Data Processing Addendum

Capitalized terms not defined here have the meanings given in the Agreement.

• Applicable Data Protection Laws means the privacy, data protection and data security laws that apply to BUFI's Processing of Customer Personal Data under the Agreement, including, where applicable, the GDPR, the FADP, the State Privacy Laws, Brazil's LGPD, Argentina's Law 25,326 and Mexico's Federal Law on the Protection of Personal Data Held by Private Parties.
• Controller and Processor have the meanings given in Applicable Data Protection Laws, and include a "business" and a "service provider" or "contractor" under the CCPA and other State Privacy Laws.
• Customer Personal Data means personal data that Customer or its users provide to, or connect with, the Service for BUFI to Process on Customer's behalf, such as data about Customer's employees, contractors, payees, customers, vendors and the people named in documents Customer uploads. It does not include personal data BUFI processes as an independent controller (Section 3).
• Data Subject means the identified or identifiable natural person to whom personal data relates.
• FADP means the Swiss Federal Act on Data Protection, as amended.
• GDPR means, as applicable, Regulation (EU) 2016/679 (the "EU GDPR") and the EU GDPR as it forms part of UK law (the "UK GDPR"), with any national implementing legislation.
• Information Security Incident means a breach of BUFI's security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in BUFI's possession, custody or control. It does not include unsuccessful attempts that do not compromise security, such as failed log-in attempts, pings, port scans or denial-of-service attacks.
• Process means any operation performed on personal data, whether or not by automated means.
• Restricted Transfer means a transfer of Customer Personal Data from the EEA, the United Kingdom or Switzerland to a country that does not benefit from an adequacy decision under the law of the exporting jurisdiction.
• SCCs means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• State Privacy Laws means the comprehensive US state privacy laws and regulations that apply to BUFI's Processing of Customer Personal Data.
• Subprocessor means a third party BUFI engages to Process Customer Personal Data.
• UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0), as revised.

This DPA applies to BUFI's Processing of Customer Personal Data in providing the Service and remains in effect for as long as BUFI Processes Customer Personal Data, even after the Agreement ends.

For Customer Personal Data, Customer is the Controller (or a Processor acting for another controller) and BUFI is a Processor (or Subprocessor). The details of the Processing are set out in Annex 1.

BUFI acts as an independent controller, not as Customer's Processor, when it determines the purposes of Processing for its own account, including: operating user accounts and sign-in; identity verification, sanctions screening, fraud prevention and other legal and regulatory compliance; account security; billing; and analytics and product improvement as described in the Privacy Policy. That Processing is governed by the Privacy Policy and Applicable Data Protection Laws, not by this DPA.

Some BUFI partners, such as wallet and stablecoin providers, identity-verification providers, card issuers and on/off-ramp providers, act as independent controllers of the data they collect to meet their own legal obligations.

BUFI will Process Customer Personal Data only on Customer's documented instructions, including those in the Agreement, this DPA and Customer's use and configuration of the Service, unless applicable law requires otherwise; in that case BUFI will inform Customer of that legal requirement before Processing unless the law prohibits it. Customer instructs BUFI to Process Customer Personal Data to provide the Service and to perform its obligations and exercise its rights under the Agreement.

BUFI will inform Customer if, in its reasonable opinion, an instruction infringes Applicable Data Protection Laws. Instructions outside the scope of the Service require a written agreement between the parties.

BUFI will implement and maintain technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, as described in Annex 2 (the "Security Measures"), taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of Processing and the risks to Data Subjects. BUFI may update the Security Measures provided the update does not materially decrease the overall protection of Customer Personal Data.

BUFI will ensure that personnel authorized to Process Customer Personal Data are bound by appropriate confidentiality obligations.

Customer is responsible for its use of the Service, including choosing appropriate roles, signers and approval thresholds, securing its users' sign-in methods and devices, and removing access for people who leave.

BUFI will notify Customer without undue delay after becoming aware of an Information Security Incident. The notice will describe, to the extent then known, the nature of the incident, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. BUFI will provide further information as it becomes available and will reasonably cooperate with Customer's investigation.

Customer is responsible for notifications it is required to make to Supervisory Authorities, Data Subjects or others. Where such a notification refers to BUFI, Customer will, where legally permitted, consult BUFI in advance in good faith. BUFI's notification of or response to an incident is not an acknowledgement of fault or liability.

Taking into account the nature of the Processing, BUFI will provide Customer with reasonable assistance, through the Service's features or otherwise, to respond to requests from Data Subjects to exercise their rights. If BUFI receives such a request about Customer Personal Data, BUFI will promptly forward it to Customer, unless the law prohibits it, and will not respond except to direct the Data Subject to Customer.

BUFI will provide reasonable assistance with Customer's data protection impact assessments and prior consultations with Supervisory Authorities, to the extent required by Applicable Data Protection Laws and relating to BUFI's Processing. Assistance beyond the Service's normal features may be charged at reasonable rates agreed in advance.

Customer is responsible for:

• having a valid legal basis under Applicable Data Protection Laws for the Processing of Customer Personal Data by BUFI, including, where applicable, under Articles 6, 9 and 10 of the GDPR;
• giving Data Subjects all required notices and obtaining any required consents for that Processing;
• the accuracy of Customer Personal Data and the lawfulness of the instructions it gives.

The Service is designed to process the financial, payment, payroll, tax and identity information that business finance requires, including tax identifiers and bank account details. Customer must not upload health information, special categories of personal data (other than as strictly required for payroll or legal compliance) or data about children under 16, unless the parties agree in writing.

Customer gives BUFI general authorization to engage Subprocessors. The Subprocessors engaged at the effective date of this DPA are listed in Annex 3.

BUFI will enter into a written agreement with each Subprocessor that imposes data protection obligations no less protective than those in this DPA, to the extent applicable to the nature of the services provided. BUFI remains responsible for its Subprocessors' performance of those obligations.

BUFI will notify Customer of any new Subprocessor at least 15 days before it begins Processing Customer Personal Data, by updating Annex 3 and by email to Customer's workspace owner or another designated contact. Customer may object on reasonable data protection grounds within that period. The parties will try in good faith to resolve the objection; if they cannot, Customer may terminate the affected part of the Service as its sole remedy, without penalty, and BUFI will refund any prepaid fees for the terminated period.

BUFI will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA. Customer may audit BUFI's compliance once per year, and more often where required by a Supervisory Authority or Applicable Data Protection Laws, on at least 30 days' written notice with a proposed audit plan describing scope, duration and start date.

Audits will be conducted during business hours, under confidentiality obligations, in a way that does not unreasonably interfere with BUFI's operations or compromise the security or confidentiality of other customers' data. Where a current independent audit report or certification covers the requested controls, Customer will first rely on that report. Each party bears its own audit costs, unless the audit reveals a material breach of this DPA by BUFI.

When the Service ends, BUFI will stop Processing Customer Personal Data except as needed to return or delete it or as required by law. Within 30 days after the end of the Service, Customer may request a copy of Customer Personal Data in a commonly used format, to the extent available through the Service's export features. After that period, BUFI will delete or anonymize Customer Personal Data within a commercially reasonable time, and data in backups when those backups expire.

BUFI may retain Customer Personal Data where the law requires it, including financial, tax and anti-money-laundering records, for no longer than required, while keeping it confidential, protecting it under the Security Measures and Processing it only for the purpose of that retention. Data recorded on a public blockchain cannot be deleted. On written request, BUFI will confirm deletion in writing.

BUFI will not use Customer Personal Data to train, fine-tune or develop general-purpose artificial intelligence or machine learning models, its own or a third party's, unless Customer expressly authorizes it in writing.

BUFI uses AI model providers as Subprocessors to provide AI features of the Service, such as the assistant, document reading and drafting. BUFI will contractually require those providers not to use Customer Personal Data to train their general-purpose models. Providers may retain data for service delivery, security or abuse monitoring under their agreements with BUFI.

If the Service involves automated decision-making that produces legal or similarly significant effects on Data Subjects, BUFI will disclose it to Customer, provide meaningful information about the logic involved to the extent reasonably available without disclosing trade secrets, and reasonably cooperate so Data Subjects can exercise their related rights.

BUFI and most Subprocessors Process Customer Personal Data in the United States and other countries where they operate. To the extent Processing involves a Restricted Transfer from Customer to BUFI:

• EEA. The SCCs are incorporated into this DPA and are deemed signed by the parties. Module Two applies where Customer is a controller and Module Three where Customer is a processor. In Clause 7, the docking clause is not used. In Clause 9, Option 2 (general written authorization) applies, with the 15-day notice period in Section 9. In Clause 11, the optional language is not used. In Clause 13, all square brackets are removed and the text retained. In Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland. In Clause 18, disputes are resolved by the courts of Ireland. Annex I of the SCCs is populated with Annex 1 of this DPA (Customer as data exporter, BUFI as data importer), and Annex II with Annex 2. The competent supervisory authority is that of the EU Member State where Customer is established, or where its Article 27 representative is located, or, if neither, the Member State Customer notifies to BUFI in which the relevant Data Subjects are located.
• United Kingdom. The SCCs apply as varied by the UK Addendum. Tables 1 to 3 of the UK Addendum are populated with the information in this DPA, in Table 4 the importer may end the UK Addendum, and the parties are bound by its Mandatory Clauses.
• Switzerland. The SCCs apply with references to the GDPR read as references to the FADP, references to the EU and Member States read as references to Switzerland, and the supervisory authority being the Swiss Federal Data Protection and Information Commissioner. Data Subjects habitually resident in Switzerland may bring proceedings in Swiss courts.
• Brazil and other countries. Where another country requires a specific transfer mechanism, such as ANPD-approved standard clauses for Brazil, the parties agree that the applicable mechanism is incorporated by reference to the extent required.

BUFI may replace the transfer mechanism with a newer approved version or another valid mechanism, provided protection is not materially reduced. If the SCCs conflict with this DPA or the Agreement, the SCCs prevail for the Restricted Transfer concerned.

With respect to personal information subject to State Privacy Laws, BUFI is a service provider, contractor or processor, as applicable, and Customer discloses personal information to BUFI only for the limited and specified purposes in the Agreement. BUFI will:

• not sell or share personal information;
• not retain, use or disclose personal information for any purpose other than providing the Service, or outside the direct business relationship with Customer, except as State Privacy Laws permit;
• not combine personal information received from Customer with personal information from other sources, except as State Privacy Laws permit and as needed to provide the Service;
• provide the same level of privacy protection as State Privacy Laws require, and notify Customer if it determines it can no longer meet its obligations.

Customer may take reasonable and appropriate steps to ensure BUFI's use of personal information is consistent with Customer's obligations, and to stop and remediate unauthorized use. BUFI certifies that it understands and will comply with these restrictions.

This DPA is governed by the governing law and dispute provisions of the Agreement, except where the SCCs or Applicable Data Protection Laws require otherwise. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, to the extent permitted by Applicable Data Protection Laws; nothing limits either party's liability to Data Subjects under the third-party beneficiary provisions of the SCCs.

If this DPA conflicts with the Agreement, this DPA prevails for the Processing of Customer Personal Data. BUFI may update this DPA to reflect changes in Applicable Data Protection Laws or the Service, on notice to Customer, provided an update does not materially reduce the protection of Customer Personal Data or materially increase Customer's obligations without Customer's agreement. Notices to BUFI under this DPA: hello@bu.finance.

Data importer / Processor: Fantasmita, LLC, doing business as BUFI, a Delaware limited liability company. Contact for data protection: hello@bu.finance. Activities: providing a financial workspace for businesses, including wallets, payments, payroll, invoicing, reimbursements, accounting integrations and AI assistance.

Data exporter / Controller: the Customer named in the workspace's account details. Contact: the workspace owner's email address. Activities: use of the Service for its business operations.

Categories of Data Subjects: Customer's employees, contractors, signers and other workspace members; payees and payroll recipients; Customer's customers, vendors and other business contacts; and individuals named in documents Customer uploads or connects.

Categories of personal data: identification and contact details; employment and contractor details; payment and bank account details, wallet addresses and transaction records; tax identifiers; invoice, receipt, payroll and reimbursement contents; communications and documents Customer uploads or connects (including email messages from connected inboxes); content submitted to AI features; and technical data about workspace users.

Sensitive data: not intended. Any sensitive data contained in documents Customer uploads is processed only to provide the Service, under the Security Measures, with access restricted to what the Service requires.

Frequency of transfer: continuous, as Customer uses the Service.

Nature and purpose of the Processing: hosting, storing, organizing, analyzing, transmitting and displaying Customer Personal Data to provide the Service as Customer configures and instructs it, including executing payments Customer approves, generating documents and records, and providing AI features.

Duration and retention: for the term of the Agreement and as described in Section 11.

Transfers to Subprocessors: as listed in Annex 3, for the purposes described there.

BUFI maintains the following measures, appropriate to the nature of the Service:

• Governance: assigned responsibility for information security, periodic risk review, and policies that staff must follow.
• Access control: role-based access within workspaces; database row-level security so each workspace's data is accessible only to its members; least-privilege, need-to-know staff access with unique accounts; prompt removal of access when roles change.
• Authentication: passwordless sign-in, passkeys, optional multi-factor authentication with step-up for sensitive actions, and multi-signature approval for treasury payments.
• Encryption: encryption of data in transit over public networks, and encryption of stored data by BUFI's hosting providers.
• Key management: wallet keys are held by the wallet provider or the user as described in Section 5 of the Terms; BUFI-held credentials are kept in managed secret stores with restricted access.
• Logging and monitoring: audit logs of security-relevant actions, error monitoring, and alerting.
• Secure development: code review, automated testing and change management for production changes; automated secret scanning.
• Network security: managed hosting with network-level protections, rate limiting and bot protection.
• Incident management: procedures to investigate, contain, remediate and notify in line with Section 6.
• Resilience: backups and recovery procedures provided by BUFI's hosting providers.
• Subprocessor management: due diligence and written data protection terms with Subprocessors.

BUFI engages the following Subprocessors to Process Customer Personal Data, depending on the features Customer uses. Locations show the principal processing location; contact hello@bu.finance for details.

• Supabase (United States): database, authentication and file storage.
• Vercel (United States): application hosting, edge network and AI Gateway routing.
• Cloudflare (United States): API hosting, network security and bot protection.
• Google Cloud (United States): background processing, and Gemini models for the assistant, document reading and embeddings.
• OpenAI (United States): AI memory extraction, embeddings, transcription and voice.
• Anthropic (United States): AI drafting features.
• xAI (United States): AI reasoning features.
• Deepgram and Groq (United States): speech transcription.
• ElevenLabs (United States): text-to-speech for the voice assistant.
• LiveKit (United States): real-time voice transport.
• Trigger.dev (United States): background jobs and document generation.
• Upstash (United States): caching and rate limiting.
• Resend, Novu and OneSignal (United States): email and notifications.
• Sentry (United States): error monitoring.
• Chatwoot and Plain (United States): customer support.
• Circle (United States): wallets, stablecoin transfers and cross-chain transfers.
• Bridge (United States), Alfred Pay (Mexico and United States) and Ripio (Argentina): conversion between money and digital assets and payouts to bank accounts.
• Plaid, Teller and Mesh (United States) and Pluggy (Brazil): bank and exchange account connections Customer authorizes.
• Rain (United States): card programs, where available.
• Pipedream (United States): third-party integrations Customer connects.
• context.dev, Exa and Firecrawl (United States): company information enrichment and web lookups.
• Typesense (United States): search.
• Liveblocks (United States): real-time collaboration.
• Alchemy (United States): blockchain data.
• Duffel (United Kingdom): travel booking, where used.