s reasonable costs of that assistance to the extent law permits.

On Customer’s written request, no more than once every 12 months, Carta will provide information reasonably needed to demonstrate its compliance with this DPA. That information may consist of summaries of third-party audit reports or certifications, security questionnaire responses, or similar documentation.

If Data Protection Laws require more, and the information under Section 10.1 is not reasonably sufficient, Customer may engage an independent auditor, bound by confidentiality obligations and reasonably acceptable to Carta, to audit Carta’s compliance with this DPA. Any audit (a) requires at least 30 days’ written notice, (b) will follow a scope, time, and duration the parties agree on, (c) will occur during business hours and minimize disruption to Carta, (d) will occur no more than once every 12 months, unless a supervisory authority requires it or it follows a Personal Data Breach, and (e) is at Customer’s sole expense, including reimbursement of Carta’s reasonable costs.

All information provided under this Section 10, and all audit results, are Carta’s confidential information. Audits under Clause 8.9 of the Standard Contractual Clauses will be carried out under this Section 10.

Customer acknowledges that Carta and its Subprocessors process Customer Personal Data primarily in the United States, and authorizes those transfers.

For transfers of Customer Personal Data subject to the GDPR to a country without an adequacy decision, the parties enter into the Standard Contractual Clauses, which are incorporated by reference and completed as follows: (a) Module Two applies where Customer is a controller, and Module Three applies where Customer is a processor; (b) Clause 7 does not apply; (c) in Clause 9, Option 2 applies, with the notice period in Section 6.3 of this DPA; (d) in Clause 11, the optional language does not apply; (e) in Clause 17, Option 1 applies, and the governing law is Irish law; (f) in Clause 18(b), disputes will be resolved by the courts of Ireland; and (g) Annexes I, II, and III of this DPA complete the corresponding Annexes of the Standard Contractual Clauses.

For transfers subject to the UK GDPR, the UK Addendum applies and is incorporated by reference. Tables 1 through 3 are completed with the information in Section 11.2 and the Annexes, and in Table 4, either party may end the UK Addendum as permitted by its Section 19.

For transfers subject to the Swiss Federal Act on Data Protection, the Standard Contractual Clauses apply with these changes: references to the GDPR include that Act, the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for those transfers, and the term “member state” does not prevent data subjects in Switzerland from bringing claims in their place of habitual residence.

If a transfer mechanism in this Section 11 is invalidated or replaced, Carta may adopt an alternative lawful mechanism by notice to Customer, and Customer will cooperate in implementing it.