Data Processing Addendum

Effective date: October 7, 2026 · Version 1.5

Terms governing ScaleIQ’s processing of personal data on your behalf, including TDPSA and CCPA/CPRA obligations.

This Data Processing Addendum (“DPA”) forms part of the agreement between ScaleIQ LLC and Customer when ScaleIQ processes personal data on Customer’s behalf. This DPA is governed by the laws of the State of Texas and the applicable US federal and state data protection laws identified below. ScaleIQ operates with USA-only sales; if EU or UK residents access the Service, supplementary transfer mechanisms apply as described in Section 9.

1. Roles

For Customer Data containing personal data, Customer is the controller (or a processor acting on a third party’s instructions) and ScaleIQ is the processor (or sub-processor). Each party complies with applicable Data Protection Laws, including the Texas Data Privacy and Security Act (TDPSA, Tex. Bus. & Com. Code §§ 541.001–541.203), the Texas Identity Theft Enforcement and Protection Act (Tex. Bus. & Com. Code §§ 521.001–521.053), the California Consumer Privacy Act (CCPA/CPRA, for California-resident customers), and, where applicable, the EU GDPR and UK GDPR.

2. Scope & purpose — Annex I

Annex I-A — Tenant-connected products (Schedule B)

The following data processing details apply inline (Annex I-A):

• Subject matter: processing of personal data to provide the Service.
• Nature and purpose: reading Microsoft 365 tenant metadata under administrator consent, and hosting, processing, and generating assessment results to operate, secure, and support the Service per Customer’s instructions.
• Data subjects: Customer’s authorized users and personnel whose metadata appears in the tenant signals assessed.
• Categories of personal data: identifiers (name, email, user ID), professional information (job title, department, role), configuration and usage metadata (Microsoft 365 policy settings, sharing configurations, adoption signals), and system-generated metadata (timestamps, audit events, assessment scores). Customer should not submit special-category data (biometric, health, financial, racial/ethnic origin, religious or political beliefs, sexual orientation, or data of known children) unless agreed in a written addendum.
• Processing purpose: AI readiness assessment, scoring, remediation guidance, and platform operations.
• Duration: for the term of the subscription agreement, plus any post-termination period required for data return or deletion.
• Two-tier data architecture: Customer Data generated through AI-Assisted Assessments is subject to a two-tier retention structure. Tier A (Active Assessment Data) is retained for 24 months from delivery of the applicable Report of Findings and is deletable on Customer’s request. Tier B (WORM Evidence Blobs) — the documents submitted for an assessment, dated SHA-256-hashed snapshots of the URLs Customer authorizes us to review, and the digitally signed record of each completed assessment (inputs, model version, and outputs) — are retained for seven (7) years in immutable WORM storage as a contractual security and evidentiary integrity control and generally cannot be deleted during that period, subject to the limited erasure path in Section 10. See Section 10 and our Data Retention & Deletion Policy for full detail.

Annex I-B — ComplyIQ (Schedule A)

3. Customer instructions

ScaleIQ processes personal data only on documented instructions from Customer, including the Agreement, this DPA, and Customer’s configurations and consent within the Service.

4. Confidentiality & security

Personnel authorized to process personal data are bound by confidentiality. ScaleIQ implements the technical and organizational measures in Annex II and the Security Overview, appropriate to the risk. ScaleIQ maintains reasonable security procedures and practices appropriate to the nature of the personal information, as required by Tex. Bus. & Com. Code § 521.052, including encryption of sensitive personal information during transmission and in storage.

5. Sub-processors

Customer authorizes ScaleIQ to engage the sub-processors listed at /legal/subprocessors. ScaleIQ gives at least 30 days’ notice of additions or replacements via that page, imposes data-protection obligations no less protective than this DPA, and remains liable for sub-processors’ acts and omissions (TDPSA § 541.106).

6. Data subject rights & breach notification

ScaleIQ provides functionality enabling Customer to respond to data-subject requests and will forward any request received directly.

72-Hour GDPR Notification: ScaleIQ will notify Customer without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting Customer Data (GDPR Art. 33).

Texas Breach Notification (Tex. Bus. & Com. Code § 521.053): In the event of a Security Incident involving personal data of Texas residents, ScaleIQ will: (a) notify affected Texas residents without unreasonable delay; (b) if the breach affects more than two hundred fifty (250) Texas residents, notify the Texas Attorney General no later than thirty (30) days after discovery of the breach; and (c) provide notification to Customer within 48 hours of discovery to enable Customer’s independent notification obligations.

7. Data Protection Assessments

ScaleIQ conducts and maintains written Data Protection Assessments for processing activities that present a heightened risk of harm to data subjects, including processing of sensitive personal data, processing for targeted advertising, and processing for profiling, as required by Tex. Bus. & Com. Code § 541.105. Assessments are available to Customer for review upon written request submitted to trust@scale-iq.ai.

8. Audits & assurance

ScaleIQ makes available the information necessary to demonstrate compliance with this DPA. Security assurance documentation, including information on technical and organizational measures, is available to customers under NDA upon written request to trust@scale-iq.ai. Where information is insufficient and Customer has a documented basis, the parties will agree on the scope and timing of an audit, no more than once per year except following a breach or as required by a regulator.

9. International transfers

ScaleIQ’s operations are USA-based. Where Customer Data is transferred from the EEA, UK, or Switzerland to the United States, the parties incorporate by reference the EU Standard Contractual Clauses (Module 2 or 3), the UK IDTA, and equivalent mechanisms as applicable. Swiss (FADP) clauses are reserved for customers with Swiss-resident data subjects; they are not applicable to USA-only sales.

10. Return or deletion

On termination, ScaleIQ returns or deletes Active Assessment Data per the Retention Policy. Customer can export data for at least 30 days following termination. At Customer’s written request, ScaleIQ will delete Active Assessment Data and certify deletion in writing within thirty (30) days; on termination, ScaleIQ will certify deletion of Active Assessment Data within ninety (90) days.

WORM Evidence Blob exception: WORM Evidence Blobs (the documents submitted for an assessment, dated SHA-256-hashed snapshots of the URLs Customer authorizes us to review, and the digitally signed record of each completed assessment (inputs, model version, and outputs)) are retained for seven (7) years from the date of capture as a contractual security and evidentiary integrity control, regardless of termination. This retention is implemented to preserve evidentiary integrity, auditability, and non-repudiation of assessment results and is not intended to supersede any non-waivable legal rights except to the extent required by applicable law. Any deletion certification issued upon termination expressly excludes WORM Evidence Blobs during the 7-year WORM Retention Period. ScaleIQ will provide Customer with a written schedule of WORM Evidence Blobs retained for Customer’s account upon request.

Limited erasure path. Nothing in this Section 10 limits any non-waivable right of a data subject or of Customer under applicable data protection law. Where applicable law requires erasure of Personal Data contained in a WORM Evidence Blob and no statutory exemption applies, ScaleIQ will (i) notify Customer without undue delay, (ii) restrict all processing of the affected blob other than storage, (iii) apply cryptographic erasure of the associated encryption keys where technically available, and (iv) purge the blob at the earliest point permitted by the immutability configuration. ScaleIQ will document each such instance in writing.

Access to WORM Evidence Blobs. ScaleIQ will not access the contents of WORM Evidence Blobs for any purpose other than (i) complying with applicable law, valid legal process, or a court order, or (ii) responding to a Customer request for a schedule of retained WORM Evidence Blobs. Automated integrity verification, storage-platform maintenance, and backup operations that do not involve human review of blob contents are not “access” for purposes of this subsection.

Annex II — Technical & organizational measures

• Encryption: in transit (TLS 1.2+) and at rest (AES-256) using Azure Key Vault-managed keys. Sensitive personal information is encrypted in transmission and storage per Tex. Bus. & Com. Code § 521.052.
• Access control: Microsoft Entra ID, SSO, MFA, role-based access, least-privilege, quarterly access reviews; Microsoft Entra authentication with API keys disabled; least-privilege service identities.
• Tenant-scoped access: Customer Data is logically separated per tenant; access is scoped at the application and database layers; AI inference is request-scoped and not pooled across customers. This is our design intent; ScaleIQ does not represent tenant isolation as an independently validated fact.
• Application security: secure SDLC, mandatory code review, static and dependency scanning on every build.
• WORM evidence storage: WORM Evidence Blobs are held in segregated Azure Blob Storage under a locked seven-year write-once, read-many immutability policy, separate from Active Assessment Data in Azure SQL.
• Monitoring: Azure Monitor / Application Insights, centralized logging, anomaly detection, on-call response.
• Resilience: daily encrypted backups, tested restoration, defined RTO (4 hours) / RPO (1 hour).
• Incident response: documented playbook, post-incident review, customer notification per Section 6.

Contact

To execute a signed DPA, email trust@scale-iq.ai or write to:
ScaleIQ, LLC · 240 W Galveston St, #1828, League City, Texas 77573