Data Processing Addendum

Last updated: 27 October 2026. In force from: 27 October 2026.

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Terms") between the Customer and Lettuce Labs LLC, a Delaware limited liability company that owns and operates the software product Compliant Always ("Lettuce Labs"). It applies whenever Lettuce Labs processes Customer Personal Data in providing the Service, and it takes effect automatically when the Customer accepts the Terms. No signature is needed. Words defined in the Terms have the same meaning here.

1. Definitions

• Data Protection Laws means every law on the protection of personal data that applies to the processing under this DPA, including the EU General Data Protection Regulation 2016/679 (the "GDPR"), the GDPR as it forms part of UK law and the UK Data Protection Act 2018 (the "UK GDPR"), the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (the "CCPA") and other US state privacy laws, and comparable laws elsewhere, such as India's Digital Personal Data Protection Act 2023 and Turkey's Law No. 6698.
• Customer Personal Data means personal data in Customer Content that Lettuce Labs processes on the Customer's behalf.
• Sub-processor means a third party Lettuce Labs engages to process Customer Personal Data.
• Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• "Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the GDPR, and the equivalent terms in other Data Protection Laws (such as "business" and "service provider" under the CCPA) are read accordingly.

2. Roles and instructions

• The Customer is the controller (or, where it acts for another controller, a processor) of Customer Personal Data, and Lettuce Labs is its processor (or sub-processor).
• Lettuce Labs processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use and configuration of the Service (including uploading documents, using the AI features, inviting users and giving partners upload links) are the Customer's complete instructions. Any further instruction must be agreed in writing. Lettuce Labs will tell the Customer if, in its opinion, an instruction breaks Data Protection Laws, and is not required to follow it.
• The Customer warrants that it has, and will keep, a lawful basis for all Customer Personal Data it, its users and its partners put into the Service, that it has given every notice and obtained every consent required to do so (including to individuals named in its documents and to the partners it invites), and that its instructions comply with Data Protection Laws. The Customer is responsible for the accuracy of that data, and will indemnify Lettuce Labs, subject to the Terms, against claims arising from a breach of this warranty.
• The Customer will not upload special category data, criminal records data, payment card details, government identity numbers or personal data of Russian citizens.
• The details of the processing are in Annex 1.

3. Lettuce Labs' obligations

Lettuce Labs will:

• process Customer Personal Data only to provide, secure and support the Service, and never sell it, share it for cross-context behavioural advertising, use it to train any AI model, or use it for any purpose of its own or of any other customer;
• not combine Customer Personal Data with personal data it receives from or on behalf of anyone else, except as the CCPA permits a service provider to do;
• ensure that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality;
• maintain the technical and organisational measures in Annex 2;
• taking into account the nature of the processing, help the Customer respond to requests from data subjects, and with data protection impact assessments and consultations with supervisory authorities, in each case where the Customer cannot reasonably do so itself using the Service, and at the Customer's reasonable cost where the help goes beyond the Service's own features;
• promptly pass to the Customer any request it receives directly from a data subject about Customer Personal Data, without responding to it except to say that it has been passed on; and
• comply with the CCPA as a service provider, and tell the Customer if it can no longer meet its obligations under it; Lettuce Labs certifies that it understands and will comply with the restrictions in this Section;
• if a government or court asks for Customer Personal Data, redirect the request to the Customer where possible, tell the Customer unless the law forbids it, and disclose only what it is legally required to; and
• process Customer Personal Data through AI models only as described in Annex 2: through a single gateway, with zero data retention and no training, with output shown to a person to review, and never to make decisions that produce legal or similarly significant effects on any individual.

4. Sub-processors

• The Customer gives Lettuce Labs general authorisation to engage Sub-processors. The current Sub-processors are listed in Annex 3 and in the Privacy Policy.
• Lettuce Labs will impose on each Sub-processor, by written contract, data protection obligations that protect Customer Personal Data to at least the standard of this DPA, and remains responsible for each Sub-processor's performance.
• Lettuce Labs will tell the Customer, by email to the account holder or in the Service, at least 14 days before adding or replacing a Sub-processor. The Customer may object on reasonable data protection grounds within that period; if it does not, the change is accepted. The parties will then discuss the objection in good faith; if they cannot resolve it, the Customer may stop using the Service and close its account, which is its sole remedy for the objection.

5. Security Incidents

Lettuce Labs will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident. The notice will describe, so far as then known, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Lettuce Labs will take reasonable steps to contain and remedy the incident and will provide further information as it becomes available. Notifying a Security Incident is not an admission of fault or liability. Unsuccessful attempts that do not compromise Customer Personal Data (such as blocked log-in attempts, pings or scans) are not Security Incidents, and Lettuce Labs is not responsible for incidents caused by the Customer, its users or its partners, including by sharing credentials or upload links.

6. International transfers

• Customer Personal Data is stored in the United States and may be processed by the Sub-processors in the locations listed in Annex 3.
• To the extent Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914 (the "SCCs"), which are incorporated into this DPA by reference: Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor. For the SCCs: the optional docking clause in Clause 7 applies; under Clause 9 the general authorisation and notice period in Section 4 apply; the optional language in Clause 11 does not apply; under Clauses 17 and 18 the SCCs are governed by the laws of, and disputes are resolved by the courts of, Ireland; and Annexes I to III of the SCCs are completed by Annexes 1 to 3 of this DPA, with the Customer as data exporter and Lettuce Labs as data importer.
• For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) is incorporated, with its tables completed by the information in this DPA, and either party may end it as its Section 19 allows.
• For transfers subject to Swiss law, the SCCs apply with the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority and references to the GDPR read as references to the Swiss Federal Act on Data Protection.
• Where another Data Protection Law requires a transfer mechanism, the parties agree to the mechanism that law recognises that most closely matches the SCCs.
• For transfers from Turkey, Lettuce Labs will sign the standard contract approved by the Turkish Personal Data Protection Authority on request; the Customer is responsible for notifying that Authority as Turkish law requires.
• If the SCCs conflict with this DPA or the Terms, the SCCs prevail.

7. Audits

Lettuce Labs will make available to the Customer the information reasonably necessary to show that it meets this DPA, by answering the Customer's written questions about its security and processing no more than once a year, or more often if required by a supervisory authority or after a Security Incident. Where the SCCs or Data Protection Laws give the Customer a right to audit that these answers do not satisfy, the Customer may carry out an audit on at least 30 days' written notice, during normal business hours, at its own cost, by an independent auditor bound by confidentiality, in a way that does not disrupt the Service or expose other customers' data. The auditor must not be a competitor of Lettuce Labs, and the audit is limited to the systems that process Customer Personal Data.

8. Return and deletion

The Customer may export Customer Personal Data at any time using the Service's export. When the Customer's account is closed, or on the Customer's written request, Lettuce Labs will delete Customer Personal Data from live systems within 30 days, and backup copies will expire within 35 days after that, unless the law requires Lettuce Labs to keep it.

9. Usage data, liability and order of precedence

Lettuce Labs is an independent controller of the information about how the Service is used (account and sign-in records, usage and security logs) as the Privacy Policy describes, and may create aggregated or de-identified information that identifies no customer or individual, to run, secure and improve the Service.

Each party's liability under or in connection with this DPA, including under the SCCs to the extent the SCCs permit, is subject to the limitations and exclusions in the Terms, which apply to all claims under the Terms and this DPA together, and neither party is liable for fines imposed on the other by a supervisory authority except to the extent caused by its own breach. This DPA prevails over the Terms where they conflict about the processing of Customer Personal Data. This DPA ends when Lettuce Labs no longer processes Customer Personal Data.

Annex 1: Details of the processing

• Data exporter: the Customer, as identified in its account; activities: using the Service to organise its product compliance records. Role: controller (or processor).
• Data importer: Lettuce Labs LLC, c/o ZenBusiness Inc., 611 South Dupont Highway, Suite 102, Dover, DE 19901, United States, legal@compliantalways.com; activities: providing the Service. Role: processor (or sub-processor).
• Data subjects: the Customer's users; the Customer's partners and their staff (such as suppliers, manufacturers, laboratories, importers, distributors and retailers); and individuals named in documents the Customer uploads (such as analysts, signatories and contacts).
• Categories of personal data: names, job titles, employers, business email addresses, phone numbers and postal addresses; signatures and signatory details on documents; account and activity records; and any other personal data the Customer chooses to upload.
• Special categories of data: none intended. The Customer agrees not to upload special category data.
• Frequency: continuous, for as long as the Customer uses the Service.
• Nature and purpose: hosting, storing, reading (including by automated means and large language models), organising, displaying, searching, drafting from and exporting Customer Content, to provide the Service to the Customer under the Terms.
• Duration and retention: for the term of the Terms, then as set out in Section 8.
• Sub-processor processing: as set out in Annex 3, for the duration of the Terms.
• Competent supervisory authority: the authority determined under Clause 13 of the SCCs.

Annex 2: Technical and organisational measures

• Account separation: row-level security in the database restricts every query to the account it belongs to; no request in one account can read another account's records.
• Encryption: data is encrypted in transit using TLS and at rest by the hosting and database providers.
• Private file storage: uploaded files are held in private storage that is not publicly reachable, and each file is served only to a signed-in user of its account or through a link the Customer creates.
• Identity and access: sign-in through a dedicated identity provider with email verification; roles within each account are set by the Customer; staff access to production systems is limited to named people who need it, and the operator console requires a second factor to sign in.
• Attributed history: consequential actions in the Service are recorded against the named person who took them, in a versioned history that is edited over rather than deleted.
• AI processing: every model call is routed through a single gateway with zero data retention and no prompt training required, only to the hosts listed in Annex 3; a call that cannot meet those conditions is not sent.
• Partner upload links: links are unguessable, can be stopped by the Customer at any time, expire, and their use is logged.
• Resilience: managed infrastructure with point-in-time database recovery and backups that expire within 35 days.
• Incident response: a process to investigate, contain and notify Security Incidents under Section 5.
• Development: changes are reviewed and tested before release, and tests run against a separate database, never against customer data.

Annex 3: Sub-processors