Data Processing Addendum

This Data Processing Addendum (the "DPA") forms part of the Terms of Service or other written agreement (the "Agreement") between Taxably, Inc. ("Taxably") and the customer entity identified in the Agreement ("Firm"). This DPA applies to Taxably's processing of Personal Data on behalf of Firm in connection with the Services.

The Services are provided in the United States to United States customers. This DPA addresses United States data protection law and does not purport to satisfy data protection laws of jurisdictions outside the United States.

In the event of any conflict between this DPA and the Agreement, this DPA controls with respect to the subject matter of data protection.

1. Definitions

Capitalized terms not defined in this DPA have the meanings given in the Agreement.

• "Applicable Data Protection Laws" means all United States federal, state, and local laws and regulations applicable to the processing of Personal Data under the Agreement, including: (a) Internal Revenue Code § 7216 and Treasury Regulation 26 CFR § 301.7216 ("Section 7216") (b) The Gramm-Leach-Bliley Act, including the FTC Safeguards Rule at 16 CFR Part 314 ("GLBA") (c) The California Consumer Privacy Act and California Privacy Rights Act ("CCPA/CPRA") (d) Other state comprehensive consumer privacy laws, including the Colorado Privacy Act, Connecticut Data Privacy Act, Virginia Consumer Data Protection Act, Utah Consumer Privacy Act, Texas Data Privacy and Security Act, and Oregon Consumer Privacy Act (e) Any successor or replacement laws to the foregoing
• "Business", "Consumer", "Personal Data", "Personal Data Breach", "Processing", "Sell", "Service Provider", and "Share" have the meanings given in CCPA/CPRA or the equivalent terms in other Applicable Data Protection Laws.
• "Subprocessor" means any third party engaged by Taxably to Process Personal Data on Taxably's behalf in connection with the Services.
• "Taxpayer Data" means Personal Data of taxpayers that Firm processes through Taxably Connect.
• "Tax Return Information" has the meaning given in 26 CFR § 301.7216-1(b)(3).

2. Scope and Roles

2.1 Processing roles

With respect to Taxpayer Data, Firm is the Business (or controller) and Taxably acts as Firm's Service Provider (or processor).

With respect to Firm account, billing, and administrative information, Taxably acts as a Business (or controller) for limited purposes related to account management, billing, security, and legal compliance.

2.2 Subject matter, duration, nature, and purpose of processing

• Subject matter: Taxably's provision of the Services to Firm as described in the Agreement.
• Duration: the term of the Agreement and any additional period required for return or deletion of Personal Data under Section 11.
• Nature and purpose: to enable Firm to use the Services for tax document intake, document classification and structured-data extraction, prep-sheet generation, workflow management, and related administrative functions.
• Categories of Consumers: Firm's Authorized Users, and (in respect of Taxpayer Data) the taxpayers whose information Firm processes using Taxably Connect.
• Categories of Personal Data for Authorized Users: name, email address, role, professional credential, account credentials and authentication factors, device identifiers, IP address, log and usage data.
• Categories of Personal Data within Taxpayer Data: as determined by Firm and the documents Firm processes. May include name, address, date of birth, social security number, taxpayer identification number, employer identification number, financial account numbers, dependents, wages, income, deductions, credits, and other information reflected in tax documents. Documents containing Taxpayer Data remain on Firm's own systems. On the per-document path their pages are transmitted directly to the document-processing Subprocessor and Taxably holds no copy; where a bulk job is separately enabled, document content is held and deleted as Sections 3.2(a) and 3.2(c) describe. The records that persist are tokenized (see Section 3.2).

3. Processing Instructions

3.1 Documented instructions

Taxably will Process Personal Data only on Firm's documented instructions. Those instructions include the Agreement, this DPA, and Firm's use of the Services. Taxably will not Process Personal Data for any other purpose unless required by Applicable Data Protection Laws, in which case Taxably will, where legally permitted, inform Firm of the requirement before Processing.

3.2 Transient Processing of Taxpayer Data

Firm instructs Taxably to Process documents containing Taxpayer Data as follows:

(a) Transit. Documents submitted for processing remain on Firm's own systems. To be read, their pages are transmitted from Firm's systems directly to the document-processing Subprocessor over encrypted connections. Taxably's own infrastructure is not on that path and does not hold a copy of a document.

Where processing runs as a bulk job (a single run covering many documents at once rather than one document at a time), document content is written to storage that Taxably administers, is read from there by the document-processing Subprocessor over the course of the job, and is deleted by the run that wrote it on completion, subject to the same backstop deletion policy in Section 3.2(c). Taxably personnel have administrative access to that storage for the duration of the job. Bulk processing is otherwise identical to per-document processing: the same Subprocessor, the same written terms, the same location commitment in Section 4(f), and the same records persisting afterward.

(b) Subprocessor reading. Document contents are read by the document-processing Subprocessor identified on the Subprocessor list (Section 8.2) under written terms that prohibit that Subprocessor from using them to train or fine-tune its models without Taxably's permission, which Taxably does not give, consistent with Section 4(d). Those terms do not, on their own, prevent the Subprocessor from retaining document contents: under its standard terms it may keep content it flags for abuse monitoring for up to 90 days, unless an applicable agreement or an exception it has approved for Taxably's use excludes it. The Subprocessor list states which applies.

(c) Deletion. Where document content is written to storage in advance of a bulk read under Section 3.2(a), it is deleted by the run that wrote it on completion of processing, with an automatic deletion policy of no more than 24 hours as a backstop. On the per-document path nothing is stored, so there is nothing to delete.

(d) What persists. Only structured records produced by processing persist on Taxably's services. Those records reference taxpayers through opaque tokens generated on Firm's own systems rather than by name, and identifier fields (including social security numbers, taxpayer identification numbers, and dates of birth) are removed before storage. Taxably does not offer, and Firm cannot enable, server-side retention of source documents.

This processing model materially limits the Personal Data of taxpayers that Taxably retains on behalf of Firm and is fundamental to the parties' compliance posture under this DPA.

3.3 Compliance with law

Taxably will comply with Applicable Data Protection Laws applicable to its role as a Service Provider and will not engage in any Processing that, in its reasonable judgment, would cause Firm to violate Applicable Data Protection Laws.

4. Section 7216: Auxiliary Services Designation

This Section is material to the Agreement. The parties agree that:

(a) Designation. To the extent Taxpayer Data constitutes Tax Return Information, Taxably is engaged by Firm to provide "auxiliary services" in connection with the preparation of tax returns within the meaning of 26 CFR § 301.7216-2(d)(2), including software services that facilitate the preparation of tax returns.

(b) Limited purpose. Taxably will use and disclose Tax Return Information solely for the purpose of providing the Services to Firm and will not use, disclose, or retain Tax Return Information for any other purpose, including marketing, advertising, profiling, or training of artificial intelligence models for use outside Firm's account.

(c) No further disclosure. Taxably will not disclose Tax Return Information to any person other than (i) Firm and its Authorized Users, (ii) Subprocessors bound by obligations no less protective than those in this DPA, or (iii) as required by law.

(d) Subprocessor obligations. Taxably will require its Subprocessors that process Tax Return Information to agree in writing to use and disclose Tax Return Information only as permitted by Section 7216 and this DPA.

(e) Taxably is itself a tax return preparer, and accepts the consequences of that. By providing auxiliary services in connection with the preparation of tax returns, Taxably is a "tax return preparer" within the meaning of 26 CFR § 301.7216-1(b)(2). Taxably acknowledges that it is therefore subject in its own right to the criminal penalties of IRC § 7216 (fine of up to $1,000, imprisonment of up to one year, or both, per violation, together with the costs of prosecution) and to the civil penalty of IRC § 6713, which applies without regard to intent, for any knowing or reckless unauthorized use or disclosure of Tax Return Information. Taxably will not assert that these obligations rest solely with Firm.

(f) All processing and all access are inside the United States. Taxably will Process Tax Return Information, and will permit access to it, only within the United States. This applies to every system on which Tax Return Information is stored or processed, to every Subprocessor that Processes it, and to every individual who accesses it, including Taxably's employees and contractors. Taxably will not permit Tax Return Information to be accessed from outside the United States. Where Taxably sends document content to a Subprocessor for automated reading, Taxably will pin that processing to a United States region rather than to a routing endpoint that does not guarantee the location of processing. Where document content is written to storage in advance of a bulk read (Section 3.2(a)), Taxably will place that storage at a United States location and will not use a storage location outside the United States for that purpose. Taxably will notify Firm at least thirty (30) days before any change to this commitment, and Firm may terminate the Agreement without penalty if it does not accept the change.

(g) Consent acknowledgment. Firm is responsible for obtaining any taxpayer consents required under Section 7216 in connection with Firm's disclosure of Tax Return Information to Taxably as an auxiliary service provider. Taxably does not solicit consents from Firm's clients. Nothing in this paragraph limits paragraph (e): Firm's consent obligations and Taxably's own obligations as a tax return preparer exist independently of each other.

(h) Cooperation. Each party will cooperate in good faith to maintain compliance with Section 7216 in the parties' performance under the Agreement.

5. GLBA Safeguards Rule

Taxably acknowledges that Firm may be a "financial institution" under the FTC Safeguards Rule (16 CFR Part 314). Taxably will:

(a) implement and maintain administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of customer information, as described in Section 6 (b) reasonably cooperate with Firm's monitoring of Taxably's compliance, including by providing the security materials described in Section 10 (c) report to Firm any Personal Data Breach affecting customer information in accordance with Section 9 (d) impose substantially similar obligations on its Subprocessors that process customer information

6. Security Measures

Taxably will implement and maintain technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include:

• Encryption. TLS 1.3 for data in transit. AES-256 for data at rest in cloud storage.
• Identity and access. Multi-factor authentication (authenticator app, passkeys, backup codes) available for all customer accounts. Role-based access controls following least-privilege principles for Taxably personnel. Periodic access reviews.
• Network security. Network segmentation with least-privilege security groups, TLS termination at a managed load balancer, and DDoS mitigation at the network edge.
• Application security. Secure software development lifecycle, code review, dependency scanning, and vulnerability management. Taxably has not yet had an independent penetration test performed, and will notify Firm when one has been completed.
• Logging and monitoring. Centralized logging of security-relevant events with retention periods consistent with applicable law. Continuous monitoring and alerting.
• Personnel security. Background checks where lawful. Mandatory security and privacy training on hire and annually thereafter. Confidentiality obligations binding on personnel.
• Incident response. Documented incident response procedures, including breach notification procedures consistent with Section 9.
• Vendor risk management. Due diligence on Subprocessors. Contractual data-protection commitments. Periodic review.
• Audit and certification. Taxably maintains the security measures described in this Section 6. Taxably has not engaged an independent auditor and holds no SOC 2 report or other independent security certification or attestation. Taxably will notify Firm when an independent examination of its security controls begins.
• Data minimization. Source documents remain on Firm's systems, and Taxably holds no copy of them on the per-document path; content held for a separately enabled bulk job is deleted as Section 3.2(c) describes; the records that persist are tokenized as described in Section 3.2.

A current description of Taxably's security measures is available to Firm on request and may be updated from time to time to maintain or improve protection of Personal Data.

7. Confidentiality of Personnel

Taxably will ensure that personnel authorized to Process Personal Data:

• Are bound by appropriate written confidentiality obligations or are subject to statutory confidentiality duties
• Receive training appropriate to their role
• Are granted access to Personal Data only as needed to perform their duties

8. Subprocessors

8.1 General authorization

Firm provides general authorization for Taxably to engage Subprocessors to Process Personal Data, subject to the requirements of this Section.

8.2 List of Subprocessors

A current list of Taxably's Subprocessors is published at taxably.ai/subprocessors and is incorporated by reference into this DPA.

8.3 Subprocessor contracts

Taxably will impose on each Subprocessor data-protection obligations that are no less protective than those in this DPA, by written contract. Taxably remains liable to Firm for the acts and omissions of its Subprocessors to the same extent as if Taxably had performed the obligation itself.

8.4 Notice of new or replacement Subprocessors

Taxably will give Firm at least 30 days' advance notice of the engagement of a new Subprocessor that will Process Personal Data. Notice will be given by updating the list at taxably.ai/subprocessors and, on request, by email subscription. Firm may subscribe to email notifications of Subprocessor changes by contacting legal@taxably.ai.

8.5 Objection right

Firm may object to a new Subprocessor on reasonable data-protection grounds by written notice to Taxably within 15 days of receiving the notice. The parties will discuss the objection in good faith. If Taxably cannot reasonably accommodate the objection, Firm may terminate the affected portion of the Services on written notice and receive a pro-rated refund of pre-paid fees for the terminated portion. This is Firm's exclusive remedy for an objection to a Subprocessor.

9. Personal Data Breaches

9.1 Notification

Taxably will notify Firm without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Firm's Personal Data.

9.2 Content of notification

The notification will include, to the extent then known:

• A description of the nature of the breach, including the categories and approximate number of Consumers and records affected
• The likely consequences of the breach
• The measures Taxably has taken or proposes to take to address the breach and to mitigate its possible adverse effects
• A designated point of contact for further information

Taxably may provide information in stages as it becomes available. Initial notification does not constitute an acknowledgment by Taxably of fault or liability with respect to the breach.

9.3 Cooperation

Taxably will cooperate reasonably with Firm in connection with Firm's investigation of and response to a Personal Data Breach, including by providing Firm with information reasonably necessary for Firm to comply with its own notification obligations under Applicable Data Protection Laws.

10. Audits

10.1 Audit reports

On Firm's reasonable written request (no more than once per year, except where a Personal Data Breach has occurred or as required by Applicable Data Protection Laws), Taxably will make available to Firm:

• A summary of the most recent SOC 2 Type II report (once available)
• Other relevant security certifications, attestations, or summary reports

These materials are Taxably's Confidential Information and will be provided under the confidentiality obligations in the Agreement.

10.2 On-site audits

To the extent the reports under Section 10.1 are insufficient to demonstrate compliance with this DPA and Applicable Data Protection Laws require an on-site audit, Firm (or a qualified independent auditor selected by Firm and reasonably acceptable to Taxably) may conduct an audit of Taxably's facilities, systems, and records relevant to the Processing of Personal Data. Audits will be conducted on at least 30 days' prior written notice, during normal business hours, no more than once per year, and at Firm's expense. The auditor will be bound by appropriate confidentiality obligations and will conduct the audit in a manner that does not unreasonably disrupt Taxably's operations or compromise the data of other customers.

11. Return and Deletion of Personal Data

11.1 During the term

Firm may export Firm Data and Personal Data within Firm's account through the Services at any time during the term.

11.2 On termination

After termination or expiration of the Agreement, Firm may ask Taxably in writing, at legal@taxably.ai, to return or delete the Personal Data Taxably Processes on behalf of Firm. Taxably will do so within 90 days of the request and confirm in writing when it is done, unless Applicable Data Protection Laws require continued retention. Personal Data Taxably holds until a request is made, and Personal Data that must be retained, will continue to be protected under the provisions of this DPA.

11.3 Backups

Personal Data residing in Taxably's automated database backups will be deleted on the routine backup expiry cycle (within 35 days). A manual copy of the database taken for a migration, a restore test or a security investigation is kept only as long as that purpose requires, is protected under this DPA while it exists, and is deleted when that purpose ends. Once both have happened, Taxably's deletion obligations are complete.

12. CCPA/CPRA Service Provider Terms

For Personal Data of California Consumers subject to CCPA/CPRA that Taxably Processes on behalf of Firm, Taxably acts as a Service Provider and:

(a) will not Sell or Share Personal Data within the meaning of CCPA/CPRA

(b) will not retain, use, or disclose Personal Data outside the direct business relationship with Firm or for any purpose other than the specific business purposes set forth in this DPA and the Agreement

(c) will not combine Personal Data received from or on behalf of Firm with personal information that Taxably receives from or on behalf of another person, or that Taxably collects from its own interactions with Consumers, except as permitted by CCPA/CPRA

(d) will comply with the applicable obligations of a Service Provider under CCPA/CPRA, including by providing the level of privacy protection required

(e) will notify Firm if Taxably determines it can no longer meet its obligations as a Service Provider

(f) will permit Firm to take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Data

Firm certifies that it understands and will comply with these restrictions.

13. United States Operations

Personal Data is Processed in the United States. The Services are offered to United States customers only. Firm is responsible for ensuring its use of the Services complies with United States law.

14. Consumer Requests

Taxably will, to the extent legally permitted, promptly notify Firm of any request received from a Consumer seeking to exercise rights under Applicable Data Protection Laws relating to Personal Data Processed under this DPA. Taxably will assist Firm in responding to such requests by providing reasonable technical and organizational measures, but Firm is responsible for responding to Consumer requests. Taxably will not respond to such requests directly except on Firm's written instructions or as required by law.

15. Liability

The limitation of liability provisions of the Agreement apply to claims arising under this DPA, except to the extent prohibited by Applicable Data Protection Laws.

16. Term and Survival

This DPA takes effect on the Effective Date and remains in effect for the duration of the Agreement and any additional period necessary for the return or deletion of Personal Data. Sections that by their nature should survive (including Sections 4, 7, 8.3, 9, 11, 12, and 15) will survive termination.

17. Order of Precedence

In the event of a conflict between this DPA and the Agreement, this DPA controls with respect to the subject matter of data protection.

18. Contact

Privacy and data protection: legal@taxably.ai Legal notices: legal@taxably.ai Security incidents: security@taxably.ai Support: support@taxably.ai

Taxably, Inc., a Delaware corporation
Registered office: 131 Continental Dr, Suite 305, Newark, DE 19713, USA

Mailing address, including for legal notices:
4539 N 22ND ST #7547
PHOENIX, AZ, 85016, USA