Data Processing Addendum

Last updated: 14 October 2026.

Offered to institutional clients that subscribe on behalf of their staff and need processor terms under the GDPR, the UK GDPR or US state privacy laws.

This Data Processing Addendum ("DPA") forms part of the agreement between Tamarly Corporation ("Processor") and the client named in the order ("Customer").

1. Roles and scope

For personal data that Customer or its authorised users upload, such as user accounts and portfolio data ("Customer Personal Data"), Customer is controller and Tamarly is processor. Tamarly is an independent controller for its own billing, security and product analytics data, as described in its Privacy Policy.

2. Processor obligations

Tamarly will:

• process Customer Personal Data only on Customer's documented instructions, including this DPA;
• ensure staff with access are bound by confidentiality;
• apply the security measures in Annex 1;
• assist Customer with data subject requests and with impact assessments where reasonably required;
• notify Customer of a personal data breach affecting Customer Personal Data without undue delay and in any case within 72 hours of becoming aware of it;
• at Customer's choice, delete or return Customer Personal Data within 30 days of the end of the agreement, unless law requires retention;
• make available information needed to show compliance, and allow one audit a year on 30 days' notice, which may be met by a current independent security report.

3. Sub-processors

Customer authorises the sub-processors listed in Annex 2. Tamarly will give 30 days' notice of a new sub-processor, during which Customer may object on reasonable data protection grounds. Tamarly remains liable for its sub-processors.

4. International transfers

Where Customer Personal Data leaves the EEA, UK or Switzerland, the EU Standard Contractual Clauses (Module 2 or 3 as applicable) and the UK International Data Transfer Addendum apply and are incorporated by reference.

5. US state laws

For the CCPA and similar laws, Tamarly acts as a service provider. It will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship, or combine it with other data except as permitted.

6. Liability

Liability under this DPA is subject to the limits in the agreement, except where law does not allow them.

Annex 1. Security measures

• Encryption in transit (TLS 1.2 or later) and at rest; column-level encryption for portfolio fields
• Row-level security on every database table, enforced in Postgres
• Sign-in with Google, Microsoft or email, and two-factor authentication; two-factor required for all administrators
• Least-privilege access, logged administrative access with stated reasons, quarterly access review
• Daily backups with point-in-time recovery (7 days) and a restore test every quarter
• Dependency scanning on every release; independent penetration test before launch and yearly
• Incident response plan with named owner and tested runbook

Annex 2. Sub-processors