Data Processing Addendum

Parties and effective date

This Data Processing Addendum ("DPA") forms part of the Main Agreement between the Customer named in the signed order form or subscription agreement ("Customer") and BenefitsInteractive ("Provider," "we," or "us").

Effective as of the later of (a) the Main Agreement effective date or (b) the date the last party signs this DPA via DocuSign or equivalent ("DPA Effective Date").

1. Definitions

Capitalized terms not defined here have the meaning in the Main Agreement. In this DPA:

• "Applicable Privacy Law" means privacy, data protection, and consumer protection laws that apply to the Processing of Customer Personal Data under the Main Agreement, including (as applicable) U.S. state comprehensive privacy laws (e.g., CCPA/CPRA and similar statutes) and, if Annex 1 is executed, EU/UK GDPR.
• "Customer Personal Data" means Personal Data that Customer (or Customer's users) submit to the Services, or that Provider Processes on Customer's behalf in providing the Services under the Main Agreement—excluding Provider Independent Data.
• "Provider Independent Data" means Personal Data for which Provider acts as an independent controller / business, including public marketing leads and similar website intake described in Provider's Privacy Policy, and Provider's own account, billing, security, and product telemetry data to the extent not Processed solely on Customer's documented instructions.
• "Personal Data", "Process" / "Processing", "Controller", "Processor", "Business", "Service Provider", "Sale", and "Share" have the meanings given under Applicable Privacy Law (or the closest functional equivalent).
• "Security Incident" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in Provider's possession or control.
• "Services" means the BenefitsInteractive platform and related services described in the Main Agreement (including employee benefits education tools, portals, AI-assisted features, media/authoring tools, and admin configuration as enabled for Customer).
• "Subprocessor" means a third party engaged by Provider to Process Customer Personal Data in connection with the Services.

2. Roles and scope

2.1 Roles for Customer Personal Data

For Customer Personal Data Processed in the Services under the Main Agreement:

• Customer is the Controller / Business (and, where Customer is a broker administering employer clients, Customer is responsible for its own relationship with those employers and individuals as required by law and Customer's contracts).
• Provider is a Processor / Service Provider (and, where Applicable Privacy Law uses that term, a Contractor) to Customer.

Customer determines the purposes and means of Processing Customer Personal Data. Provider Processes Customer Personal Data only as described in this DPA, the Main Agreement, Customer's documented configuration of the Services, and Customer's other documented instructions that Provider can reasonably carry out within the Services.

2.2 Provider Independent Data

This DPA does not make Provider a processor for Provider Independent Data. Provider's Privacy Policy governs that Processing. Promotion of a marketing lead into a Customer-controlled CRM or tenant workspace may change roles for the migrated record; the parties will treat migrated records as Customer Personal Data once under Customer's tenant control, subject to Applicable Privacy Law.

2.3 No sale / share for cross-context advertising

Provider will not Sell Customer Personal Data or Share it for cross-context behavioral advertising as those terms are defined under California law (and analogous concepts under other Applicable Privacy Law), and will not combine Customer Personal Data with personal information received from other sources except as permitted for a Service Provider / Processor under Applicable Privacy Law or as instructed by Customer.

2.4 Not a BAA by default

Unless the parties execute a separate Business Associate Agreement, Customer will not submit protected health information (PHI) as defined by HIPAA for Processing, and this DPA is not a BAA. Benefits education content and plan documents may be sensitive; Customer remains responsible for what it uploads and for selecting features appropriate to its compliance program.

3. Customer instructions and responsibilities

3.1 Instructions

Customer instructs Provider to Process Customer Personal Data to:

1. Provide, maintain, secure, and support the Services
2. Configure features Customer enables (including AI chat/authoring, SMS/email notifications, media generation/delivery, SSO, reporting, and required-engagement tracking)
3. Comply with law and respond to lawful requests, subject to Section 8
4. Perform Processing described in Exhibit A

Customer's use of admin, broker, SSO, invite, and impersonation features constitutes instructions to Process data as those features operate.

3.2 Customer responsibilities

Customer is responsible for:

• Providing required notices to individuals and obtaining consents where required
• Ensuring it has a lawful basis / permission to submit Customer Personal Data to the Services
• Configuring access (roles, groups, SSO) appropriately
• Not uploading unlawful content or data Customer is not authorized to Process
• Making deletion/access requests through agreed channels (Section 7)
• Its own employers, brokers, or end users as applicable under Customer's contracts

4. Confidentiality and personnel

Provider will ensure personnel authorized to Process Customer Personal Data are bound by confidentiality obligations and receive appropriate training. Access is limited on a need-to-know basis consistent with Provider's security practices.

5. Security

Provider will implement and maintain reasonable administrative, technical, and organizational measures designed to protect Customer Personal Data against Security Incidents, appropriate to the nature of the Services and the Personal Data Processed. Measures typically include (as implemented for the production environment):

• TLS in transit; encryption at rest as provided by hosting/database vendors
• Authentication controls (including OAuth/magic link/invite flows and, where purchased, enterprise SSO)
• Tenant/group scoping controls and role-based portals
• Access logging and operational monitoring
• Vulnerability and dependency management practices appropriate to the stack

Provider may update controls without reducing overall protection in a material way without notice, except as required by the Main Agreement.

6. Subprocessors

6.1 Authorization

Customer authorizes Provider to engage Subprocessors to Process Customer Personal Data as needed to deliver the Services. Current typical Subprocessors are listed in Exhibit B.

6.2 Flow-down

Provider will impose data-protection obligations on Subprocessors that are no less protective of Customer Personal Data than those in this DPA in material respects, to the extent applicable to the Subprocessor's services.

6.3 Notice of changes

Provider will provide notice of material Subprocessor additions or replacements by updating Exhibit B on this page (or a successor disclosure URL) and notifying Customer via email to Customer's notice address (or in-product notice) at least thirty (30) days before the new Subprocessor Processes Customer Personal Data, except for emergency replacements needed to maintain Services or security, in which case Provider will notify as soon as practicable.

6.4 Objection

If Customer reasonably objects to a new Subprocessor on data-protection grounds, the parties will discuss in good faith. If unresolved before the effective date, Customer may terminate the affected Services (or the Main Agreement, if the Services cannot be provided without that Subprocessor) as its sole remedy, subject to fees owed for Services rendered.

6.5 Customer IdPs and Customer vendors

Customer's own identity provider (for SSO) and any Customer-controlled integrations are not Provider Subprocessors; Customer is responsible for those vendors.

7. Assistance with individual rights and compliance

Taking into account the nature of Processing, Provider will provide reasonable assistance to Customer, at Customer's request, to respond to requests from individuals to exercise rights under Applicable Privacy Law regarding Customer Personal Data in the Services (access, deletion, correction, and similar rights), including through self-serve admin tools where available and through Provider's operational request process.

Customer will:

• Submit verified requests to support@benefitsinteractive.app, or use admin tooling where available
• Not instruct Provider to delete data Customer must retain under law (for example, certain employment or ERISA records Customer chooses to keep outside or inside the Services)

Provider will also provide reasonable information to help Customer conduct data-protection assessments related to Customer's use of the Services, upon written request not more than once per twelve (12) months unless required by a regulator or Security Incident.

8. Security Incidents

Provider will notify Customer without undue delay after becoming aware of a Security Incident involving Customer Personal Data, and in any event within seventy-two (72) hours where feasible, at Customer's security/privacy notice email. Notice will include information reasonably available to Provider about the nature of the incident, categories of data involved (if known), and remediation steps. Provider will cooperate reasonably in Customer's investigation and notifications required by Applicable Privacy Law. Notification is not an admission of fault.

9. Return and deletion

Upon termination or expiration of the Services that Process Customer Personal Data, Provider will, at Customer's written election within thirty (30) days, (a) make available a reasonable export of Customer Personal Data then retained in production systems Provider controls, and/or (b) delete or de-identify Customer Personal Data, except:

• Archival or backup copies deleted on ordinary backup rotation schedules
• Data Provider must retain under Applicable Privacy Law or for fraud/security/dispute purposes (limited use and continued protection)
• Data that has become Provider Independent Data under Section 2.2

10. Audits

Upon written request no more than once in any twelve (12) month period (unless a Security Incident or regulator requires more frequent review), Provider will make available information reasonably necessary to demonstrate compliance with this DPA, which may include responses to security questionnaires, summaries of relevant controls, and (if available) third-party audit reports under NDA. On-site audits are not required unless mandated by Applicable Privacy Law or mutually agreed in writing; any on-site audit is at Customer's expense, during business hours, with reasonable notice, and without unreasonably disrupting operations or revealing other customers' data.

11. International Processing

Provider primarily stores and Processes Customer Personal Data in the United States. Customer is responsible for determining whether its use of the Services is lawful for individuals outside the U.S. If EU/UK GDPR (or similar) applies to the Processing, the parties will execute Annex 1 (or a counsel-approved replacement) before Customer submits Personal Data of EU/UK data subjects to the Services.

12. AI and subprocessors processing content

Certain Services send prompts, document excerpts, scripts, or similar content to AI or media Subprocessors (for example, large language model APIs and text-to-speech) to provide features Customer enables. Customer instructs Provider to do so when Customer uses those features. Customer should not submit unnecessary sensitive identifiers into chat or authoring fields. Provider does not guarantee AI outputs are accurate or suitable as formal plan documents; Customer remains responsible for review before employee-facing publication.

13. Liability; order of precedence

Liability arising from this DPA is subject to the limitations and exclusions in the Main Agreement. If there is a conflict, this DPA controls for Processing of Customer Personal Data; the Main Agreement controls for all other matters. Provider's Privacy Policy describes Processing generally and does not reduce Provider's obligations under this DPA for Customer Personal Data.

14. Term

This DPA starts on the DPA Effective Date and continues for as long as Provider Processes Customer Personal Data under the Main Agreement.

15. Miscellaneous

Amendments must be in writing (including agreed electronic signature). The parties intend that DocuSign (or a substantially equivalent e-sign platform) and the resulting executed PDF constitute original signed writings. If any provision is unenforceable, the remainder remains in effect. This DPA may be executed in counterparts (including electronic counterparts).

Signature blocks appear on the DocuSign PDF countersign copy sent with your Main Agreement—not on this web page.

Exhibit A — Description of Processing

Exhibit B — Subprocessors

Typical production stack. Feature-dependent vendors apply only when the related feature is enabled for Customer's environment. Provider may update this list as described in Section 6.3.

Customer IdP (Premium Group Admin SSO): Customer's identity provider — not a Provider Subprocessor.

Annex 1 — EU/UK GDPR module (optional)

Execute only if EU/UK GDPR (or similar) applies to the Processing. If Customer will not Process EU/UK data subject Personal Data in the Services, Annex 1 is not applicable and is omitted from the DocuSign PDF unless requested.

When Annex 1 is included in a signed envelope, it will address (as counsel-approved for that deal):

1. Processing only on documented instructions (including this DPA)
2. Personnel confidentiality; appropriate technical and organizational measures; Subprocessor flow-down
3. Assistance with data subject rights and DPIAs as required by GDPR
4. Deletion/return as in Section 9
5. International transfers via SCCs / UK transfer tools as attached schedules
6. Audit rights consistent with Section 10 and GDPR Art. 28(3)(h)

Firm-standard Article 28 clauses and SCCs/IDTA schedules are attached in the executed PDF when this Annex applies—not reproduced in full on this web page.

Request a signed copy

To receive a DocuSign envelope of this DPA with your Main Agreement, contact support@benefitsinteractive.app.