Insights7 Data Processing Agreement

Effective date: October 8, 2026
Version: 1.0

This Data Processing Agreement (“DPA”) is between Insights7, Corp., a Minnesota corporation (“Insights7”), and the customer that has agreed to the Insights7 Terms of Service or an Order Form (“Customer”). It forms part of the agreement between them (the “Agreement”). It applies when Insights7 processes Customer Personal Data in providing the Service. Capitalized terms not defined here have the meanings in the Terms of Service.

1. Definitions

• “Customer Personal Data” means personal data contained in Customer Data that Insights7 processes on Customer’s behalf under the Agreement.
• “Data Protection Laws” means all data protection and privacy laws that apply to the processing of Customer Personal Data under the Agreement, including, where applicable, the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as it forms part of UK law and the UK Data Protection Act 2018 (“UK GDPR”), the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (“CCPA”), and other US state comprehensive privacy laws.
• “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by Insights7 or its Sub-processors.
• “SCCs” means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0), as amended or replaced.
• “Sub-processor” means a third party engaged by Insights7 that processes Customer Personal Data.
• “Controller,” “processor,” “data subject,” “personal data,” “processing,” “service provider” and “supervisory authority” have the meanings given in the applicable Data Protection Laws.

2. Roles and scope

2.1 Roles. For Customer Personal Data, Customer is the controller (or a processor acting for its own controller), and Insights7 is a processor (or service provider) acting on Customer’s behalf. Insights7 is a controller of its own account, billing, usage and business-contact data, as described in the Insights7 Privacy Policy, and this DPA does not apply to that data.

2.2 Details of processing. Annex 1 describes the processing.

2.3 Customer’s responsibilities. Customer is responsible for having a lawful basis for the processing, for giving its workforce and other data subjects any required notices, and for the accuracy of Customer Personal Data. Customer will not submit special categories of personal data or data about criminal convictions unless the Agreement expressly allows it.

3. Instructions

Insights7 will process Customer Personal Data only on Customer’s documented instructions, unless required to do otherwise by law (in which case Insights7 will tell Customer before processing, unless the law prohibits this). The Agreement, Customer’s use and configuration of the Service, and Customer’s written requests are Customer’s complete instructions. Insights7 will tell Customer if, in its opinion, an instruction infringes Data Protection Laws.

4. Insights7 personnel

Insights7 will ensure that its personnel and contractors who process Customer Personal Data are bound by confidentiality obligations and access it only as needed to perform the Agreement.

5. Sub-processors

5.1 General authorization. Customer gives Insights7 general authorization to engage Sub-processors. The current Sub-processors are listed at https://insights7.com/subprocessors/. Customer approves them.

5.2 Sub-processor obligations. Insights7 will have a written agreement with each Sub-processor that imposes data protection obligations no less protective than this DPA, and remains liable for each Sub-processor’s performance as it is for its own.

5.3 Notice of changes. Insights7 will notify Customer’s account administrators by email, and update the list, at least 30 days before a new or replacement Sub-processor begins processing Customer Personal Data.

5.4 Objection. Customer may object on reasonable data protection grounds by email to info@insights7.com within that 30-day period. The parties will discuss the objection in good faith. If Insights7 cannot offer a reasonable alternative within 30 days of the objection, Customer may terminate the affected part of the Service by written notice and receive a refund of prepaid fees for the unused part of the Subscription Term. This is Customer’s sole remedy for an objection.

6. Security

Insights7 will implement and maintain the technical and organizational measures in Annex 2, which are designed to protect Customer Personal Data. Insights7 may update these measures as long as the updates do not materially reduce the overall level of protection.

7. Personal Data Breach

7.1 Notice. Insights7 will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach.

7.2 Contents. The notice will include, as far as known at the time, the nature of the breach, the categories and approximate numbers of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact person. Insights7 will provide further information in phases as it becomes available.

7.3 Response. Insights7 will take reasonable steps to contain, investigate and remedy the breach, and will reasonably cooperate with Customer. Customer decides whether to notify supervisory authorities and data subjects. Insights7 will not notify them about a breach affecting Customer Personal Data without Customer’s approval, unless the law requires it.

7.4 No admission. Insights7’s notice is not an admission of fault or liability.

8. Assistance

8.1 Data subject requests. Taking into account the nature of the processing, Insights7 will help Customer respond to requests from data subjects to exercise their rights, mainly through the Service’s features (which let Customer view, edit, export and delete data). If Insights7 receives a request directly, it will forward it to Customer and will not respond itself, except to direct the person to Customer.

8.2 Impact assessments and consultations. Insights7 will give Customer reasonable information and help with data protection impact assessments and prior consultations with supervisory authorities that relate to the Service.

8.3 Cost. Assistance is free where it is reasonable and occasional. Insights7 may charge reasonable fees for assistance that requires significant effort, after agreeing them with Customer in advance.

9. Audits

9.1 Information. On written request, no more than once a year (unless after a Personal Data Breach or at a supervisory authority’s request), Insights7 will answer a reasonable written security questionnaire and provide the information reasonably needed to show compliance with this DPA, including summaries of its Sub-processors’ security certifications or audit reports where Insights7 is allowed to share them.

9.2 Audits. If the information in Section 9.1 is not enough to show compliance, or a supervisory authority requires it, Customer (or an independent auditor bound by confidentiality and not a competitor of Insights7) may audit Insights7’s compliance with this DPA. The audit must be on at least 30 days’ notice, during business hours, no more than once a year, without access to other customers’ data, and in a way that does not unreasonably disrupt Insights7’s business. Customer bears its own costs and pays Insights7’s reasonable costs for time spent beyond one business day. Audits of Sub-processors are satisfied by their audit reports.

10. Deletion and return

10.1 During the term. Customer can export and delete Customer Personal Data using the Service at any time.

10.2 After termination. For 30 days after the Agreement or the relevant subscription ends, Insights7 will, on request, make Customer Data available for export. Insights7 will then delete Customer Personal Data from its active systems within 30 days after that export window ends. Deleted data will be removed from backups as backups expire, within a further 30 days. Insights7 will confirm deletion in writing on request.

10.3 Exceptions. Insights7 may keep Customer Personal Data where required by law. Any data kept stays protected under this DPA and is used only for the purpose for which it was kept. Aggregated Data that does not include personal data is not affected.

11. International transfers

11.1 Locations. Insights7 stores Customer Personal Data in the United States. Sub-processors may process it in the locations listed on the Sub-processor page.

11.2 EU transfers. To the extent Customer Personal Data subject to the GDPR is transferred to Insights7 in a country without an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows: - Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor. - Clause 7 (docking clause) applies. - Clause 9: Option 2 (general written authorization) applies, with the 30-day notice period in Section 5.3. - Clause 11: the optional language does not apply. - Clause 13: the competent supervisory authority is the one determined under Clause 13(a) for Customer. - Clause 17: the SCCs are governed by the laws of Ireland. - Clause 18: disputes are resolved by the courts of Ireland. - Annex I is completed by Annex 1 of this DPA, Annex II by Annex 2, and Annex III by the Sub-processor page.

11.3 UK transfers. To the extent Customer Personal Data subject to the UK GDPR is transferred, the UK Addendum is incorporated by reference. Table 1 is completed with the parties’ details in the Order Form; Table 2 refers to the SCCs as set out in Section 11.2; Table 3 is completed by Annexes 1 and 2 and the Sub-processor page; and in Table 4, either party may end the UK Addendum as allowed by its Section 19.

11.4 Swiss transfers. For Customer Personal Data subject to the Swiss Federal Act on Data Protection, the SCCs apply with the changes required by Swiss law, with the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.

11.5 Other mechanisms. If a transfer mechanism is invalidated or replaced, the parties will cooperate to put in place a valid alternative. If Insights7 becomes certified under the EU–US Data Privacy Framework, it may rely on that certification instead, while the SCCs remain as a fallback.

12. US state privacy laws

To the extent the CCPA or similar US state laws apply, Insights7 is a service provider (or processor) and will: (a) not sell or share Customer Personal Data (as those terms are defined in the CCPA); (b) not retain, use or disclose it for any purpose other than the business purposes in the Agreement, or outside the direct business relationship with Customer; (c) not combine it with personal data Insights7 receives from other sources, except as the law allows; (d) comply with the applicable obligations of those laws and provide the same level of privacy protection they require; (e) notify Customer if it can no longer meet these obligations; and (f) allow Customer to take reasonable steps to stop and remedy unauthorized use. Insights7 certifies that it understands and will comply with these restrictions. Insights7’s creation and use of Aggregated Data under Terms Section 5.4 is permitted to the extent the data is deidentified as those laws require.

13. AI Features

Insights7 does not send Customer Personal Data to any AI model provider, and does not use Customer Personal Data to train AI models. If Insights7 later changes this, it will treat the AI provider as a Sub-processor under Section 5 and give the 30-day notice.

14. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions in the Agreement (including the enhanced cap in Terms Section 17.3), to the extent Data Protection Laws allow. Nothing in this DPA limits a data subject’s rights under the SCCs.

15. General

15.1 Precedence. If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Personal Data. If the SCCs or UK Addendum conflict with this DPA, the SCCs or UK Addendum prevail.

15.2 Term. This DPA lasts as long as Insights7 processes Customer Personal Data.

15.3 Changes. Insights7 may update this DPA where required by changes in Data Protection Laws or to reflect a new transfer mechanism, or in other ways that do not materially reduce the protection for Customer Personal Data, with notice under Terms Section 20.

15.4 Governing law. Except as the SCCs require, this DPA is governed by the law that governs the Agreement.

Annex 1: Details of processing

Data exporter: Customer, as identified in the Order Form. Contact: as stated in the Order Form. Role: controller (or processor).

Data importer: Insights7, Corp., Minnesota, United States. Contact: info@insights7.com. Role: processor.

Categories of data subjects:

• Customer’s employees, contractors and other members of its workforce (human and AI) who are recorded in, or use, the Service (AI agents are recorded in the Service but are not data subjects)
• Customer’s authorized Users
• other individuals that Customer chooses to record in the Service, such as advisors, board members or contacts at customers and suppliers

Categories of personal data:

• identity and contact data: name, work email, job title
• organizational data: roles, responsibilities, reporting relationships, process and KPI ownership, assignments, and commitments
• work and performance data: time allocation and time records, KPI targets and results linked to an individual, notes and comments
• account and usage data within Customer’s instance: user ID, sign-in records, activity logs
• any other personal data Customer chooses to enter, such as personal data contained in financial records (for example, compensation that can be linked to an individual)

Special categories of data: None intended. Customer agrees not to submit them.

Frequency of transfer: Continuous, for the duration of the Agreement.

Nature and purpose of processing: Hosting, storing, organizing, displaying, analyzing, backing up and supporting Customer Data to provide the Service and any Professional Services (including Managed Services) under the Agreement, and creating Aggregated Data as permitted by the Agreement.

Duration and retention: The Subscription Term, plus the export and deletion periods in Section 10.

Sub-processor transfers: As listed at https://insights7.com/subprocessors/, for the purposes stated there, for the duration of the Agreement.

Annex 2: Technical and organizational security measures

Insights7 maintains the following measures.

Hosting and infrastructure

• The Service is a multi-tenant software-as-a-service (SaaS) Ruby on Rails application, using the Puma application server and a PostgreSQL database, hosted in the United States on Heroku (Salesforce), which runs on Amazon Web Services infrastructure. Physical and environmental security of the data centers is the responsibility of these hosting providers
• Each customer’s data is logically separated from other customers’ data within the application, and each customer’s users can access only their own customer instance
• Customer Data is encrypted at rest

Encryption in transit - The production application requires HTTPS, with TLS encryption for communications between the user’s browser and the application.

Access control and authentication

• Users sign in with an email address and password. Passwords are stored as salted, one-way hashes
• Access within the Service is controlled by role-based permissions
• Insights7 limits administrative access to production systems to named personnel who need it, and removes access promptly when it is no longer needed
• Multi-factor sign-in for platform users is not currently offered

Application security

• Rails model validations check submitted data, and Active Record parameterized queries help protect against SQL injection
• Rails authenticity tokens help protect against cross-site request forgery (CSRF)

Availability and recovery

• Insights7 makes regular backups of the database
• Backups are kept for 30 days
• Recovery targets: recovery point objective 24 hours, recovery time objective 48 hours

Monitoring and incident response - Insights7 follows a documented process for investigating and responding to security incidents, including the notice in Section 7.

Personnel and vendors

• Personnel and contractors with access to Customer Data are bound by confidentiality obligations
• Sub-processors are bound by written data protection terms (Section 5)

Annex 3: Sub-processors

See https://insights7.com/subprocessors/, as updated under Section 5.