Data Processing Addendum

This addendum forms part of the Terms of Service, or of any master agreement, between the customer ("Customer") and Pyke Horse Training LLC ("Apex"). It applies when Apex processes personal data in Customer Data on Customer's behalf. Where it conflicts with the Terms, this addendum wins on data protection.

1. Roles and scope

• Customer is the controller, or a processor acting for its own controllers. Apex is the processor, or a subprocessor.
• Subject matter and duration: providing the Apex Platform app for the term of the subscription, plus the deletion period in section 9.
• Nature and purpose: hosting, storage, search, AI-assisted drafting and grading, sign-in and support, as described in the Terms.
• Data subjects: Customer's staff and users. The buyers, prospects and other contacts named in Customer Data. People whose details appear in connected sources or uploaded documents.
• Personal data: names, work contact details, job roles, sign-in identifiers, and any personal data in deals, documents, bids and messages. Customer should not upload special category data unless needed. If it does, Customer is responsible for having a lawful basis.

2. Apex's obligations

Apex will:

1. process personal data only on Customer's documented instructions. These terms and Customer's settings in the app are those instructions. Apex will tell Customer if an instruction appears to break the law;
2. make sure everyone who can access the data is bound by confidentiality;
3. apply the security measures in Annex 1;
4. not use personal data to train AI models, and require the same of its AI subprocessors;
5. help Customer, as far as reasonably possible, to answer data subject requests, carry out data protection impact assessments and consult regulators;
6. notify Customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice gives the information Customer needs to meet its own obligations;
7. at Customer's choice, return or delete the data at the end of the service, as described in section 9;
8. make available the information needed to show compliance with this addendum, and allow audits as set out in section 7.

3. Staff access

Apex staff access a Customer's tenant only with a request approved by a Customer administrator, for a stated reason and time window. Every access is logged and visible to Customer. The exceptions are where the law requires access or where it is needed to prevent serious harm, in which case Apex tells Customer promptly unless the law forbids it.

4. Subprocessors

• Customer gives general authorisation for Apex to use subprocessors. The current list is in the Privacy Policy.
• Apex will give at least 30 days' notice of a new subprocessor, by email or in the app. Customer may object on reasonable data protection grounds. If the parties cannot resolve the objection, Customer may end the affected service and receive a refund of prepaid fees for the unused period.
• Apex imposes data protection terms on each subprocessor that are at least as protective as this addendum, and remains responsible for their performance.
• Providers that Customer connects itself, such as its own AI model, Google Drive or SharePoint, are not Apex subprocessors. Customer's own agreements govern them.

5. International transfers

• Customer chooses a US or EU region for its tenant. Apex stores the primary database and files in that region.
• Where personal data from the EEA, Switzerland or the UK is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Module 2, or Module 3 where Customer is a processor) are incorporated by reference, with the UK International Data Transfer Addendum for UK data. Clause 7 (docking) applies. Clause 9 option 2 (general authorisation) applies. Clause 11 optional language does not apply. Clauses 17 and 18 use the law and courts of Ireland. Annex I is section 1 of this addendum, Annex II is Annex 1 below, and Annex III is the subprocessor list.

6. California

To the extent the CCPA applies, Apex is a service provider. Apex will not sell or share the personal information, will not retain, use or disclose it outside the direct business relationship or for any purpose other than the business purposes in these terms, and will not combine it with personal information from other sources except as the CCPA allows.

7. Audits

Apex will answer reasonable written security questionnaires once a year and share summaries of independent assessments when available. Where these do not reasonably show compliance, or a regulator requires it, Customer may audit on at least 30 days' notice, during business hours, at its own cost, no more than once a year, under confidentiality, and without access to other customers' data.

8. Liability

Liability under this addendum is subject to the limits in the Terms, except where the law does not allow them.

9. Return and deletion

For 30 days after the subscription ends, Customer can export its data from the app. Apex then deletes Customer Data from the live service within 30 days, and from backups no later than 35 days after that, unless the law requires it to keep some data. Audit records are kept for 13 months and then deleted.

Annex 1: Security measures

• Isolation: every row of Customer Data carries the tenant identifier, and Postgres row-level security enforces it on every query, job, search and file path. Automated tests cover isolation.
• Encryption: TLS in transit. Encryption at rest by the hosting and database providers. Provider tokens, client secrets and SSO secrets sealed with separate keys and never logged or returned after saving.
• Access: single sign-on with SAML or OIDC, SCIM, passkeys, role-based access enforced on the server, time-limited sessions, rate-limited sign-in, approved and logged staff access.
• Files: uploads checked for type and size, scanned for malware before real companies can use them, never executed. Original files deleted once read.
• AI: models must pass a test before use. Calls fail closed unless the customer allows fallback. Only the passages a task needs are sent. Logs hold no prompts or answers.
• Logging and audit: an append-only audit trail of admin actions, staff access and exports. Logs carry identifiers, not content.
• Development: dependency and secret scanning in continuous integration, code review, and separate test companies with made-up data.
• Resilience: managed database backups with point-in-time recovery, and an incident response process.