Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the Akoonu Terms of Service and describes how Akoonu processes Customer Data in connection with the Services. Capitalized terms not defined in this DPA have the meanings given in the Terms of Service.

This DPA is published at akoonu.com/legal/dpa. Customer should refer to the version of this DPA in effect on the date of the applicable Order.

1. Service Architecture and Data Location

The Services are delivered as a managed package on the Salesforce Platform. The Services do not include any Akoonu-operated infrastructure, and Customer Data is processed and stored exclusively within Customer's Salesforce Org. Customer's Salesforce Platform agreement governs the underlying hosting, data center location, and platform-level security applicable to Customer Data.

2. Roles

To the extent applicable privacy or data protection laws characterize the parties' roles with respect to Customer Data:

(a) Under the California Consumer Privacy Act and similar U.S. state laws, Akoonu acts as a "service provider," "processor," or equivalent designation. Akoonu processes Customer Data only for the purposes of providing the Services to Customer and as otherwise permitted under the Terms of Service.

(b) Under the EU and UK General Data Protection Regulation, Akoonu acts as a "processor" with respect to Customer Data that constitutes personal data, and Customer acts as the "controller." Akoonu processes Customer Data only on Customer's documented instructions, which include Customer's configuration and use of the Services and the Terms of Service.

Akoonu shall not sell, rent, share, or otherwise disclose Customer Data except as necessary to provide the Services or as required by law.

3. Sub-Processors

Akoonu does not engage sub-processors in connection with the Services except as follows:

(a) Akoonu-Provided AI Mode. If Customer enables AI Features under the Akoonu-Provided AI Mode described in Section 2.5.2(c) of the Terms of Service, Akoonu's AI provider acts as Akoonu's sub-processor with respect to Customer Data submitted to AI Features in that mode. The current AI provider and applicable terms are set forth in the AI Schedule at akoonu.com/legal/ai-schedule.

(b) All Other Modes. In any other configuration of the Services, including any configuration in which AI Features are disabled or are used in Customer Agentforce Mode or Customer BYOK Mode, Akoonu does not engage any sub-processors with respect to Customer Data.

Akoonu will provide notice of material changes to its sub-processors as described in the AI Schedule or, where no AI Schedule applies, with at least thirty (30) days' prior notice through the Services or by email to Customer's designated administrator.

4. Security

Akoonu's security commitments derive from the combination of (a) the Salesforce Platform's security certifications and controls, which govern the environment in which Customer Data is processed and stored, and (b) Akoonu's secure development practices for the managed package, including code review, access controls applicable to Akoonu personnel, and managed package release procedures. Information regarding Akoonu's security practices is available at akoonu.com/security.

5. Akoonu Personnel Access to Customer Data

In the normal operation of the Services, Akoonu personnel do not have access to Customer Data. Akoonu personnel may access Customer Data only in connection with Customer's grant of support access to Customer's Salesforce Org, and only as necessary to respond to a Customer support request. Such access is subject to Customer's control under Salesforce's support access mechanisms and to Akoonu's confidentiality obligations under Section 5 of the Terms of Service.

6. Security Incidents

Akoonu will notify Customer without undue delay after becoming aware of any confirmed security incident affecting Customer Data within Akoonu's control or processed by Akoonu in connection with the Services. Such notice will include, to the extent then known, a description of the nature of the incident, the categories of Customer Data affected, the likely consequences, and the measures taken or proposed to address the incident. The parties acknowledge that security incidents affecting the underlying Salesforce Platform are subject to Salesforce's notification obligations to Customer and are not Akoonu's responsibility.

7. International Data Transfers

Because Customer Data is processed and stored within Customer's Salesforce Org, the location of Customer Data is determined by Customer's Salesforce configuration and Customer's agreement with Salesforce. Akoonu does not separately transfer Customer Data internationally. In Akoonu-Provided AI Mode, Customer Data submitted to the AI provider may be transferred to and processed in jurisdictions where the AI provider operates; such transfers are governed by the AI provider's applicable terms and transfer mechanisms.

8. Data Subject Requests and Cooperation

Because Customer Data resides within Customer's Salesforce Org, Customer has primary responsibility and capability to respond to requests from data subjects or individuals regarding their personal data. Akoonu will provide reasonable cooperation, at Customer's expense, to assist Customer in responding to such requests to the extent the Services are involved.

9. Return or Deletion of Customer Data

Customer Data resides in Customer's Salesforce Org throughout and after the Subscription Term. Upon termination or expiration of the Subscription Term, Customer retains its Customer Data in its Salesforce Org, subject to Customer's configuration of the managed package and Customer's Salesforce agreement. Akoonu has no separate obligation to return or delete Customer Data because Akoonu does not separately store Customer Data outside Customer's Salesforce Org.

10. Conflict; Order of Precedence

In the event of any conflict between this DPA and the Terms of Service, this DPA controls solely with respect to the subject matter addressed in this DPA. All other terms of the Terms of Service remain in full force and effect.

---

This is the first published version of the Akoonu Data Processing Addendum.