This Data Processing Addendum (“DPA”) applies where an agreement for Talon’s services between Talon HC, Inc., a Delaware corporation (“Talon”), and a client (“Client”) incorporates it by reference (the “Agreement”). It sets out how Talon processes Personal Data on Client’s behalf when providing those services (the “Services”).

This DPA needs no separate signature. It applies to the extent that Data Protection Laws require a written agreement between Client and Talon for the processing of Personal Data, and it takes effect when the Agreement does. Capitalized terms that are not defined here have the meanings given in the Agreement.

1. Definitions

1.1 “Data Protection Laws” means all laws that apply to the processing of Personal Data under the Agreement. Where applicable, these include the California Consumer Privacy Act as amended (“CCPA”) and other US state privacy laws, the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and the UK Data Protection Act 2018, and the Swiss Federal Act on Data Protection.

1.2 “Personal Data” means information that relates to an identified or identifiable individual, or that is otherwise defined as personal data or personal information under Data Protection Laws, and that Talon processes on Client’s behalf in providing the Services.

1.3 “Personal Data Breach” means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data held by Talon or its Subprocessors.

1.4 “Subprocessor” means a third party that Talon engages to process Personal Data in connection with the Services.

1.5 “Standard Contractual Clauses” or “SCCs” means the clauses annexed to European Commission Implementing Decision (EU) 2021/914.

1.6 “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner, version B1.0.

1.7 The terms “controller”, “processor”, “data subject”, “processing”, “business”, “service provider”, “sell” and “share” have the meanings given in the applicable Data Protection Laws.

2. Roles and scope

2.1 Roles. Client is the controller of Personal Data, or a processor acting for its own clients, such as the funds and entities it administers. Talon is Client’s processor, or subprocessor where Client is itself a processor. Where Client acts as a processor, Client confirms that the relevant controller has authorized its instructions to Talon and the engagement of Talon.

2.2 Details of processing. Annex I describes the subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of data subjects.

2.3 Instructions. Talon will process Personal Data only on Client’s documented instructions. The Agreement, this DPA, and the use and configuration of the Services by Client and its users are Client’s complete instructions, together with any further written instructions the parties agree. Talon will tell Client if it believes an instruction infringes Data Protection Laws. If a law requires Talon to process Personal Data in another way, Talon will tell Client before doing so, unless that law prohibits the notice.

2.4 Client responsibilities. Client is responsible for the accuracy, quality and legality of Personal Data and for how it was obtained. Client confirms that it has given every notice and obtained every consent and right needed for Talon to process Personal Data under the Agreement. Client will not submit categories of Personal Data that Annex I does not describe.

2.5 Talon as controller. Talon processes limited data about Client’s personnel as an independent controller, in line with Data Protection Laws. This covers business contact details and account, billing and usage records, which Talon uses to manage the relationship, bill for and secure the Services, and meet its legal obligations.

2.6 Anonymized and aggregated data. Where the Agreement permits it, Client instructs Talon to create anonymized and aggregated data from Personal Data to improve the Services. That data will not identify Client or any individual, and Talon will not attempt to re-identify it.

3. Confidentiality, security and assistance

3.1 Personnel. Talon will limit access to Personal Data to personnel who need it to provide the Services. Those personnel are bound by written confidentiality obligations and complete security awareness training.

3.2 Security. Talon will implement and maintain the technical and organizational measures described in Annex II. Talon may update those measures over time, provided the update does not materially reduce the overall protection of Personal Data.

3.3 No model training. Talon will not use Personal Data to train or improve general-purpose artificial intelligence models, and will not permit a Subprocessor to do so.

3.4 Assistance. Taking into account the nature of the processing and the information available to Talon, Talon will give Client reasonable assistance with data protection impact assessments, consultations with regulators, and Client’s own security obligations under Data Protection Laws.

3.5 Records. Talon will keep the records of its processing that Data Protection Laws require and will make them available to Client on request.

4. Subprocessors

4.1 Authorization. Client gives Talon general authorization to engage Subprocessors. The Subprocessors engaged at the date of this DPA are listed in Annex III.

4.2 Flow-down. Talon will bind each Subprocessor by a written agreement that protects Personal Data to at least the standard this DPA requires. Talon remains responsible for each Subprocessor’s performance.

4.3 Changes. Talon will give Client at least 30 days’ notice by email before a new Subprocessor begins processing Personal Data. Client may object in writing within 15 days of the notice on reasonable data protection grounds. The parties will then work in good faith to resolve the objection. If they cannot do so within 30 days, Client may terminate the affected Services by written notice, and Talon will refund any prepaid fees for the period after termination. This is Client’s only remedy for an objection to a Subprocessor.

4.4 Urgent replacement. Talon may replace a Subprocessor without advance notice where that is needed to keep the Services secure or available. Talon will then notify Client promptly, and Section 4.3 applies from the date of that notice.

5. Data subject and third-party requests

5.1 Data subject requests. If Talon receives a request from a data subject about Personal Data, Talon will notify Client promptly, and in any case within 5 business days. Talon will not respond to the request itself, other than to refer the data subject to Client, unless a law requires it to.

5.2 Assistance. The Services let Client access, correct, export and delete Personal Data. Where Client cannot meet a request through the Services, Talon will give reasonable assistance on written request.

5.3 Government and regulator requests. If a government body or regulator demands Personal Data from Talon, Talon will notify Client before disclosing it, unless a law prohibits the notice. Talon will disclose only what the demand legally requires.

5.4 Costs. Talon may charge its then-current rates for assistance under this Section 5 that goes materially beyond the standard functionality of the Services, after agreeing the scope with Client.

6. Personal Data Breach

6.1 Notice. Talon will notify Client of a Personal Data Breach without undue delay, and in any case within 48 hours of becoming aware of it. Talon will send the notice to Client’s notice contact under the Agreement.

6.2 Content. The notice will describe, as far as Talon knows at the time:

6.2.1 the nature of the Personal Data Breach;

6.2.2 the categories and approximate number of data subjects and records affected;

6.2.3 the likely consequences;

6.2.4 the steps Talon has taken or plans to take; and

6.2.5 a contact point for more information.

Talon may provide this information in stages as it becomes available.

6.3 Response. Talon will take reasonable steps to contain, investigate and mitigate the Personal Data Breach. Talon will give Client the cooperation it reasonably needs to meet its own notification obligations.

6.4 Notifications. Client is responsible for notifying regulators and data subjects. Talon will not notify them on Client’s behalf unless Client asks it to or a law requires it. A notice under this Section 6 is not an admission of fault or liability.

7. Audits and assurance

7.1 Security documentation. On written request, and no more than once in any 12 months, Talon will give Client its current security documentation. This includes Talon’s security and controls report, answers to a reasonable security questionnaire, and its most recent independent audit report or certification once one is available.

7.2 Audit. Client may audit Talon’s compliance with this DPA where the documentation in Section 7.1 does not reasonably demonstrate it, where a regulator requires an audit, or after a Personal Data Breach. An audit:

7.2.1 needs at least 30 days’ written notice, except where a regulator requires less;

7.2.2 takes place in business hours, no more than once in any 12 months, to a scope the parties agree in advance;

7.2.3 may be carried out by Client or by an independent auditor that is bound by confidentiality and is not a competitor of Talon;

7.2.4 does not give access to other clients’ data or to information that would put Talon’s security at risk; and

7.2.5 is at Client’s cost.

7.3 Results. Audit results and all information Talon provides under this Section 7 are Talon’s confidential information and are subject to the confidentiality terms of the Agreement.

7.4 Subprocessors. Talon meets audit requests about a Subprocessor by providing the assurance reports that the Subprocessor makes available to Talon.

8. International transfers

8.1 Locations. Talon and its Subprocessors may process Personal Data in the United States and in the other countries listed in Annex I and Annex III. Client authorizes those transfers, subject to this Section 8.

8.2 When this Section applies. Sections 8.3 to 8.6 apply only where Personal Data that is subject to the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection is transferred to a country that those laws do not treat as providing adequate protection.

8.3 EEA transfers. The SCCs are incorporated into this DPA and apply as follows:

8.3.1 Module Two applies where Client is a controller, and Module Three applies where Client is a processor.

8.3.2 Clause 7 (docking) does not apply.

8.3.3 In Clause 9(a), Option 2 (general authorization) applies, with the notice period in Section 4.3.

8.3.4 In Clause 11(a), the optional wording does not apply.

8.3.5 In Clause 17, Option 1 applies and the governing law is the law of Ireland.

8.3.6 In Clause 18(b), disputes are resolved by the courts of Ireland.

8.3.7 Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

8.4 UK transfers. The UK Addendum is incorporated into this DPA. Tables 1 to 3 are completed by the information in this DPA and its Annexes. In Table 4, neither party may end the UK Addendum.

8.5 Swiss transfers. The SCCs apply as set out in Section 8.3, with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the supervisory authority.

8.6 Conflict. If the SCCs or the UK Addendum conflict with the rest of this DPA or the Agreement, the SCCs or the UK Addendum prevail.

9. Return and deletion

9.1 During the term. Client can access and export Personal Data through the Services at any time during the term of the Agreement.

9.2 Return. After the Agreement ends, Talon will return Personal Data to Client in its then-current format, if Client asks in writing within 30 days of the end date.

9.3 Deletion. Talon will delete Personal Data from its production systems within 60 days after the period in Section 9.2 ends, and from its backups within a further 90 days. On request, Talon will confirm the deletion in writing.

9.4 Exceptions. Talon may keep Personal Data where a law requires it to. Talon will keep that data confidential and will process it only for the purpose the law requires. Anonymized and aggregated data under Section 2.6 is not Personal Data and is not subject to this Section 9.

10. US state privacy laws

10.1 Role. Where the CCPA or a similar US state privacy law applies, Talon acts as Client’s service provider or processor. Client discloses Personal Data to Talon only for the limited business purpose of providing the Services under the Agreement.

10.2 Restrictions. Talon will not:

10.2.1 sell or share Personal Data;

10.2.2 retain, use or disclose Personal Data for any purpose other than providing the Services, or as those laws otherwise permit a service provider to do;

10.2.3 retain, use or disclose Personal Data outside the direct business relationship between Talon and Client; or

10.2.4 combine Personal Data with personal data it receives from another source or collects itself, except as those laws permit.

10.3 Commitments. Talon will comply with the obligations those laws place on it and will protect Personal Data to the standard they require. Talon will tell Client if it decides it can no longer meet those obligations. Client may then take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Data, and may otherwise take such steps to check that Talon uses Personal Data consistently with Client’s obligations.

10.4 Certification. Talon certifies that it understands the restrictions in this Section 10 and will comply with them. Talon receives no payment or other consideration for Personal Data.

11. General

11.1 Order of precedence. If documents conflict on the processing of Personal Data, they apply in this order: the SCCs and the UK Addendum, then this DPA, then the rest of the Agreement. The Terms of Service and Privacy Policy published on Talon’s website do not apply to Personal Data.

11.2 Liability. Each party’s liability under this DPA, including under the SCCs, is subject to the exclusions and limits of liability in the Agreement. Nothing in this DPA limits a party’s liability to a data subject under the SCCs, or any liability that the law does not allow to be limited.

11.3 Term. This DPA lasts for as long as Talon processes Personal Data on Client’s behalf.

11.4 Governing law. The governing law and venue of the Agreement apply to this DPA, except where the SCCs or the UK Addendum provide otherwise.

11.5 Changes. Talon may update this DPA where a change in Data Protection Laws requires it, by written notice to Client, provided the update does not materially reduce the protection of Personal Data. Any other change needs a written agreement signed by both parties.

11.6 Contacts. Client may send privacy questions and requests under this DPA to privacy@talonfi.com, and security reports to security@talonfi.com. Talon will send notices to Client’s notice contact under the Agreement.

Annex I: Details of processing

A. Parties

Name: Data exporter: Client, as identified in the Agreement. Data importer: Talon HC, Inc.

Address: Data exporter: As stated in the Agreement. Data importer: 3606 Woodruff Ave., Oakland, CA 94602, USA

Contact: Data exporter: Client’s notice contact under the Agreement. Data importer: privacy@talonfi.com

Role: Data exporter: Controller, or processor for its own clients. Data importer: Processor, or subprocessor

Activities: Data exporter: Use of the Services under the Agreement. Data importer: Provision of the Services under the Agreement

B. Description of the processing

Subject matter: Talon’s provision of its treasury and payments operations platform to Client under the Agreement.

Duration: The term of the Agreement, plus the return and deletion periods in Section 9.

Nature and purpose: Hosting, storing, retrieving, displaying, transmitting and otherwise processing Personal Data to provide the Services. This covers entity and ownership records, bank account connectivity and reporting, counterparties and payment templates, payment preparation and approval, cash sweep accounts, document storage and electronic signature, user authentication, support and security monitoring.

Data subjects: Client’s users. Directors, officers, employees, authorized signers, beneficial owners and control persons of Client and of the entities it manages. Investors. Counterparties and payees who are individuals, and the individual contacts of those that are organizations.

Categories of Personal Data: Identity and contact details: name, email, phone, address, job title and role. Authentication and usage data: login identifiers, IP address, device data and audit history. Identification details: date of birth, nationality, tax identification numbers, and government identity document numbers and copies. Financial details: bank account and routing numbers, balances, transactions and payment instructions. Ownership and control relationships. Documents and signatures that Client uploads or signs through the Services.

Sensitive data: Government identification numbers and financial account details, protected by the measures in Annex II. Client does not intend to submit special categories of data under Article 9 of the GDPR.

Frequency: Continuous, for the term of the Agreement.

Retention: As Section 9 provides.

Processing locations: Personal Data is hosted in the United States. Talon personnel may access it from the United States and Canada. Subprocessor locations are in Annex III.

C. Supervisory authority

The competent supervisory authority is the one determined under Clause 13 of the SCCs.

Annex II: Security measures

Talon maintains the following technical and organizational measures.

Governance: A documented information security program with published policies that management reviews and approves every year. A risk register that is reassessed at least annually.

Personnel: Background checks at hire. Security awareness training at hire and every year. Written confidentiality obligations and acceptance of the Code of Conduct and Acceptable Use Policy.

Access control: Unique user IDs and multi-factor authentication on Talon’s cloud accounts. Access granted on least privilege at onboarding and removed at termination, with quarterly access reviews. Access to production databases limited to named administrators.

Product access: Role-based permissions and a configurable payment approval matrix. Client data is logically separated by workspace. Multi-factor authentication is available for Client users.

Encryption: TLS 1.2 or higher on all public endpoints. Encryption at rest for databases and file storage. Encryption keys held in a managed key service and rotated annually. Application secrets held in a managed secrets vault, not in code.

Network: Production databases reachable only from a private network. Firewalls that allow only web traffic from the internet. Threat detection across the cloud environment.

Logging and monitoring: Cloud audit logging with alerts to the security team on sensitive events. Production database audit logging kept for one year. Versioned records with a tamper-resistant audit trail of changes to Client data.

Vulnerability management: Continuous configuration checks against cloud security best practices. Scanning of container images. Regular automated external vulnerability scanning.

Change management: All changes go through merge requests and automated tests. A change to production needs approval from someone other than its author. Separate environments, with no production data in development.

Endpoints: Antivirus on company devices and a company password manager.

Incident response: A documented incident response plan, tested every year.

Continuity: Daily server snapshots, database point-in-time recovery, and an annual restore test.

Vendors: Risk-rated vendors, reviewed every year, each bound by confidentiality and security terms.

Physical security: Hosting in data centers operated by Talon’s cloud provider, which is responsible for physical security.

Annex III: Subprocessors

Amazon Web Services: Hosting, databases, logging and key management. Location: United States

Clerk: User authentication, multi-factor authentication and sessions. Location: United States

Embat: Bank data aggregation; data passes through and is not stored. Location: European Union

Box: Client document storage. Location: United States

DocuSign: Electronic signature. Location: United States

Resend: Transactional email. Location: United States

OpenAI: AI document extraction and in-app assistant. Location: United States

PostHog: Application monitoring and product analytics. Location: United States