TapState Cloud Data Processing Addendum

This Data Processing Addendum ("Addendum") supplements and forms part of the End-User License Agreement and Terms of Service between you (the "Customer" or "Data Controller") and TAPDATA HONG KONG LIMITED ("TapState" or "Data Processor"). It sets out the terms under which TapState processes personal data on behalf of the Customer when providing the TapState Cloud service.

1. Definitions

For the purposes of this Addendum:

• Personal Data: Any information relating to an identified or identifiable natural person, as defined under the Hong Kong Personal Data (Privacy) Ordinance ("PDPO") and the EU General Data Protection Regulation ("GDPR").
• Customer Personal Data: Personal Data processed by TapState on behalf of the Customer in performing the activities described in Section 2. This excludes processing for TapState's independent purposes described in Section 2.5. Unless expressly stated otherwise, the processor obligations concerning Personal Data in this Addendum apply to Customer Personal Data.
• Data Controller: The Customer, who determines the purposes and means of processing Personal Data.
• Data Processor: TapState, which processes Personal Data on behalf of the Data Controller.
• Data Subject: An identified or identifiable natural person to whom Personal Data relates.
• Applicable Law: PDPO, GDPR, and any other data protection laws applicable to the Customer.
• Subprocessor: Any third-party processor engaged by TapState to process Personal Data as part of providing the Service.

2. Scope of Processing

2.1 Subject Matter and Types of Personal Data Processed

The subject matter is the processing of Customer Personal Data through the Customer's configured data integration pipelines, including change data capture (CDC) and Nest transformations, and related operation and support of those pipelines.

The actual data categories depend on the source systems, fields, transformations and destinations selected by the Customer. They may include:

These examples describe possible content, not data collected from every Customer. Inclusion of a category does not represent certification or suitability for a particular regulated workload.

2.2 Nature and Purpose of Processing

TapState processes Customer Personal Data to perform the Customer's instructed data integration and transformation workflows. Depending on the configured pipeline, processing includes reading source records and changes; transmitting, buffering and otherwise storing data as needed for execution; mapping, transforming, joining or nesting records; and writing resulting data to Customer-designated destinations.

Related processing includes operating, monitoring, securing and troubleshooting those workflows, providing Customer-requested support, assisting with applicable Data Subject requests, and handling return or deletion under Section 11. These purposes do not authorize TapState to use the Customer's business data for its own unrelated purposes.

The Customer's documented instructions include this Addendum, the agreed Service scope, and the Customer's pipeline configuration and authorized support requests. Such instructions remain subject to Applicable Law.

2.3 Duration of Processing

Customer Personal Data is processed for the duration needed to provide the Service and to perform the termination and deletion obligations in Section 11, subject to Applicable Law. Subscription termination does not establish a uniform 14-day retention or retrieval period.

2.4 Categories of Data Subjects

Data Subjects are the individuals represented in the Customer-selected source data and related pipeline or support materials. Depending on the Customer's use case, these may include its customers, prospects, employees, contractors, suppliers, business contacts or application users. The Customer determines the actual categories through its selected datasets and documented instructions.

2.5 Processing for TapState's Independent Purposes

TapState separately processes account registration and contact information, subscription and billing records, and service administration records for its own account management, billing, fraud prevention, platform security and legal compliance purposes, as described in the Privacy Policy. Where TapState determines the purposes and means of that processing, it acts as an independent controller rather than as the Customer's processor.

The distinction depends on the processing purpose, not merely the record's label. For example, support correspondence used to manage a support relationship may serve TapState's independent purposes, while Customer business records supplied to troubleshoot a pipeline remain Customer Personal Data processed on the Customer's behalf. Pipeline payloads do not become independent-purpose data merely because they appear in logs or support materials.

3. Data Protection Compliance

3.1 Processing Principles

TapState shall process Personal Data only:

• For the specified purposes set out in Section 2.2 of this Addendum;
• In accordance with the Customer's documented instructions;
• In compliance with Applicable Law.

3.2 Responsibilities for Lawful Processing

The Customer is responsible for establishing the lawful basis and providing the notices and permissions required for its instructed processing of Customer Personal Data. TapState processes that data on the Customer's documented instructions in accordance with this Addendum and Applicable Law; TapState's independent account or billing purposes do not provide a separate basis to reuse Customer Personal Data.

TapState is separately responsible for the lawfulness of processing for its independent purposes described in Section 2.5 and the Privacy Policy.

3.3 Confidentiality

TapState employees and contractors are bound by confidentiality obligations and may only access Personal Data when necessary to perform their duties.

3.4 Additional Processor Obligations

TapState will:

• inform the Customer promptly if it believes an instruction infringes Applicable Law;
• impose data protection obligations on each Subprocessor no less protective than this Addendum, and remain responsible to the Customer for its performance;
• assist the Customer, taking into account the nature of processing and the information available to TapState, with security, breach notification, data protection impact assessments and prior consultations with supervisory authorities;
• make available information reasonably necessary to demonstrate compliance with this Addendum.

The Customer gives general authorization to engage Subprocessors under Section 4.

4. Subprocessors

4.1 Authorized Subprocessors

TapState currently engages the following Subprocessors:

The following are not Subprocessors under this Addendum: the Customer's own MongoDB Atlas cluster and other source and destination systems, which the Customer contracts for and configures; and Stripe, Amazon SES and Tawk.to, which TapState uses for its own billing, account email and support purposes described in Section 2.5 and the Privacy Policy.

4.2 Notification of New Subprocessors

TapState will notify the Customer in advance of any new Subprocessors being engaged for data processing purposes. The Customer may object to a new Subprocessor within 14 days of notification, in which case TapState will make reasonable efforts to offer alternative arrangements or terminate the affected services.

4.3 Customer-Selected AI Provider

If the Customer configures an AI provider in the Service, prompts and the pipeline definitions, schemas or sample data included in assistant requests are sent to the provider and endpoint the Customer configured, using the Customer's credentials. That provider is selected by the Customer and governed by the Customer's agreement with it; it is not a TapState Subprocessor.

5. Data Security Measures

5.1 Technical Measures

TapState implements the following technical security measures:

• Encryption of data at rest (AES-256) on all storage systems
• Encryption in transit (TLS 1.2 or higher) for traffic between TapState-managed components and for access to the Console and Cluster APIs
• Connections to Customer-configured source and destination systems are encrypted when the Customer enables TLS in the connector settings and the system supports it
• Regular vulnerability assessments and penetration testing
• Automated security monitoring and incident detection
• Network segmentation and least-privilege access controls
• Multi-factor authentication for all administrative access

5.2 Organizational Measures

• Employee background checks and security training
• Regular security awareness programs
• Defined incident response procedures
• Documented data handling policies reviewed annually
• Access review and offboarding procedures

6. Data Subject Requests

6.1 Customer's Obligations

The Data Controller (Customer) is responsible for responding to Data Subject requests in accordance with Applicable Law.

6.2 TapState's Assistance

TapState will assist the Data Controller in responding to Data Subject requests for:

• Access to Personal Data
• Correction of inaccurate Personal Data
• Deletion of Personal Data
• Objections to processing
• Data portability

6.3 Request Handling Process

If TapState receives a request from a Data Subject concerning Customer Personal Data, it will forward the request to the Customer within 5 business days and will not respond to it directly unless the Customer authorizes it or Applicable Law requires. TapState will provide reasonable assistance so the Customer can meet its own response deadlines. Requests concerning TapState's independent processing (Section 2.5) are handled under the Privacy Policy.

Note: TapState currently provides this assistance, including deletion, through a manual process; there is no automated API for bulk deletion. The Customer can contact TapState at privacy@tapstate.com.

7. Cross-Border Data Transfers

7.1 Global Service and Processing Locations

TapState provides the Service to customers globally. The countries and regions in which Customer Personal Data is stored or processed depend on the relevant Service deployment, the providers used to deliver the Service, and the Customer's configured source and destination systems. This Addendum does not promise storage or processing exclusively within any single geographical region.

A Cluster's deployment region does not by itself determine the location of all account, billing, support or other related processing. Any specific data residency commitment must be expressly agreed in writing.

7.2 Customer Instructions and International Transfers

Customer configurations may require data to move between countries or regions. TapState will process and transfer Customer Personal Data in accordance with the Customer's documented instructions and Applicable Law. Customer configuration does not remove TapState's own obligations concerning transfers it carries out or arranges.

7.3 Transfer Safeguards

Where Applicable Law requires safeguards for an international transfer, TapState will ensure that an applicable lawful transfer mechanism and any required supplementary measures are in place before carrying out that transfer. Such mechanisms may include an applicable adequacy decision or appropriate contractual safeguards, including Standard Contractual Clauses where applicable. The requirements depend on the transfer and Applicable Law, rather than whether a provider is located inside or outside a particular geographical region.

8. Audit Rights

8.1 Customer Audits

The Customer has the right to conduct or have conducted a security audit of TapState's processing facilities and practices no more than once per year. Audits shall be:

• Conducted at reasonable times during business hours
• Arranged with at least 30 days' advance notice
• Limited to systems and processes relevant to this Addendum
• Conducted in a manner that does not disrupt TapState's normal operations

8.2 Third-Party Audits

TapState will make available the results of relevant third-party security audits and certifications upon request.

9. Data Breach Notification

9.1 TapState's Obligations

If TapState becomes aware of a Personal Data breach affecting Customer Personal Data, it will:

• Notify the Customer without undue delay and in no event later than 72 hours of becoming aware;
• Provide a description of the nature of the breach, including where possible the categories and approximate number of Data Subjects and records concerned;
• Describe the likely consequences of the breach;
• Provide a contact point for further information;
• Provide an estimated timeline for remediation;
• Describe the steps TapState has taken or will take to mitigate the impact.

Where it is not possible to provide all information at once, TapState will provide it in phases without undue further delay.

9.2 Customer's Obligations

The Customer is responsible for notifying relevant data protection authorities and Data Subjects as required by Applicable Law.

10. Liability

10.1 TapState's Liability

TapState's liability under this Addendum shall not exceed the greater of (a) the total amount paid by the Customer for the Service in the twelve (12) months preceding the claim and (b) one hundred US dollars (USD $100). This limitation does not apply to liability for breach of confidentiality, for fraud, gross negligence or wilful misconduct, or that cannot be limited or excluded under Applicable Law.

10.2 Allocation of Liability

Each party is liable for damage caused by its own processing as Applicable Law provides.

11. Termination

11.1 Effect of Termination

Upon termination of the Customer's subscription:

• TapState will cease processing Personal Data for all purposes except as required to comply with this Addendum or Applicable Law;
• At the Customer's choice, notified before the Service ends, TapState will delete Customer Personal Data held in TapState-managed storage or return it in a form the Service then makes available, unless Applicable Law requires retention;
• TapState will provide written confirmation of deletion upon request.

• Customer-owned Atlas data: Releasing a TapState Cluster does not itself delete business data stored in your own MongoDB Atlas cluster. You remain responsible for managing and backing up that data and for the associated Atlas charges.
• TapState-managed Cluster data: Cluster configuration, runtime state, stored connection credentials and replication checkpoints are cleaned up as part of resource release. There is no guaranteed 14-day retrieval or recovery period after release. Arrange any necessary exports and backups before the Service ends; this provision does not promise an export or restore capability.
• Account, billing and support records: These records are retained separately for the purposes described in the Privacy Policy and as required by applicable law; Cluster release does not automatically delete all such records.
• Backup copies, if any: Residual copies are removed according to the applicable backup lifecycle, subject to legal retention requirements. They are not a customer recovery service, and we do not promise that every backup copy will be deleted within 14 days.

The Customer should arrange any necessary export or return of data before the Service ends. Nothing in this Section limits obligations under Applicable Law concerning return or deletion of Personal Data. Account, billing and support records retained for TapState's own purposes are addressed separately in the Privacy Policy.

11.2 Legal Hold

If TapState receives a legal order or other legally valid request to retain Personal Data, it will notify the Customer promptly, unless legally prohibited from doing so, and will not delete the affected data while the requirement applies.

12. Changes to This Addendum

TapState will notify the Customer of material changes at least 30 days before they take effect, by email and in the Service. Material changes apply to the Customer once accepted in the Console, where the Customer will be asked to confirm at its next sign-in. If the Customer does not accept, it may cancel automatic renewal; the version it last accepted continues to apply until the end of its current paid period. Non-material changes take effect when published.

13. Contact Information

For questions about this Data Processing Addendum:

TAPDATA HONG KONG LIMITED
#557, 5/F, Building 19W, 19 Science Park West Avenue
Hong Kong SAR
Business Registration No. 73028663-000-05-21-A

Email: support@tapstate.com