Proto Node Labs Data Processing Addendum

1. Scope and roles

1.1 This Addendum applies whenever PNL processes personal data contained in Customer Data on behalf of the Customer ("Customer Personal Data"). It does not apply to account, billing, and contact data about the Customer's own representatives, which PNL controls under its Privacy Policy.

1.2 The Customer is the controller (or "business") of Customer Personal Data and PNL is the processor (or "service provider" or "contractor"). Where the Customer is itself a processor for its own customers (for example a reseller for venues), the Customer warrants that it has authority to appoint PNL as a subprocessor, and PNL is a subprocessor.

1.3 Terms used in US state privacy laws (such as "sell", "share", "service provider", "consumer") have their meanings in those laws where they apply.

2. Details of processing

• Subject matter: providing the PNL Services described in the Terms and Schedules.
• Duration: the subscription term plus the retention and deletion periods in Terms section 9.
• Nature and purpose: hosting, storing, transmitting, displaying, backing up, and otherwise processing Customer Personal Data as needed to operate the Services the Customer has subscribed to, and as the Customer instructs through the Services.
• Categories of data subjects: the Customer's employees and contractors; the Customer's customers, leads, and bookers; venue staff, guests, and advertisers (PNL Broadcast resellers); visitors to websites PNL hosts for the Customer.
• Categories of personal data: identifiers (name, email, phone, address); employment data (pay rates, hours, PTO, tips, time records, edits); location data at clock-in and clock-out; device and network identifiers; inventory activity attributed to users; communications and email threads; booking details; media and content metadata; screenshots and logs of managed devices; AI assistant conversations.
• Sensitive data: none intended. The Customer agrees not to submit the categories listed in Terms section 7.8.

3. PNL's obligations

PNL will:

3.1 Follow instructions. Process Customer Personal Data only on the Customer's documented instructions, which are the Terms, the Schedules, the Customer's configuration and use of the Services, and written instructions from the account owner. PNL will tell the Customer if it believes an instruction violates law. PNL may process data as required by law, after notifying the Customer where lawful.

3.2 Not sell or share. Not sell Customer Personal Data, share it for cross-context behavioral advertising, retain, use, or disclose it outside the direct business relationship with the Customer, or combine it with personal data from other sources except as permitted for service providers (for example to detect security incidents or to build de-identified, aggregated statistics under Terms section 7.4).

3.3 Confidentiality. Ensure that PNL personnel with access to Customer Personal Data are bound by confidentiality and access it only as needed.

3.4 Security. Maintain reasonable technical and organizational measures appropriate to the risk, including: TLS in transit; encryption at rest through our providers; hashed credentials; role-based access and least privilege; session expiry and rate limiting; logging and monitoring; encrypted backups with scheduled aging; separation of customer tenants in the database; secure development practices; and a process for responding to incidents. PNL may update these measures but will not materially reduce overall protection during the subscription.

3.5 Subprocessors. Use only the subprocessors listed in section 4. Before adding a new subprocessor that will process Customer Personal Data, PNL will update the list at protonodelabs.com/dpa and email the account owner at least 15 days in advance. If the Customer objects on reasonable data-protection grounds within that period and PNL cannot offer a workaround, the Customer may cancel the affected subscription under the Terms and PNL will refund any prepaid fees for the period after cancellation. PNL imposes data protection obligations on subprocessors at least as protective as this Addendum and remains responsible for their performance.

3.6 Assistance with requests. Forward to the Customer, without undue delay, any request PNL receives from a data subject about Customer Personal Data, and not respond to it except to acknowledge receipt and refer them to the Customer, unless the law requires otherwise. Provide reasonable help, through the Services' features and on request, so the Customer can respond to access, correction, deletion, and portability requests.

3.7 Breach notification. Notify the Customer by email to the account owner without undue delay, and in any event within 72 hours after confirming a personal data breach affecting Customer Personal Data, with the information PNL has at that time and updates as it learns more. PNL's notification is not an admission of fault.

3.8 Deletion and return. Delete or return Customer Personal Data at the end of the subscription under Terms section 9 (30-day retention window for export, then deletion from live systems within a further 60 days, with backups aging out within 35 days for daily and 13 months for monthly backups), unless the law requires retention. Deletion includes instructing subprocessors to delete.

3.9 Compliance information and audits. On written request no more than once a year, provide information reasonably needed to show compliance with this Addendum, which may be a written description of measures, provider certifications or reports (for example SOC 2 reports from Neon, Vercel, Cloudflare, Stripe), and answers to a reasonable security questionnaire. On-site audits are not offered; where a law requires an audit, the parties will agree a reasonable scope, timing, and cost, borne by the Customer.

3.10 Notice of inability to comply. Tell the Customer if PNL determines it can no longer meet its obligations under this Addendum, and allow the Customer to take reasonable steps to stop and remediate unauthorized use.

4. Subprocessors

PNL also operates a media ingest worker for PNL Broadcast on infrastructure it controls in the United States. Planned additions, to be noticed under section 3.5 before use: a content delivery network, a virtual private server provider, a mobile device management vendor.

5. The Customer's obligations

The Customer will: have a lawful basis for collecting and submitting Customer Personal Data; give notices and obtain consents required by law (including for location capture, monitoring, and managed devices); configure the Services appropriately (roles, PINs, retention choices, geofences); not submit sensitive data categories the Services are not designed for; respond to data subject requests; and give PNL only instructions that comply with law. The Customer is responsible for its own compliance and for its subcontractors and venues.

6. International transfers

Customer Personal Data is processed in the United States. If the Customer submits data about people outside the United States, the Customer is responsible for having a lawful transfer basis. PNL does not currently offer EU or UK standard contractual clauses; if the Customer needs them, ask, and PNL will consider them on a case-by-case basis.

7. Liability and precedence

Each party's liability under this Addendum is subject to the limitations and exclusions in the Terms. If this Addendum conflicts with the Terms on a data-protection point, this Addendum controls for that point; otherwise the Terms control. Where a law requires more of PNL than this Addendum states, the law controls, and the parties will cooperate to amend this Addendum.

8. Term

This Addendum lasts as long as PNL processes Customer Personal Data.

Proto Node Labs Data Processing Addendum, Version 2026-10-13.

Previous versions

This is version 2026-10-13, effective October 17, 2026. It is the first version published under this numbering, so there are no earlier versions of this document to list. When we publish a new version, earlier versions stay on file and we will send you a copy of any version that applied to you on request at [email protected].

The other legal documents:

• Terms of Service
• Schedule 02: PNL Timesheet
• Schedule 03: PNL Inventory
• Schedule 04: PNL Broadcast
• Schedule 05: Website Hosting
• Schedule 06: PNL-Ops and PNL Scheduler
• Privacy Policy
• Acceptable Use Policy