Data Processing Addendum

Draft Revision: 1 — August 12, 2026

Effective Date: August 17, 2026

This is placeholder legal language prepared for internal review and has not been reviewed by an attorney. It should be reviewed by qualified legal counsel — including confirmation of which data protection laws actually apply to KnowUsers' customer base — before the Site launches or this Addendum is presented to Customers.

This Data Processing Addendum ("DPA") forms part of, and is incorporated into, the Terms of Use between Harter Product Advisors, LLC ("KnowUsers," "we," "us," "our," or the "Processor") and the Product Manager or company entering into the Terms of Use ("Customer" or the "Controller"). It applies whenever KnowUsers processes Respondent Personal Data on the Customer's behalf in connection with the Customer's use of the KnowUsers.com Site (the "Service").

1. Definitions

• "Respondent Personal Data" means any personal data relating to a Respondent that KnowUsers processes on the Customer's behalf through the Service, as described in Section 3 below.
• "Data Subject" means the individual to whom Respondent Personal Data relates (i.e., a Respondent).
• "Controller," "Processor," "Sub-processor," "Processing," and "Personal Data Breach" have the meanings given to them under Applicable Data Protection Law.
• "Applicable Data Protection Law" means all data protection and privacy laws applicable to the processing of Respondent Personal Data under this DPA, which may include the EU General Data Protection Regulation (GDPR), the UK GDPR, and U.S. state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA), to the extent any of these actually apply to the parties and the processing described here.

2. Roles of the Parties

As between KnowUsers and the Customer, the Customer acts as Controller of Respondent Personal Data, and KnowUsers acts as Processor, processing Respondent Personal Data solely on the Customer's documented instructions. Those instructions consist of the Terms of Use, this DPA, and the Customer's ordinary use of the Service — creating and posting polls or surveys, and receiving Respondent responses and exports through the Service.

KnowUsers will not process Respondent Personal Data for any purpose other than providing the Service, except where required to do so by law, in which case KnowUsers will inform the Customer of that legal requirement before processing, unless the law prohibits such notice.

3. Details of Processing

• Subject matter: KnowUsers' provision of the poll and survey hosting, embed, and reporting features of the Service.
• Duration: For as long as the Customer's KnowUsers account is active under the Terms of Use, plus the post-termination retention period described in Section 4(f) below.
• Nature and purpose of processing: Collecting, storing, and displaying Respondent responses submitted through the Customer's embedded poll or survey, and making that data available to the Customer through the Service's reporting screens and CSV export.
• Categories of Data Subjects: Respondents — end users of the Customer's own product, website, or application who interact with a poll or survey the Customer has posted.
• Types of Personal Data: Respondent email address; response content submitted to a poll question or survey pain-point ranking; the URL of the host page where the response was submitted; and IP address and related technical/Usage Data captured at the time of response, as described in Sections 1 and 4 of the KnowUsers Privacy Notice.

4. KnowUsers' Obligations as Processor

• (a) Instructions. Process Respondent Personal Data only on the Customer's documented instructions, as described in Section 2, unless otherwise required by Applicable Data Protection Law.
• (b) Confidentiality. Ensure that personnel authorized to process Respondent Personal Data are subject to confidentiality obligations.
• (c) Security. Implement appropriate technical and organizational measures to protect Respondent Personal Data, including: account-level data isolation between Customers, enforced both in the application layer and, as a defense-in-depth measure, through database-level row security; a unique, non-guessable Host Key used to scope every public, Respondent-facing request to a single Customer's account; encrypted data transmission (HTTPS); hashed password storage; database-backed, revocable login sessions; and an append-only audit log of administrative access to Customer accounts.
• (d) Assistance with Data Subject requests. Provide reasonable assistance to the Customer, at the Customer's request, in responding to a Data Subject's request to exercise their rights (such as access, correction, deletion, or objection) with respect to Respondent Personal Data held by KnowUsers. Because Respondents do not hold a KnowUsers account, such requests will typically reach KnowUsers by way of the Customer or directly by email; KnowUsers will reasonably cooperate with the Customer to resolve them.
• (e) Breach notification. Notify the Customer without undue delay, and in any case within 72 hours of becoming aware, of any Personal Data Breach affecting Respondent Personal Data, providing whatever information is reasonably available at the time regarding the nature of the breach, the categories and approximate number of Data Subjects and records affected, and the measures taken or proposed to address it.
• (f) Return or deletion. Upon termination of the Customer's account, Respondent Personal Data will be retained, inaccessible in the Customer-facing UI, for a 30-day window before being permanently deleted, consistent with the Terms of Use and Privacy Notice, unless a longer retention period is required by law.

5. Sub-processors

The Customer provides general authorization for KnowUsers to engage the following Sub-processors in connection with the Service:

• Railway — application hosting and database infrastructure; stores Respondent Personal Data.
• Resend / Postmark (transactional email provider) — delivers transactional email on KnowUsers' behalf, including CSV exports of poll and survey responses that contain Respondent Personal Data sent to the Customer.

KnowUsers will impose data protection obligations on each Sub-processor that are materially consistent with this DPA and remains responsible for each Sub-processor's performance of those obligations. KnowUsers will provide reasonable advance notice of any intended addition or replacement of a Sub-processor on this list, giving the Customer an opportunity to object on reasonable data-protection grounds.

6. International Data Transfers

To the extent Respondent Personal Data is transferred outside the Data Subject's home jurisdiction in the course of KnowUsers or its Sub-processors providing the Service, KnowUsers will rely on appropriate safeguards required under Applicable Data Protection Law (such as Standard Contractual Clauses), to the extent those requirements actually apply given KnowUsers' hosting arrangements and customer base.

7. Audit Rights

On reasonable prior written notice, and no more than once in any 12-month period (except where the Customer reasonably suspects a Personal Data Breach), the Customer may request that KnowUsers provide reasonably available documentation demonstrating its compliance with this DPA. Given KnowUsers' size and stage, KnowUsers may satisfy this obligation by providing a written summary of its security and data-handling practices in lieu of an on-site audit.

8. Liability

Each party's liability arising out of or relating to this DPA is subject to the limitation-of-liability terms set out in the Terms of Use.

9. Term and Termination

This DPA takes effect on the date the Customer accepts it and remains in effect for as long as KnowUsers processes Respondent Personal Data on the Customer's behalf under the Terms of Use. It terminates automatically upon termination of the Terms of Use, subject to KnowUsers' data return/deletion obligations in Section 4(f).

10. Changes to This DPA

We may update this DPA from time to time. If a revision is material, we will notify the Customer and require that the Customer review and re-accept the updated DPA before continuing to use the Service, consistent with the change-notification process described in our Terms of Use and Privacy Notice.

11. Contact Us

If you have any questions about this Data Processing Addendum, please contact us by email: KnowUsers.com@gmail.com.