This US Data Protection Addendum (“DPA”) governs the processing of personal data by Unipie, Inc. dba Minoa, 1401 21st St., Suite 5305, Sacramento, CA 95811, USA (“Unipie”, “Processor”) on behalf of the customer identified in an Order Form that references the Unipie General Terms and Conditions (“Customer”, “Controller”), and forms part of the agreement between them consisting of the Order Form and the General Terms and Conditions (the “Agreement”). By executing the Order Form, Customer agrees to the terms of this DPA, which is effective as of the Effective Date of the Order Form; no separate signature is required for this DPA to be binding. This version is dated October 6, 2026; previous versions are available in the archive at https://www.minoa.io/legal/.

This DPA applies to the extent that Unipie processes Personal Data on behalf of the Customer in the course of providing the Services, where such processing is subject to the US Privacy Laws (as defined below).

Capitalized terms not otherwise defined in this DPA shall have the meanings given to them in the Agreement. The Parties agree that the terms and conditions of this DPA shall govern the processing of Customer Personal Data and shall prevail over any conflicting provisions in the Agreement with respect to such processing.

The Controller and the Processor are hereinafter collectively referred to as the “Parties” and individually as a “Party”.

1. Definitions

1.1 For the purposes of this DPA, capitalized terms shall only have the meaning set forth below. Capitalized terms used but not otherwise defined in this DPA shall have the meaning set forth in the Agreement.

1.2 “Consumer” shall have the meaning set forth under the US Privacy Laws, as applicable.

1.3 “Controller” shall have the meaning defined under the US Privacy Laws and also include, whenever applicable, the term “business”, as defined in the CCPA.

1.4 “Personal Data” shall have the meaning set forth under the US Privacy Laws and also include, whenever applicable, the term “personal information”, as defined in the CCPA. For the purpose of this DPA, reference is exclusively made to the categories of Personal Data, as may be more detailed described in the Agreement, contained within the data or set of data that the Processor processes on behalf of the Controller, in connection with the provision of the services subject matter of the Agreement.

1.5 “Processor” shall have the meaning given under the US Privacy Laws and also include, whenever applicable, the term “service provider”, as defined in the CCPA.

1.6 “Sell” or “Selling” shall have the meaning set forth in the US Privacy Laws, as applicable.

1.7 “Share” or “Sharing” shall have the meaning defined under the CCPA.

1.8 The expression “US Privacy Laws” refers to applicable US state privacy laws, including, but not limited to, the following laws, as applicable:

1.8.1 California Consumer Privacy Act, as amended by the California Privacy Rights Act and relevant regulations issued by the California Privacy Protection Agency (the “CCPA”),

1.8.2 Virginia Consumer Data Protection Act (the “VCDPA”),

1.8.3 Colorado Privacy Act and relevant rules issued by the Colorado Attorney General (the “CPA”),

1.8.4 Connecticut Data Privacy Act (the “CTDPA”),

1.8.5 Utah Consumer Privacy Act (the “UCPA”),

1.8.6 Texas Data Privacy and Security Act (“TDPSA”),

1.8.7 Florida Digital Bill of Rights (“FDBR”),

1.8.8 Oregon Consumer Privacy Act (“OCPA”).

1.9 Any other terms, including, among others, “business”, “business purpose”, “commercial purpose”, “process” or “processing”, used but not otherwise defined in the DPA or Agreement, shall have the meaning set forth under the US Privacy Laws, as applicable.

2. General Obligations

2.1 The Processor acknowledges that the Controller is disclosing Personal Data only in relation to the limited and specified business purposes agreed between Parties in the Agreement.

2.2 The Processor shall not retain, use, disclose, or otherwise process Personal Data for any purpose other than for the business purposes specified in the Agreement, including retaining, using, or disclosing Personal Data for a commercial purpose other than the business purposes specified in the Agreement or as otherwise permitted by the US Privacy Laws, as applicable.

2.3 The Processor undertakes to comply with all requirements set forth in the US Privacy Laws, as applicable, and to provide the same level of privacy protection that they impose on the Controller, in relation to the processing of Consumers’ Personal Data.

2.4 AI training. The Controller instructs the Processor not to use Customer Personal Data to train, retrain, fine-tune or otherwise improve any artificial intelligence, large language or generative AI model, and the Processor shall not permit any Subprocessor to do so. Aggregated or de-identified data that does not identify the Controller or any Data Subject and does not constitute Personal Data is not Customer Personal Data for the purposes of this instruction.

2.5 Consumption Data. The Controller acknowledges that the Processor records which User or Customer-operated software agent performed which metered action in the Minoa Platform and when (“Consumption Data”) in order to measure the Controller’s use of the Services, to invoice it and to resolve disputes about it. the Processor may retain Consumption Data containing Personal Data for up to fifteen (15) months after the end of the month to which it relates, notwithstanding any earlier deletion of Customer Personal Data under this DPA, and shall delete it thereafter.

2.6 Controller-operated tools and agents. Third-party software and AI tools that the Controller connects to the Services (including through the Processor’s Model Context Protocol interface) act on the Controller’s instructions and under the Controller’s control; they are the Controller’s own service providers and not sub-processors of the Processor.

3. Data Retention and Deletion

3.1 The Processor shall return or delete all Personal Data once the provision of the services has been completed, or sooner, if directed so by the Controller, unless the retention of Personal Data is required by law.

3.2 Unless otherwise directed by the Controller, the Processor shall retain Personal Data after the termination of the Agreement and the completed provision of the services for the period agreed upon in the Agreement solely for the purpose of providing the Controller an export of it or to continue the provision of the services under a follow up agreement as may be agreed with the Controller. After the expiration of this retention period, the Processor shall delete all Personal Data.

3.3 Notwithstanding the foregoing, the Processor shall be entitled to retain, even after the provision of the services has been completed and the termination of the Agreement, all information necessary to demonstrate orderly and compliant processing, in accordance with statutory retention periods. The Processor may further retain Consumption Data in accordance with section 2.5 (Consumption Data).

3.4 Timelines. The Controller may export Personal Data through the export functions of the Services at any time during the term of the Agreement and for thirty (30) days after its end, or request an export from the Processor, which the Processor shall fulfil within thirty (30) days. the Processor shall securely delete all Personal Data within sixty (60) days after the later of the end of the Agreement and the fulfilment of an export request made within that thirty (30) day period, and shall confirm the deletion in writing upon request. Copies in backup and disaster-recovery systems are deleted in the ordinary course of the Processor’s backup cycle (currently within six (6) months) and remain subject to this DPA until deleted.

4. Data Use and Sharing Restrictions

4.1 The Processor shall not Sell nor Share any Consumers’ Personal Data unless agreed in the Agreement.

4.2 The Processor shall not retain, use, or disclose Personal Data outside of the direct relationship with the Controller.

4.3 The Processor shall not combine the Personal Data it receives from the Controller with personal data it receives from or on behalf of another person(s) or entity(ies) or that it collects from its own interaction with the Consumer, provided that the Processor may combine Personal Data to perform any business purpose identified by the US Privacy Laws, as applicable, or to aggregate and anonymize the data Personal Data for statistical purposes to improve services.

5. Confidentiality and Security

5.1 The Processor represents and guarantees that each person processing Personal Data within its organization is subject to a strict duty of confidentiality.

5.2 The Processor undertakes to strictly follow and adhere to the instructions of the Controller, including, among others, those regarding the return or destruction of Personal Data, and to assist the Controller in meeting its obligations under the US Privacy Laws, specific reference being made, inter alia, to those concerning the security of the processing and the notification of a breach of security.

5.3 The Parties undertake to implement and adopt all necessary technical and organizational measures to ensure a level of security of Personal Data that is appropriate taking into account the context of the processing and in relation to the risks associated with the processing of the Personal Data in their availability.

6. Compliance and Cooperation

6.1 The Processor shall assist the Controller in responding to Consumers’ requests for the exercise of the rights granted under the US Privacy Laws, including by, among others, providing access to, correcting, or deleting Personal Data in its availability or honoring opt-out requests. The Processor shall also notify its own sub-processors, service providers, and/or contractors and ensure that such requests are complied with.

6.2 If the Processor receives a Consumer request to delete Personal Data that the Processor processes on behalf of the Controller, the Processor shall inform the Consumer that it should submit the request directly to the Controller and, when feasible, provide the Consumer with relevant contact information.

6.3 The Processor shall enter into written agreements with each of its own sub-processors, service providers, and/or contractors that process Personal Data on its behalf. Such agreements shall set forth terms that are at least as restrictive as those imposed on the Processor under this DPA and guarantee the same level of privacy protection, including the prohibition to Sell and Share Consumers’ Personal Data.

6.4 The Processor undertakes to notify the Controller whenever it becomes aware that it can no longer meet its obligations under the US Privacy Laws, as applicable.

7. Controller's Rights and Assessment

7.1 The Controller shall have the right to take reasonable and appropriate steps to ensure that the Processor processes Personal Data in a manner consistent with the Controller's obligations under the US Privacy Laws, as applicable, and to stop and request a remediation of the Processor’s unauthorized and/or unlawful processing of Personal Data.

7.2 Upon reasonable request of the Controller, the Processor shall make available all information in its possession, which may be necessary to demonstrate its compliance with the requirements of the US Privacy Laws, as applicable.

7.3 The Processor shall allow reasonable assessments by the Controller. This includes, by way of example, providing the Controller with all necessary information to conduct and document data protection assessments.

8. No Consideration

8.1 Notwithstanding any contrary provision contained in the Agreement, the Processor’s access to Personal Data is not part of the consideration exchanged by the Parties under the Agreement.

9. Duration of this DPA

9.1 Notwithstanding the expiration of the Agreement, this DPA will remain in effect until, and automatically expire upon, the Processor’s deletion or return of all Personal Data to the Controller.

10. Conflicts

10.1 In the event of any conflict or inconsistency between this DPA and the terms of the Agreement, this DPA shall prevail concerning any processing of Personal Data, notwithstanding any statement to the contrary in the Agreement.

11. Notices and communication

11.1 Any notice or communication including but not limited regarding data subject requests to be served under this DPA shall be delivered in English to:

If to the Customer: Customer Contact in the applicable Order Form, unless specified otherwise in the Order Form.

If to Unipie: Richard Einhorn, richard@minoa.io

or at such other address as the Parties may indicate to each other in writing.