Data Processing Agreement

This Data Processing Agreement ("DPA") is incorporated into and forms part of the Pierview Terms of Service between Pierview, Inc. ("Pierview", "Processor") and the customer entity that has agreed to those terms ("Customer", "Controller"). This DPA applies where and to the extent that Pierview processes Personal Data on behalf of Customer in connection with the Pierview platform and services.

1. Roles and Processing Instructions

The parties acknowledge that Customer is the Controller and Pierview is the Processor with respect to Personal Data processed under the Agreement. Pierview shall process Personal Data only on documented instructions from Customer, including as set forth in this DPA and the Agreement, unless required to do so by applicable law.

If Pierview is required by law to process Personal Data for a purpose other than those set forth in this DPA, Pierview shall inform Customer of that requirement before processing unless prohibited by law.

Permitted Purposes

Pierview is authorized to process Personal Data solely for the following purposes:

• Providing and maintaining the Pierview analytics platform and services
• Detecting and reporting AI agent visits to Customer's website
• Processing website visitor analytics data collected via Customer's installed tracking script
• Integrating with third-party services authorized by Customer (e.g., Google Search Console, Vercel)
• Providing customer support and responding to Customer requests
• Complying with legal obligations

2. Confidentiality of Processing

Pierview shall ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Pierview shall ensure that access to Personal Data is limited to those personnel who require access for the purposes set out in this DPA.

3. Security Measures

Pierview shall implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include:

• Pierview will encrypt Customer Personal Data in accordance with industry accepted standards, strong encryption techniques, and current security protocols
• Role-based access controls limiting data access to authorized personnel only
• Regular security reviews, vulnerability assessments, and updates
• Logical isolation of Customer data
• Access logging and monitoring for systems handling Personal Data

Security Incident Notification

In the event of a Personal Data breach, Pierview shall notify Customer without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach. The notification shall include: (a) the nature of the breach; (b) the categories and approximate number of Data Subjects and records concerned; (c) likely consequences of the breach; and (d) measures taken or proposed to address the breach.

4. California Consumer Privacy Act (CCPA)

To the extent the CCPA applies, Pierview is a "service provider" as defined by the CCPA. Pierview shall not: (a) sell or share Personal Data; (b) retain, use, or disclose Personal Data for any purpose other than providing the services specified in the Agreement; (c) retain, use, or disclose Personal Data outside of the direct business relationship with Customer; or (d) combine Personal Data received from Customer with Personal Data received from other sources, except as permitted by the CCPA. Pierview certifies that it understands and will comply with these restrictions.

5. Subprocessors

Customer grants Pierview a general written authorization to engage Subprocessors. Pierview shall inform Customer of any intended changes to its list of Subprocessors by providing at least 30 days' prior notice, giving Customer the opportunity to object. Pierview shall impose data protection obligations on each Subprocessor equivalent to those in this DPA.

Current Subprocessors:

6. International Data Transfers

6.1 Transfer Mechanism

Customer acknowledges that Pierview and its Subprocessors process Personal Data in the United States. To the extent Pierview processes Personal Data that is subject to the EU General Data Protection Regulation ("GDPR"), the UK GDPR or the Swiss Federal Act on Data Protection ("FADP") in a country that has not received an adequacy decision, the parties agree that the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914 ("Standard Contractual Clauses") are incorporated into this DPA by reference and apply as follows:

• (a) Where Customer is a Controller, Module Two (Controller to Processor) applies. Where Customer is itself a Processor acting on behalf of a third-party Controller, Module Three (Processor to Processor) applies.
• (b) The optional docking clause in Clause 7 does not apply.
• (c) Option 2 (general written authorization) of Clause 9(a) applies, with the notice period for changes to Subprocessors set out in Section 5 of this DPA.
• (d) The optional language in Clause 11 does not apply.
• (e) For Clause 13, the competent supervisory authority is the one determined in accordance with Clause 13 based on Customer's establishment or representative.
• (f) For Clauses 17 and 18, the Standard Contractual Clauses are governed by the laws of Ireland, and disputes are resolved before the courts of Ireland.
• (g) Annex I is completed by Section 6.4 of this DPA, Annex II by Section 3 (Security Measures), and Annex III by the Subprocessor list in Section 5.

6.2 UK Transfers

For Personal Data subject to the UK GDPR, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner ("UK Addendum") applies. Table 1 is completed by the parties' details in the Agreement, and Tables 2 and 3 are completed by Sections 6.1 and 6.4 of this DPA. For Table 4, neither party may terminate the UK Addendum under its Section 19.

6.3 Swiss Transfers

For Personal Data subject to the FADP, the Standard Contractual Clauses apply as set out in Section 6.1, with the following changes: references to the GDPR are read as references to the FADP; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; and the term "Member State" is read to include Switzerland, so that data subjects in Switzerland can enforce their rights there.

6.4 Description of the Transfer

• Data exporter: Customer, as identified in the Agreement.
• Data importer: Pierview, Inc., acting as Processor. Contact: support@pierview.ai.
• Categories of data subjects: Customer's authorized users of the Pierview platform, and visitors to Customer's websites where Customer has installed Pierview's tracking script or connected a hosting integration.
• Categories of Personal Data: For users, names, email addresses, organization details and account credentials. For website visitors, page views, referrer information, device type and session data.
• Sensitive data: None intended.
• Frequency of transfer: Continuous, for the duration of the Agreement.
• Nature and purpose of processing: The Permitted Purposes listed in Section 1.
• Retention: For the duration of the Agreement, after which Personal Data is deleted or returned in accordance with Section 10.
• Transfers to Subprocessors: As listed in Section 5, for the purposes stated there.

6.5 Onward Transfers

Pierview will transfer Personal Data to a Subprocessor outside the European Economic Area, the United Kingdom or Switzerland only where the Subprocessor is certified under the EU-U.S. Data Privacy Framework (and its UK Extension and the Swiss-U.S. Data Privacy Framework, where applicable), or where Pierview has entered into Standard Contractual Clauses (Module Three) or another lawful transfer mechanism with that Subprocessor.

6.6 Transfer Impact Assessment

Pierview has assessed the laws of the United States as they apply to the Personal Data it processes under this DPA. Pierview will provide reasonable information to Customer, on request, to assist Customer with its own assessment.

6.7 Order of Precedence

In the event of any conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

7. Data Subject Rights

Pierview shall, to the extent legally permitted, promptly notify Customer if it receives a request from a Data Subject to exercise any rights under applicable Data Protection Laws. Pierview shall not respond to Data Subject requests directly unless authorized by Customer or required by law. Pierview shall provide Customer with reasonable assistance to fulfill its obligations to respond to Data Subject requests, including requests for access, rectification, erasure, restriction, portability, and objection.

8. Assistance to Customer

Taking into account the nature of processing and information available to Pierview, Pierview shall provide reasonable assistance to Customer in ensuring compliance with Customer's obligations under applicable Data Protection Laws, including with respect to:

• Data protection impact assessments
• Prior consultation with supervisory authorities
• Security of processing
• Notification of Personal Data breaches

9. Audits and Inspections

Upon Customer's reasonable written request, Pierview will permit Customer, at Customer's expense, to audit Pierview's applicable controls and compliance with this DPA (an "Audit"), provided such Audit is: (a) conducted by Customer or a third-party auditor designated by Customer that has executed an appropriate non-disclosure agreement with Pierview; (b) Customer and Pierview mutually agree on reasonable details of the Audit, including the start date, scope and duration of, and security and confidentiality controls applicable to, such Audit; and (c) a similar Audit has not already been conducted less than twelve (12) months prior, unless it is required by a supervisory authority or other regulatory authority responsible for the enforcement of applicable Data Protection Laws. Customer will pay all costs and expenses incurred by Pierview in connection with any such Audit. Customer may use the results of an Audit only for the purposes of meeting Customer's regulatory audit requirements and confirming compliance with the requirements of this DPA.

10. Deletion and Return of Data

Upon termination of the Agreement or upon Customer's written request, Pierview shall delete or return all Personal Data processed on Customer's behalf, and delete existing copies, unless applicable law requires storage of the Personal Data. Pierview shall certify in writing to Customer upon request that it has complied with this obligation.

Contact

Questions regarding this Data Processing Agreement should be directed to support@pierview.ai.