CURFEW DATA PROCESSING ADDENDUM#

1. Scope and relationship to the Agreement#

This Data Processing Addendum ("DPA") forms part of the Curfew Customer Terms (the "Terms") between Curfew Labs Inc. ("Curfew") and the Customer. Capitalized terms not defined here have the meanings given in the Terms.

This DPA applies to Curfew's processing of Personal Information contained in Customer Data. It does not apply to information Curfew processes as a business or controller on its own behalf — account registration, billing, support, and marketing information — which is governed by the Curfew Privacy Policy.

Under Section 0.2 of the Terms, this DPA takes precedence over the Terms as to the processing of Personal Information, and yields to Product-Specific Terms.

2. Definitions#

"Applicable Privacy Law" means US federal and state laws relating to privacy and the protection of Personal Information that apply to the processing of Customer Data, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, and comparable laws of other US states.

"Business," "Consumer," "Sell," "Share," "Service Provider," and "Sensitive Personal Information" have the meanings given in the CCPA.

"Controller" and "Processor" have the meanings given in Applicable Privacy Law, and include a Business and a Service Provider respectively.

"Personal Information" means information within Customer Data that identifies, relates to, describes, or could reasonably be linked with an identified or identifiable individual or household, and that is protected by Applicable Privacy Law.

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Information processed by Curfew.

"Subprocessor" means a third party engaged by Curfew to process Personal Information on Curfew's behalf.

3. Roles#

The Customer is the Controller and Business. Curfew is the Processor and Service Provider.

The Customer determines the purposes and means of processing, decides what Personal Information enters the Services, and is responsible for the lawfulness of that processing, including providing any notice and obtaining any consent required.

Curfew does not decide what Personal Information the Customer submits and does not review it.

4. Processing instructions and limited purpose#

4.1 Documented instructions#

Curfew will process Personal Information only on the Customer's documented instructions, which are: this DPA, the Terms, the Customer's configuration and use of the Services, and instructions given by the Customer's Administrators and Users through the Services.

4.2 Business purposes#

The limited and specified purposes for which Curfew processes Personal Information are: providing, maintaining, securing, and supporting the Services as described in the Terms and the Products & Services Catalog, and performing the functions of each App the Customer has provisioned.

4.3 Unlawful instructions#

If Curfew reasonably believes an instruction violates Applicable Privacy Law, it will notify the Customer and may suspend the affected processing until the instruction is withdrawn, confirmed, or amended.

5. Restrictions on Curfew#

Curfew will not:

(a) sell or share Personal Information, as those terms are defined in the CCPA; (b) retain, use, or disclose Personal Information for any purpose other than the business purposes specified in Section 4.2, including retaining, using, or disclosing it for a commercial purpose other than those purposes; (c) retain, use, or disclose Personal Information outside the direct business relationship between Curfew and the Customer; (d) combine Personal Information with personal information Curfew receives from or on behalf of another person, or collects from its own interaction with a Consumer, except as permitted by the CCPA for a Service Provider; or (e) use Personal Information to train, fine-tune, or improve any generative model. See Schedule C of the Terms.

Curfew certifies that it understands the restrictions in this Section 5 and will comply with them.

6. Compliance and notification of inability#

Curfew will comply with the obligations applicable to it as a Service Provider and Processor under Applicable Privacy Law and will provide the same level of privacy protection as Applicable Privacy Law requires.

Curfew will notify the Customer promptly if it determines it can no longer meet its obligations under Applicable Privacy Law. On such notice, the Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Information, including directing Curfew to cease the affected processing.

7. Confidentiality#

Curfew will ensure that personnel authorized to process Personal Information are subject to a duty of confidentiality, and will limit access to those who need it to perform the Services.

8. Security#

Curfew will implement and maintain reasonable technical and organizational measures designed to protect Personal Information, appropriate to the nature of the information and the risks of processing. Those measures are described at www.curfewsuite.com/security and in Annex 2.

The Customer is responsible for its own configuration and use of the Services, including Section 14 (Shared responsibility) of the security page and Section 6.4 of the Terms.

9. Subprocessors#

9.1 Authorization#

The Customer generally authorizes Curfew to engage Subprocessors. Curfew's current Subprocessors are listed at www.curfewsuite.com/security.

9.2 Flow-down#

Curfew will enter a written agreement with each Subprocessor imposing obligations that are substantially the same as, and no less protective than, those in this DPA. Curfew remains responsible to the Customer for a Subprocessor's performance.

9.3 Changes#

Curfew will update the Subprocessors page before engaging a new Subprocessor that processes Personal Information. The Customer may subscribe to notifications at support@curfewsuite.com.

The Customer may object to a new Subprocessor within fifteen (15) days of notice, on reasonable grounds relating to data protection. If the parties cannot resolve the objection, the Customer's sole remedy is to terminate the affected Apps or the Agreement and receive a pro-rata refund of prepaid, unused fees.

9.4 Customer-supplied Model Providers#

Where the Customer supplies its own Model Provider credentials under Schedule C, Section C.4.4, that Model Provider is the Customer's subprocessor, not Curfew's, and this Section 9 does not apply to it.

10. Consumer rights#

Curfew will provide reasonable assistance to enable the Customer to respond to requests from Consumers to know, access, delete, correct, or port their Personal Information, and to opt out of sale or sharing, taking into account the nature of the processing and the tools available in the Services.

Where a Consumer directs a request to Curfew concerning Personal Information in a Customer's Account, Curfew will not respond substantively. Curfew will refer the request to the Customer and, where it can identify the Customer, will inform the Consumer that the request has been referred.

11. Deidentified information#

Where Curfew creates deidentified or aggregated information from Personal Information under Section 6.5 of the Terms, Curfew will:

(a) take reasonable measures to ensure it cannot be associated with an individual or household; (b) publicly commit to maintain and use it in deidentified form and not attempt to reidentify it, except to test whether deidentification measures are adequate; and (c) contractually obligate any recipient to the same.

12. Retention, deletion on request, and return#

Retention. Curfew may retain Personal Information indefinitely, or for the period set out for a particular application or feature in the Services or in the Terms (for example, executed Signature Envelopes under Schedule D, Section D.1.8, or a retention window a Customer sets within an application). On termination, Customer may export Personal Information in accordance with Section 12.3 of the Terms.

Deletion on request. On Customer's written request, Curfew will purge the Personal Information it holds on Customer's behalf, provided that, and to the extent that, applicable law permits it to do so. Curfew will not delete Personal Information that applicable law requires it to retain, and will tell Customer what it has retained and why. Copies held in Curfew's encrypted backups are removed as those backups expire under the backup schedule published at www.curfewsuite.com/security.

Where Curfew retains Personal Information under this Section, it will continue to protect it in accordance with this DPA and will limit processing to the purpose of the retention.

13. Demonstrating compliance#

Curfew will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA. That information consists of:

(a) the security page at www.curfewsuite.com/security and the Subprocessors list; (b) Curfew's responses to a reasonable security questionnaire, not more than once in any twelve-month period; and (c) any third-party audit report or certification Curfew then holds.

Any on-site audit or inspection requires a separate written agreement, and is available only under a signed order form. The Customer bears its own costs and Curfew's reasonable costs of supporting an audit.

14. Security Incidents#

Curfew will notify the Customer of a Security Incident affecting Personal Information without undue delay after becoming aware of it, and will provide the information then reasonably available to it, updating the Customer as more becomes known.

Curfew will take reasonable steps to contain and remediate the Security Incident.

Notification to Consumers, regulators, and any other party is the Customer's obligation, as Controller and Business. Curfew's notification is not an acknowledgment of fault or liability.

15. Sensitive Personal Information#

The Services are not designed to process Sensitive Personal Information, and Section 6.4 of the Terms restricts what the Customer may submit.

Where the Customer submits Sensitive Personal Information notwithstanding those restrictions, Curfew processes it only for the purposes in Section 4.2, and the Customer is responsible for any additional notice, consent, limitation, or assessment obligation that attaches to it.

16. Employee and personnel information#

The Customer may process information about its own personnel through the Services, including through Curfew Staff and Curfew Payroll Helper. The Customer is the Controller and Business for that information, including for any assessment, ranking, or evaluation output produced by an AI Feature under Schedule C, Section C.7.3.

17. Geographic scope#

All Personal Information processed under this DPA is stored in the United States.

The Services are offered only to customers organized and based in the United States under Sections 2.1(a) and 2.2 of the Terms, and Section 6.4 of the Terms prohibits the Customer from submitting personal data of individuals located in the European Economic Area, the United Kingdom, or Switzerland.

This DPA does not provide terms required by the GDPR, the UK GDPR, or Swiss law, and does not incorporate Standard Contractual Clauses. If the Customer submits such data in breach of Section 6.4, this DPA does not supply the terms that would be required for it, and the Customer is responsible for the consequences under Sections 6.4 and 14.1 of the Terms.

If Curfew begins offering the Services outside the United States, it will publish an updated DPA before doing so.

18. Liability#

The limitations and exclusions in Section 15 of the Terms apply to claims under this DPA, and the parties' aggregate liability under the Terms and this DPA together is subject to a single cap.

19. Term and conflicts#

This DPA takes effect when the Customer accepts the Terms and continues until Curfew ceases processing Personal Information. Sections 5, 11, 12, and 18 survive.

If this DPA conflicts with the Terms as to the processing of Personal Information, this DPA controls.

ANNEX 1 — DETAILS OF PROCESSING#

ANNEX 2 — SECURITY MEASURES#

Curfew's technical and organizational measures are described at www.curfewsuite.com/security, as updated from time to time, and are incorporated here by reference. They include: encryption in transit; encryption at rest for backups and stored email; database-enforced tenant isolation with default-deny row-level security; least-privilege application database access; append-only administrative audit logging per workspace; malware scanning of uploaded files; twice-daily encrypted off-site backups held in a separate cloud account; and passwordless authentication.

[CONFIRM: this Annex must match the security page exactly. Where the two differ, the Annex becomes the contractual commitment and the more exposed document.]

ANNEX 3 — SUBPROCESSORS#

The current list of Subprocessors is maintained at www.curfewsuite.com/security and is incorporated here by reference. As of the effective date it comprises Railway Corp. (hosting, compute, database, object storage), Amazon Web Services, Inc. (backup storage, email, and AI inference), OpenRouter, Inc. (fallback AI inference), and Stripe, Inc. (payment processing).