Butter's Data Processing Addendum

THIS DATA PROCESSING ADDENDUM (“DPA”) is entered into as of the Addendum Effective Date by and between: (1) Butter Payments, Inc. a U.S. corporation with its principal business address at 1 Letterman Drive, Building C, Suite 3500, San Francisco, CA 94129 (“Butter”); and (2) the entity or other person who is a counterparty to the Agreement (as defined below) into which this DPA is incorporated and forms a part (“Customer”), together the “Parties” and each a “Party”.

INTERPRETATION

In this DPA, the following terms shall have the meanings set out in this Section 1, unless expressly stated otherwise:
1. “Addendum Effective Date” means the effective date of the Agreement.
2. “Agreement” means the agreement under which Butter has agreed to provide services to Customer entered into by and between the Parties.
3. “Applicable Data Protection Laws” means the privacy, data protection and data security laws and regulations of any jurisdiction applicable to Butter’s Processing of Customer Personal Data under the Agreement (including, as and where applicable, the GDPR and or State Privacy Laws).
4. “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
5. “Customer Personal Data” means any Personal Data Processed by Butter or its Sub-Processor on behalf of Customer to perform the Services under the Agreement (including, for the avoidance of doubt, any such Personal Data comprised within Customer Data).
6. “Data Subject” means the identified or identifiable natural person to whom Customer Personal Data relates.
7. “Data Subject Request” means the exercise by a Data Subject of its rights in accordance with Applicable Data Protection Laws in respect of Customer Personal Data and the Processing thereof.
8. “GDPR” means, as and where applicable to Processing concerned: (i) the General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”); and/or (ii) the EU GDPR as it forms part of UK law (as amended from time to time) (“UK GDPR”).
9. “Personal Data” means “personal data,” “personal information,” “personally identifiable information” or similar term defined in Applicable Data Protection Laws.
10. “Personal Data Breach” means a breach of Butter’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in Butter’s possession, custody or control. For clarity, Personal Data Breach does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data (such as unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems).
11. “Personnel” means a person’s employees, agents, consultants, contractors or other staff.
12. “Process”, and grammatical inflections thereof, means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
13. “Processor” means a natural or legal person, public authority, agency or other body that Processes Personal Data on behalf of a Controller.
14. “Restricted Transfer” means the disclosure, grant of access or other transfer of Customer Personal Data to any person located in: (i) in the context of the EU GDPR, any country or territory outside the European Economic Area (“EEA”) which does not benefit from an adequacy decision from the European Commission (an “EU Restricted Transfer”); and (ii) in the context of the UK GDPR, any country or territory outside the UK, which does not benefit from an adequacy decision from the UK Government (a “UK Restricted Transfer”), which would be prohibited without a legal basis under Chapter V of the GDPR.
15. “SCCs” means the standard contractual clauses approved by the European Commission pursuant to implementing Decision (EU) 2021/914.
16. “Services” means those services and activities to be supplied to or carried out by or on behalf of Butter for Customer pursuant to the Agreement.
17. “State Privacy Laws” means the California Consumer Privacy Act of 2018 (“CCPA”), the Colorado Privacy Act, the Virginia Consumer Data Protection Act, the Connecticut Data Privacy Act, and the Utah Consumer Privacy Act, in each case only if and to the extent applicable to Butter’s Processing of Customer Personal Data under the Agreement.
18. “Sub-Processor” means any third party appointed by or on behalf of Butter to Process Customer Personal Data.
19. “Supervisory Authority”: (i) in the context of the EEA and the EU GDPR, shall have the meaning given to that term in the EU GDPR; and (ii) in the context of the UK and the UK GDPR, means the UK Information Commissioner’s Office.
20. “UK Transfer Addendum” means the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section ‎‎18 of the UK Mandatory Clauses included in Part 2 thereof (the “UK Mandatory Clauses”).
Unless otherwise defined in this DPA, all capitalized terms in this DPA shall have the meaning given to them in the Agreement.

PROCESSING OF CUSTOMER PERSONAL DATA

Details and roles. The Parties acknowledge and agree that the details of Butter’s Processing of Customer Personal Data (including the respective roles of the Parties relating to such Processing) are as described in Annex 1 (Data Processing Details) to the DPA.
General. Butter shall not Process Customer Personal Data other than: (a) on Customer’s instructions set out in the Agreement and this DPA; or (b) as required by applicable laws, provided that in such circumstances, Butter shall inform Customer in advance of the relevant legal requirement requiring such Processing if and to the extent Butter is: (i) required to do so by Applicable Data Protection Laws; and (ii) permitted to do so in the circumstances. Customer instructs and authorizes Butter to Process Customer Personal Data for the purposes set out in the Agreement (as further described in Annex 1 (Data Processing Details) to the DPA). The Agreement is a complete expression of such instructions, and Customer’s additional instructions will be binding on Butter only pursuant to any written amendment to this DPA signed by both Parties. Where required by Applicable Data Protection Laws, if Butter receives an instruction from Customer that, in its reasonable opinion, infringes Applicable Data Protection Laws, Butter shall notify Customer.
Improvement and General Usage Processing. To the extent that Butter carries out any secondary Processing of Customer Personal Data under the license set out in the final sentence of Section 5(2) of the Agreement to improve the Services (including to train machine learning models and artificial intelligence algorithms, plus associated de-identification or aggregation): (a) Customer hereby authorizes that Processing to the fullest extent required by Applicable Data Protection Laws; and (b) Butter acts as an independent Controller in respect of such Processing and shall: (i) comply with Applicable Data Protection Laws in respect of such Processing as such; and (ii) not Process any relevant Customer Personal Data under that license in a form that directly identifies Customer and/or any relevant Data Subjects except to the extent required to de-identify or aggregate that Personal Data and/or comply with applicable law.

TECHNICAL AND ORGANIZATIONAL MEASURES; ASSISTANCE

Personnel. Butter shall take commercially reasonable steps designed to ascertain the reliability of any Butter Personnel who Process Customer Personal Data, and shall enter into written confidentiality agreements with all Butter Personnel who Process Customer Personal Data that are not subject to professional or statutory obligations of confidentiality.
Security. Butter shall implement and maintain technical and organizational measures in relation to Customer Personal Data designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access as described in Annex 4 (Security Measures) (the “Security Measures”).
Data Subject Rights. Butter, taking into account the nature of the Processing of Customer Personal Data, shall provide Customer with such assistance as may be reasonably necessary and technically feasible to assist Customer in fulfilling its obligations to respond to Data Subject Requests. If Butter receives a Data Subject Request, Customer will be responsible for responding to any such request. Butter shall: (a) promptly notify Customer if it receives a Data Subject Request; and (b) not respond to any Data Subject Request, other than to advise the Data Subject to submit the request to Customer, except as required by Applicable Data Protection Laws.
DPIAs and Consultations. If and to the extent the GDPR applies to the given Processing of Customer Personal Data, Butter shall, taking into account the nature of the Processing and the information available to it, provide reasonable assistance to Customer with any data protection impact assessments and prior consultations with Supervisory Authorities, which are required by Article 35 or Article 36 of the GDPR (as applicable), in each case solely in relation to such Processing of Customer Personal Data by Butter.

PERSONAL DATA BREACHES

Notifications. Butter shall notify Customer without undue delay upon Butter’s confirmation of a Personal Data Breach affecting Customer Personal Data. Butter shall provide Customer with information (insofar as such information is within Butter’s possession and knowledge and does not otherwise compromise the security of any Personal Data Processed by Butter) to allow Customer to meet its obligations under the Applicable Data Protection Laws to report the Personal Data Breach. Butter’s notification of or response to a Personal Data Breach shall not be construed as Butter’s acknowledgement of any fault or liability with respect to the Personal Data Breach. As between the Parties, unless and to the extent such Personal Data Breach affects any Personal Data Processed under Section 2.3, Customer is solely responsible for complying with applicable laws (including notification laws), and fulfilling any third-party notification obligations, related to any Personal Data Breaches.
Consultation with Butter. If Customer determines that a Personal Data Breach suffered by Butter or a Sub-Processor affecting Customer Personal Data must be notified to any Supervisory Authority, any other governmental authority, any Data Subject(s), the public or others under Applicable Data Protection Laws or otherwise, to the extent such notice directly or indirectly refers to or identifies Butter, where permitted by applicable laws, Customer agrees to: (a) notify Butter in advance; and (b) in good faith, consult with Butter and consider any clarifications or corrections Butter may reasonably recommend or request to any such notice, which: (i) relate to Butter’s involvement in or relevance to such Personal Data Breach; and (ii) are consistent with applicable laws.

SUB-PROCESSING

General authorization. Customer generally authorizes Butter to appoint Sub-Processors in accordance with this Section 5. Information about Butter’s Sub-Processors, including their functions and locations is as shown in Annex 2 (Authorized Sub-Processors) (the “Sub-Processor List”). Without limitation, Customer authorizes Butter engagement of the Sub-Processors listed on the Sub-Processor List as of the Addendum Effective Date.
Notification. Butter shall give Customer prior written notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken by the Sub-Processor by providing Customer with an updated copy of the Sub-Processor List via email sent to Customer’s contact point as set out in Annex 1 (Data Processing Details). If, within ten (10) days of receipt of that notice, Customer notifies Butter in writing of any objections to the proposed appointment (made in good faith based upon evidenced concerns that the use of that proposed Sub-Processor would cause Customer to be in material and unavoidable breach of Applicable Data Protection Laws): (a) Butter shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services, which avoids the use of that proposed Sub-Processor; and (b) where: (i) such a change cannot be made within thirty (30) days from Butter’s receipt of Customer’s notice; (ii) no commercially reasonable change is available; and/or (iii) Customer declines to bear the cost of the proposed change, then Butter may terminate the Agreement without liability to Customer beyond reimbursing any pre-paid fees on a pro-rated basis. If Customer does not object to Butter’s appointment of a Sub-Processor during the objection period referred to in this Section 5.2, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. If Customer does not object to Butter’s appointment of a Sub-Processor during the objection period referred to in this Section 5.2, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor.
Butter Responsibilities. With respect to each Sub-Processor, Butter shall maintain a written contract between Butter and the Sub-Processor that includes terms which offer at least an equivalent level of protection for Customer Personal Data as those set out in this DPA (including the Security Measures). Butter shall remain liable for any breach of this DPA caused by a Sub-Processor.

DATA TRANSFERS

Entry into SCCs. In respect of any Restricted Transfer of Customer Personal Data from Customer to Butter under this DPA: (a) that is an EU Restricted Transfer, the Parties hereby enter into and agree to comply with their respective obligations set out in the SCCs; and/or (b) that is a UK Restricted Transfer, the Parties hereby enter into and agree to comply with their respective obligations set out in the SCCs as varied by the UK Transfer Addendum.
Population of SCCs. In respect of any SCCs entered into pursuant to Section 6.1, the Parties agree as follows: (a) each of the Parties is hereby deemed to have signed the SCCs at the relevant signature block in Annex I to the Appendix to the SCCs; (b) as applicable: (i) Module Two of the SCCs applies to any relevant Restricted Transfer involving Processing of Customer Personal Data in respect of which Customer is a Controller in its own right; and (ii) Module Three of the SCCs applies to any relevant Restricted Transfer involving Processing of Customer Personal Data in respect of which Customer is itself a Processor; (c) as and where applicable to the relevant Module of the SCCs and the Clauses thereof: (i) in Clause 7: the ‘Docking Clause’ is not used; (ii) in Clause 9: ‘OPTION 2: GENERAL WRITTEN AUTHORISATION’ applies, and the minimum time period for advance notice of the addition or replacement of Sub-Processors shall be the advance notice period set out in Section 5.2; (iii) in Clause 11: the optional language is not used; (iv) in Clause 13: all square brackets are removed and all text therein is retained; (v) in Clause 17: ‘OPTION 1’ applies, and the Parties agree that the SCCs shall be governed by the law of: (A) Ireland in relation to any EU Restricted Transfer and (B) England and Wales in relation to any UK Restricted Transfer; and (vi) in Clause 18(b): the Parties agree that any dispute arising from the SCCs: (A) in relation to any EU Restricted Transfer, shall be resolved by the courts of Ireland; and (B) in relation to any UK Restricted Transfer, shall be resolved by the courts of England and Wales; and (d) in respect of the Annexes to the Appendix to the SCCs: (i) Annex I is populated with the corresponding information detailed in Annex 1 (Data Processing Details) to the DPA; and (ii) Annex II is populated with reference to the information contained in and determined by Section 3.2 of the DPA (including the Security Measures).
Population of UK Transfer Addendum. Where relevant in accordance with Section 6.1(b), the SCCs apply to any UK Restricted Transfers as varied by the UK Transfer Addendum in the following manner: (i) ’Part 1 to the UK Transfer Addendum’: (A) Tables 1, 2 and 3 to the UK Transfer Addendum are deemed populated with the corresponding details set out in Annex 1 (Data Processing Details) to the DPA and Section 6.2; and (B) Table 4 to the UK Transfer Addendum is completed by the box labelled ‘Data Importer’ being deemed to have been ticked; and (ii) ‘Part 2 to the UK Transfer Addendum’: the Parties agree to be bound by the UK Mandatory Clauses and that the SCCs shall apply to any UK Restricted Transfers as varied in accordance with those Mandatory Clauses.
Operational Clarifications. In relation to any SCCs entered into pursuant to Section 6.1, the Parties agree as follows: (a) when complying with its transparency obligations under Clause 8.3 of the SCCs, Customer shall not provide or otherwise make available, and shall take all appropriate steps to protect, Butter’s and its licensors’ trade secrets, business secrets, confidential information and/or other commercially sensitive information; (b) where applicable, for the purposes of Clause 10(a) of Module Three of the SCCs, Customer acknowledges and agrees that there are no circumstances in which it would be appropriate for Butter to notify any third-party Controller of any Data Subject Request and that any such notification shall be the sole responsibility of Customer; (c) for the purposes of Clause 15.1(a) of the SCCs, except to the extent prohibited by applicable law and/or the relevant public authority, as between the Parties, Customer agrees that it shall be solely responsible for making any notifications to relevant Data Subject(s) if and as required; (d) the terms and conditions of Section 5 apply in relation to Butter’s appointment and use of Sub-Processors under the SCCs; (d) any approval by Customer of Butter’s appointment of a Sub-Processor that is given expressly or deemed given pursuant to Section 5 constitutes Customer’s documented instructions to effect disclosures and onward transfers to any relevant Sub-Processors if and as required under Clause 8.8 of the SCCs; (e) the audits described in Clauses 8.9(c) and 8.9(d) of the SCCs shall be subject to any relevant terms and conditions detailed in Section 6; (f) certification of deletion of Customer Personal Data as described in Clauses 8.5 and 16(d) of the SCCs shall be provided only upon Customer’s written request; (g) in relation to any UK Restricted Transfer to which they apply, where the context permits and requires, any reference in the DPA to the SCCs, shall be read as a reference to those SCCs as varied by Section 6.3; and (h) in respect of any given Restricted Transfer, if requested of Customer by a Supervisory Authority, Data Subject or further Controller (where applicable) – on specific written request; accompanied by suitable supporting evidence of the relevant request – Butter shall provide Customer with an executed version of the relevant set(s) of SCCs responsive to the request made of Customer (amended and populated in accordance with relevant provisions of this DPA in respect of the relevant Restricted Transfer) for countersignature by Customer, onward provision to the relevant requestor and/or storage to evidence Customer’s compliance with Applicable Data Protection Laws.

AUDITS

Information provision and audits. Butter shall make available to Customer on reasonable request, such information as Butter (acting reasonably) considers appropriate in the circumstances to demonstrate its compliance with this DPA. Subject to Sections 7.2 to 7.4, in the event that Customer (acting reasonably) is able to provide documentary evidence that such information is not sufficient in the circumstances to demonstrate Butter’s compliance with this DPA, Butter shall allow for and contribute to audits by Customer or an auditor mandated by Customer in relation to the Processing of Customer Personal Data by Butter.
Customer responsibilities. Customer shall give Butter reasonable notice of any audit to be conducted under Section 7.1 (which shall in no event be less than fourteen (14) days’ notice, unless a shorter notice period is specifically required under Applicable Data Protection Laws relevant to the audit concerned) and shall use its best efforts (and ensure that each of its mandated auditors uses its best efforts) to avoid causing any destruction, damage, injury or disruption to Butter’s premises, equipment, Personnel, data, and business (including any interference with the confidentiality or security of the data of Butter’s other customers or the availability of Butter’s services to such other customers).
Audit plans. Prior to conducting any audit, Customer must submit a detailed proposed audit plan providing for the confidential treatment of all information exchanged in connection with the audit and any reports regarding the results or findings thereof. The proposed audit plan must describe the proposed scope, duration, and start date of the audit. Butter will review the proposed audit plan and provide Customer with any feedback, concerns or questions (for example, any request for information that could compromise Butter security, privacy, employment or other relevant policies). Butter will work cooperatively with Customer to agree on a final audit plan.
Limitations. Butter need not give access to its premises for the purposes of any audit under this Section 7: (a) where a third-party audit report or certification (e.g., SOC 2 Type 2, ISO 2700x, NIST or similar audit report or certification) is provided in lieu of such access (acceptance of which for this purpose not to be unreasonably withheld, delayed or conditioned by Customer); (b) to any individual unless they produce reasonable evidence of their identity; (c) to any auditor whom Butter has not approved in advance (acting reasonably); (d) to any individual who has not entered into a non-disclosure agreement with Butter on terms acceptable to Butter (acting reasonably); (e) outside normal business hours at those premises; or (f) on more than one occasion in any calendar year during the term of the Agreement, except for any audits which Customer is required to carry out under Applicable Data Protection Laws or by a Supervisory Authority. Nothing in this DPA shall require Butter to furnish more information about its Sub-Processors in connection with such audits than such Sub-Processors make generally available to their customers. Nothing in this Section 7 shall be construed to obligate Butter to breach any duty of confidentiality.

RETURN AND DELETION

General. Upon expiration or earlier termination of the Agreement, Butter shall return and/or delete all Customer Personal Data in Butter’s care, custody or control in accordance with Customer’s instructions as to the post-termination return and deletion of Customer Personal Data expressed in the Agreement. To the extent that deletion of any Customer Personal Data contained in any back-ups’ maintained by or on behalf of Butter is not technically feasible within the timeframe set out in Customer’s instructions, Butter shall (a) securely delete such Customer Personal Data in accordance with any relevant scheduled back-up deletion routines (e.g., those contained within Butter’s relevant business continuity and disaster recovery procedures); and (b) pending such deletion, put such Customer Personal Data beyond use.
Permitted retention. Notwithstanding the foregoing, Butter may retain Customer Personal Data where required by applicable laws, provided that Butter shall (a) maintain the confidentiality of all such Customer Personal Data and (b) Process the Customer Personal Data only as necessary for the purpose(s) and duration specified in the applicable law requiring such retention. Without limitation to the deletion and return obligations relating to Customer Personal Data set out in Section 8.1, Butter may retain and continue to freely use any information derived from Customer Personal Data that has been anonymized, or otherwise deidentified and/or aggregated (such that it no longer directly identifies any given Data Subject, Customer and/or Customer’s customers and users), as part of the Processing set out in Section 2.3.

CUSTOMER’S RESPONSIBILITIES

Security. Customer agrees that, without limiting Butter’s obligations under Section 5 (Security), Customer is solely responsible for its use of the Services, including (a) making appropriate use of the Services to maintain a level of security appropriate to the risk in respect of the Customer Personal Data; (b) securing the account authentication credentials, systems and devices Customer uses to access the Services; (c) securing Customer’s systems and devices that Butter uses to provide the Services; and (d) backing up Customer Personal Data.
Compliance. Customer shall ensure: (a) that there is, and will be throughout the term of the Agreement, a valid legal basis for the Processing by Butter of Customer Personal Data in accordance with this DPA and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing) for the purposes of all Applicable Data Protection Laws (including Article 6, Article 9(2) and/or Article 10 of the GDPR (where applicable)); and (b) that all Data Subjects have (i) been presented with all required notices and statements (including as required by Article 12-14 of the GDPR (where applicable)); and (ii) provided all required consents, in each case (i) and (ii) relating to the Processing by Butter of Customer Personal Data.
Restricted Data. Customer shall not provide or otherwise make available to Butter any Customer Personal Data that contains any (a) Social Security numbers or other government-issued identification numbers; (b) protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA) or other information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; (c) health insurance information; (d) biometric information; (e) passwords to any online accounts; (f) credentials to any financial accounts; (g) tax return data; (h) Personal Data of children under 13 years of age; or (i) any other information that falls within any special categories of personal data (as defined in GDPR) and/or data relating to criminal convictions and offences or related security measures (together, “Restricted Data”).

VARIOUS

Incorporation and Application. This DPA shall be incorporated into and form part of the Agreement with effect on and from the Addendum Effective Date. Except as set out in Section 2.3: (a) this DPA applies only if and to the extent Applicable Data Protection Laws govern Butter’s Processing of Customer Personal Data in performance of the Service(s) as a ‘processor’, ‘service provider’ or similar role defined under Applicable Data Protection Laws; and (b) accordingly, this DPA does not apply to Butter’s Processing of any Personal Data for its own business/customer relationship administration purposes, its own marketing or service analytics, its own information and systems security purposes supporting the operation of the Services, nor its own legal, regulatory or compliance purposes.
State Privacy Laws. Annex 3 (State Privacy Laws Annex) applies if and to the extent Butter’s Processing of Customer Personal Data on behalf of Customer under the Agreement is subject to any of the State Privacy Laws.
Costs. Except to the extent prohibited by Applicable Data Protection Laws, Customer shall compensate Butter at Butter’s then-current professional services rates for, and reimburse any costs reasonably incurred by Butter in the course of providing, cooperation, information, or assistance requested by Customer pursuant to Sections 3.3 (Data Subject Rights), 3.4 (DPIAs and Consultations) and 7 (Audits) of this DPA (provided that Butter shall bear its own costs in the event that any audit or inspection conducted in accordance with that Section 7 reveals any material non-compliance by Butter with this DPA and/or Applicable Data Protection Laws), in each case, beyond providing self-service features included as part of, or in connection with, the Services.
LIABILITY. THE TOTAL AGGREGATE LIABILITY OF EITHER PARTY TOWARDS THE OTHER PARTY, HOWSOEVER ARISING, UNDER OR IN CONNECTION WITH THIS DPA AND THE SCCS (IF AND AS THEY APPLY) WILL UNDER NO CIRCUMSTANCES EXCEED ANY LIMITATIONS OR CAPS ON, AND SHALL BE SUBJECT TO ANY EXCLUSIONS OF, LIABILITY AND LOSS AGREED BY THE PARTIES IN THE AGREEMENT; PROVIDED THAT, NOTHING IN THIS SECTION 10.4 WILL AFFECT ANY PERSON’S LIABILITY TO DATA SUBJECTS UNDER THE THIRD-PARTY BENEFICIARY PROVISIONS OF THE SCCS (IF AND AS THEY APPLY).
Required Updates. Each Party shall act in good faith to agree variations to this DPA that are reasonably necessary to address the requirements of Applicable Data Protection Laws from time to time (including to apply a new transfer mechanism to comply with relevant requirements of the GDPR).
Prevail. This DPA shall be incorporated into and form part of the Agreement with effect on and from the Addendum Effective Date. In the event of any conflict or inconsistency between: (a) this DPA and the Agreement, this DPA shall prevail; or (b) any SCCs entered into pursuant to Section 6 and this DPA and/or the Agreement, the SCCs shall prevail in respect of the Restricted Transfer to which they apply.

Annex 1

Data Processing Details

BUTTER / ‘DATA IMPORTER’ DETAILS

Name:	Butter Payments, Inc., a U.S. corporation
Address:	As set out in the pre-amble to the DPA
Contact Details for Data Protection:	Role: CEO Email: vijay@butter.com
Butter Activities:	Butter is a provider of a payments technology platform.
Role:	Processor

CUSTOMER / ‘DATA EXPORTER’ DETAILS

Name:	The entity or other person who is a counterparty to the Agreement
Address:	Customer’s address is: the address shown in the Agreement entered into by and between the Customer and Butter; or if the Agreement does not include the address, the Customer’s principal business trading address unless otherwise notified to legal@butterpayments.com and/or finance@butterpayments.com
Contact Details for Data Protection:	Customer’s contact details are: the contact details shown in the Agreement; or if the Agreement does not include the contact details, Customer’s contact details submitted by Customer and associated with Customers account for the Services – unless otherwise notified to legal@butterpayments.com and/or finance@butterpayments.com
Customer Activities:	Customer’s activities relevant to this DPA are the use and receipt of the Services under and in accordance with, and for the purposes anticipated and permitted in, the Agreement as part of its ongoing business operations.
Role:	Controller – in respect of any Processing of Customer Personal Data in respect of which Customer is a Controller in its own right; and Processor – in respect of any Processing of Customer Personal Data in respect of which Customer is itself acting as a Processor on behalf of any other person (including, where applicable, its affiliates or Customer’s own customers for whom Customer is a Processor).

DETAILS OF PROCESSING

Categories of Data Subjects:	Relevant Data Subjects include any Data Subjects that Customer causes Butter to process as part of the provisions of the Service, including Customer’s own customers and users. If any category of data subject listed here is a business or organization, it includes reference to their Personnel.
Categories of Personal Data:	Relevant Personal Data includes any Categories of Data Customer causes Butter to process as part of the provisions of the Service, including: Payment and transaction details – information relating to Data Subjects’ financial transactions, including tokenized payment card information, billing zip codes, and transaction amounts, timestamps, and status.‍ Customer identifiers – unique identifiers or pseudonymous identifiers created by Customer and associated with Data Subjects.
Sensitive Categories of Data, and associated additional restrictions/safeguards:	Categories of sensitive data: None – as noted in Section 9.3 of the DPA, Customer agrees that Restricted Data, which includes ‘sensitive data’ (as defined in Clause 8.7 of the SCCs) must not be submitted to the Services. Additional safeguards for sensitive data: N/A
Frequency of transfer:	Ongoing – as initiated by Customer in and through its use, or use on its behalf, of the Services.
Nature of the Processing:	Processing operations required in order to provide the Services in accordance with the Agreement.
Purpose of the Processing:	Customer Personal Data will be Processed: (i) as necessary to provide the Services as initiated by Customer in its use thereof, and (ii) to comply with any other reasonable instructions provided by Customer in accordance with the terms of this DPA.
Duration of Processing / Retention Period:	For the period determined in accordance with the Agreement and DPA, including Section 8 of the DPA.
Transfers to (sub-)processors:	Transfers to Sub-Processors are as, and for the purposes, described from time to time in the Sub-Processor List.
Competent Supervisory Authority:	EU Restricted Transfers: with respect to the SCCs applicable to EU Restricted Transfers: (i) where Customer is established in an EEA Member State: the competent Supervisory Authority shall be the Supervisory Authority of that EEA Member State in which Customer is established; or (ii) where Customer is not established in an EEA Member State: the competent Supervisory Authority shall be the Supervisory Authority of the EEA Member State in which Customer’s Representative for the EU GDPR is based (from time to time), which Customer must notify to Butter in writing.‍ UK Restricted Transfers: with respect to the SCCs applicable to UK Restricted Transfers, the UK Information Commissioner’s Office.

Annex 2

Authorized Sub-Processors

Sub-Processor	Address	Contact person name, position, contact information	Description of processing	Location
Amazon Web Services, Inc.	410 Terry Avenue North, Seattle, WA 98109	Phone: 206-266-7010	https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf	USA
Snowflake	Suite 3A, 106 East Babcock Street, Bozeman, Montana 59715	Phone:	https://www.snowflake.com/legal/data-processing-addendum/	USA

Annex 3

State Privacy Laws Annex

In this Annex 3, the terms “business,” “business purpose,” “commercial purpose,” “consumer,” “sell,” “share,” and “service provider” shall have the respective meanings given thereto in the CCPA; and “personal information” shall mean Customer Personal Data that constitutes “personal information” as defined in and that is subject to the State Privacy Laws.

The business purposes and services for which Butter is Processing personal information are for Butter to provide the Services to and on behalf of Customer as set forth in the Agreement, as described in more detail in Annex 1 (Data Processing Details) to the DPA.
It is the Parties’ intent that with respect to any personal information, Butter is a service provider. Butter (a) acknowledges that personal information is disclosed by Customer only for limited and specific purposes described in the Agreement; (b) shall comply with applicable obligations under the State Privacy Laws and shall provide the same level of privacy protection to personal information as is required by the State Privacy Laws; (c) agrees that Customer has the right to take reasonable and appropriate steps under and subject to Section 7 (Audits) of the DPA to help ensure that Butter’s use of personal information is consistent with Customer’s obligations under the State Privacy Laws; (d) shall notify Customer in writing of any determination made by Butter that it can no longer meet its obligations under the State Privacy Laws; and (e) agrees that Customer has the right, upon notice, including pursuant to the preceding clause, to take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.
Butter shall not (a) sell or share any personal information; (b) retain, use or disclose any personal information for any purpose other than for the business purposes specified in the Agreement, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purpose specified in the Agreement, or as otherwise permitted by State Privacy Laws; (c) retain, use or disclose the personal information outside of the direct business relationship between Butter and Customer; or (d) combine personal information received pursuant to the Agreement with personal information (i) received from or on behalf of another person, or (ii) collected from Butter’s own interaction with any consumer to whom such personal information pertains except as and to the extent necessary as part of Butter’s provision of the Services.
Butter shall implement reasonable security procedures and practices appropriate to the nature of the personal information received from, or on behalf of, Customer, in accordance with Section 3.2 (Security Measures) of the DPA.
When Butter engages any Sub-Processor, Butter shall notify Customer of such Sub-Processor engagements in accordance with Section 5 (Sub-Processing) of the DPA and that such notice shall satisfy Butter’s obligation under the State Privacy Laws to give notice of and an opportunity to object to such engagements.
Butter agrees that Customer may conduct audits, in accordance with Section 7 of the DPA, to help ensure that Butter’s use of personal information is consistent with Butter’s obligations under the State Privacy Laws.
The parties acknowledge that Butter’s retention, use and disclosure of personal information by Customer’s instructions documented in the Agreement and DPA are integral to Butter’s provision of the Services and the business relationship between the Parties.

The Parties acknowledge that Butter’s Processing of Customer Personal Data authorized by Customer under this DPA is integral to the Services and the business relationship between the Parties.

Annex 4

Security Measures

As from the Addendum Effective Date, Butter will implement and maintain the Security Measures as set out in this Annex 4.

Technical and Organizational Security Measure	Details
Measures of pseudonymization and encryption of personal data	Sensitive customer data is encrypted at rest and in transit over public networks.
Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services	All central databases are redundant. Production access to cluster is restricted behind VPN. The majority of service to service requests happen over a private network.
Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident	Butter performs regular data backups and periodically tests its disaster recovery process.
Processes for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures in order to ensure the security of the processing	Butter conducts regular penetration testing on all public-facing endpoints within scope. These tests are carried out by certified auditors and are designed to identify any vulnerabilities that could be exploited by attackers. In addition, Butter is SOC 2 Type 2 compliant.
Measures for user identification and authorization	Multi-Factor Authentication is required for Amazon Web Services and Google Workspace. Access reviews are conducted in compliance with SOC 2.
Measures for the protection of data during transmission	Data is encrypted in transit over any publicly available network.
Measures for the protection of data during storage	Sensitive customer data is encrypted at rest
Measures for ensuring events logging	Butter logs events using DataDog.
Measures for ensuring system configuration, including default configuration	Butter utilizes Amazon Web Services managed EKS and prioritize using managed services where applicable. Butter checks for system configurations that are out of SOC 2 Compliance using SecureFrame.
Measures for internal IT and IT security governance and management	Butter employs security engineers and works with a variety of Butters and auditors to maintain compliance and security initiatives.
Measures for certification/assurance of processes and products	SOC 2 Type 2
Measures for ensuring data minimization	Sensitive data is limited in production systems and only used where necessary to maintain the integrity of the messages transmitted to Butter.
Measures for ensuring data quality	Butter uses a variety of tools and processes to monitor its systems for potential security incidents or violations, including regular jobs that check for known quality control issues. If any issues are detected, Butter’s team is notified right away, allowing Butter to take immediate action to address the problem and prevent any further damage.
Measures for ensuring limited data retention	Data is retained in production queues for a maximum of 7 days.
Measures for ensuring accountability	Security training is performed annually and at hire.
Measures for allowing data portability and ensuring erasure	Butter enables its customers to trace sensitive data back to such customer’s accounts and request erasure if necessary.
Technical and organizational measures of Sub-Processors	Critical Butter’s compliance programs are reviewed regularly.

Butter may update or modify these Security Measures from time to time provided that such updates and modifications do not decrease the overall security of Customer Personal Data.