Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement (the RevPass Terms of Service and each Order Form, together the "Agreement") between Oasis Enterprise LLC, a Wisconsin limited liability company, doing business as RevPass ("RevPass") and the customer named in the Order Form ("Customer"). Terms not defined here have the meaning given in the Agreement.

1. Definitions

• Applicable Data Protection Law: the laws on personal data that apply to the processing under this DPA, including, where they apply, the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and U.S. state privacy laws such as the CCPA.
• Customer Personal Data: personal data in Customer Data that RevPass processes on Customer's behalf.
• Security Incident: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. It does not include unsuccessful attempts that do not compromise Customer Personal Data (for example failed sign-ins or blocked scans).
• Subprocessor: a third party RevPass engages to process Customer Personal Data.
• SCCs: the standard contractual clauses approved by the European Commission in Decision (EU) 2021/914.
• UK Addendum: the International Data Transfer Addendum issued by the UK Information Commissioner.
• "Controller", "processor", "data subject", "personal data" and "processing" have the meanings in the GDPR, and include the equivalent terms (such as "business" and "service provider") in other Applicable Data Protection Law.

2. Roles

1. Customer is the controller (or a processor acting for its own controller) of Customer Personal Data. RevPass is Customer's processor (or subprocessor).
2. RevPass is an independent controller of personal data it processes for its own purposes: account administration, billing, security of the service, and its own sales and support communications. RevPass's Privacy Policy covers that processing, not this DPA.

3. Instructions

1. RevPass will process Customer Personal Data only on Customer's documented instructions, unless law requires otherwise (in which case RevPass will tell Customer first, where lawful).
2. Customer's instructions are the Agreement, this DPA, and the choices Customer and its Authorized Users make in the service: uploading documents, connecting Salesforce or Slack, the Salesforce write setting (Off, Human only or Agent), the fields allowed for automatic correction, rules, retention settings, and actions such as applying a correction or marking a deal booked.
3. RevPass will tell Customer if, in its opinion, an instruction breaks Applicable Data Protection Law.

4. Customer obligations

Customer is responsible for having a lawful basis and giving the notices needed for the processing; for the permissions of the Salesforce user that connects RevPass and for the data that user lets RevPass read; for the people it invites and the roles it gives them; and for not uploading special-category or other sensitive personal data unless the parties agree in writing.

5. Confidentiality of personnel

RevPass will ensure that everyone it authorises to process Customer Personal Data is bound by confidentiality, and will limit access to people who need it to run, secure or support the service.

6. Security

RevPass will maintain the technical and organizational measures in Annex II. RevPass may update them, but will not materially reduce the overall level of protection during the term.

7. Subprocessors

1. Customer authorises RevPass to use the Subprocessors listed in Annex III.
2. RevPass will have a written agreement with each Subprocessor that protects Customer Personal Data at least as well as this DPA does, to the extent relevant to the Subprocessor's service, and remains responsible for each Subprocessor's performance.
3. RevPass will give Customer at least 30 days' notice before a new Subprocessor begins processing Customer Personal Data, by email to Customer's administrators and by updating the list at revpass.io/security.
4. Customer may object on reasonable data-protection grounds within the notice period. The parties will discuss the objection in good faith. If it cannot be resolved, Customer may terminate the affected part of the service and receive a refund of prepaid fees for the remaining term.
5. Salesforce and Slack are systems Customer chooses to connect and controls. They act under Customer's own agreements with them and are listed in Annex III for transparency only.

8. AI processing

1. RevPass uses Anthropic's API (Claude) as a Subprocessor to read documents and produce findings. For each check, the whole document and the related deal fields are sent. Messages to the RevPass Slack app or in-app assistant are also processed by Claude.
2. Under Anthropic's commercial terms, data sent through the API is not used to train Anthropic's models. RevPass will not allow any Subprocessor to train general-purpose models on Customer Personal Data, and RevPass does not train models on it.
3. AI output can be wrong. Findings are aids for Customer's review (see the Terms).

9. Data subject requests

RevPass will, taking into account the nature of the processing, help Customer respond to requests from data subjects. Inside the service, Customer's administrators can export the workspace's data and can deactivate a user and erase their personal details. If RevPass receives a request directly, it will pass it to Customer and will not respond except on Customer's instructions, unless law requires.

10. Other assistance

RevPass will give Customer reasonable information and help for data protection impact assessments and consultations with supervisory authorities, to the extent they concern the service.

11. Security Incidents

1. RevPass will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident affecting Customer's data.
2. The notice will include, as far as then known, what happened, the categories and approximate numbers of data subjects and records affected, likely consequences, and what RevPass has done or proposes to do. RevPass will add information as it becomes available.
3. RevPass will take reasonable steps to contain and remedy the incident and will cooperate with Customer.
4. Notifying an incident is not an admission of fault.

12. Audits

1. RevPass will make available the information reasonably needed to show compliance with this DPA, including completed security questionnaires and a description of its controls. RevPass does not hold a SOC 2 report or third-party penetration test today; SOC 2 Type I is on RevPass's roadmap. When such reports exist, RevPass will provide them under confidentiality.
2. If that information is not enough to meet Customer's legal obligations, Customer may audit RevPass once a year, on 30 days' notice, at Customer's cost, by Customer or an independent auditor bound by confidentiality, during business hours and without unreasonable disruption.

13. Return and deletion

1. During the term, Customer's administrators can download an export of the workspace (original uploaded files, extracted terms, findings, deals and the audit log) from Settings.
2. Customer can set a retention period in the service. Documents on deals that closed more than that many days ago are then deleted automatically each day; signed (executed) documents and audit records are kept. By default no retention period is set.
3. Customer's administrator can delete the workspace from Settings. Sign-in stops at once; the workspace can be restored for 7 days; after that RevPass permanently deletes its records and stored files.
4. On termination of the Agreement, RevPass will, at Customer's choice, return Customer Personal Data by providing an export within 30 days of Customer's request, and will then delete it as in section 13.3 no later than 60 days after termination, unless law requires RevPass to keep it.
5. Database backups are provided by RevPass's database provider (Supabase) under its standard service. Copies in those backups expire under RevPass's database provider's standard retention and are not restored except to recover the service.
6. Deleting the workspace does not revoke RevPass's access in Customer's Salesforce or Slack; Customer should remove the RevPass connected app and Slack app.
7. On request, RevPass will confirm deletion in writing.

14. International transfers

1. RevPass and most Subprocessors process data in the United States (see Annex III).
2. For transfers of Customer Personal Data from the EEA, the SCCs are incorporated: Module Two where Customer is a controller, Module Three where Customer is a processor. Annexes I, II and III of this DPA complete the SCC annexes.
3. For transfers from the UK, the UK Addendum is incorporated. For transfers from Switzerland, the SCCs apply with the adjustments the Swiss FADP requires.

15. U.S. state privacy laws

Where the CCPA or similar U.S. state laws apply, RevPass is a service provider or processor. RevPass will not sell or share Customer Personal Data, will not use it outside the business purposes in the Agreement, and will not combine it with other personal data except as those laws allow. RevPass will tell Customer if it can no longer meet these obligations.

16. Liability

Each party's liability under this DPA is subject to the limits and exclusions in the Agreement (Terms, section 15).

17. Term and precedence

This DPA lasts as long as RevPass processes Customer Personal Data. If it conflicts with the Agreement on personal data, this DPA prevails; the SCCs and UK Addendum prevail over both.

18. Assignment

RevPass may assign this DPA together with the Agreement, as the Terms allow, including to an affiliate or to a successor entity formed to operate the RevPass business, on written notice to Customer.

Annex I — Details of processing

A. Parties

• Data exporter: Customer, as named in the Order Form. Role: controller (or processor).
• Data importer: Oasis Enterprise LLC, a Wisconsin limited liability company, doing business as RevPass, 708 Heartland Trl, 3rd Floor, Madison, WI 53717, privacy@revpass.io. Role: processor (or subprocessor).

B. Subject matter

Providing the RevPass service: reviewing customers' signed documents against their Salesforce data and their own master agreements and rules.

C. Nature and purpose

• Storing documents Customer uploads (signed order forms, purchase orders, MSAs and related files).
• Reading them with an AI model to extract terms, and comparing the terms with Salesforce data, with the customer's MSA and with Customer's rules.
• Showing findings, each linked where possible to the page it came from.
• Reading Salesforce records through Customer's connection, and writing to Salesforce only as Customer's write setting allows (corrections a person applies; and, if Customer chooses the Agent setting and turns each on, automatic corrections to allowed Opportunity fields, automatic Closed Won at the point Customer chooses, and attaching the signed document).
• Tracking booking status.
• Sending notifications by email and, if connected, Slack; answering questions in the Slack app and in-app assistant.
• Showing the RevPass panel inside Salesforce.
• Reporting, audit logging, data export, deletion and retention.

D. Duration

The term of the Agreement and the deletion period in section 13.

E. Categories of data subjects

• Customer's Authorized Users.
• Customer's other staff named in documents or Salesforce (for example account owners and signatories).
• People at Customer's customers, partners and suppliers named in documents or Salesforce (for example signatories, billing contacts and procurement contacts).

F. Categories of personal data

• Authorized Users: name, email, role, sign-in identifiers, Slack user ID and Salesforce user ID where linked, activity in the audit log.
• People named in documents or Salesforce: name, job title, business email, business phone, business address, signature blocks and similar business contact details, and the commercial terms of the deal they relate to.

G. Sensitive data

None intended. Customer will not upload special-category data.

H. Frequency

Continuous, as Customer uses the service.

I. Retention

As set out in section 13.

Annex II — Technical and organizational measures

These describe what RevPass does today.

1. Encryption. TLS for all traffic to the service. Data at rest encrypted by the database and object-storage providers. Salesforce and Slack credentials (OAuth tokens) additionally encrypted in the application with AES-256-GCM. The encryption key is versioned so it can be rotated without losing stored credentials.
2. Identity and access. Sign-in through Clerk on a verified email. Access to a workspace is by invitation only; new workspaces are set up by RevPass. Roles (administrator, Order Management, Order Management manager, sales manager, sales rep) limit what users can see and do; for example only administrators and Order Management can search Salesforce, and only administrators can change the Salesforce write setting or export data. Sales reps see only the deals they own in Salesforce or are assigned to, and sales managers additionally see their direct reports' deals.
3. Tenant isolation. Every record is tied to one customer organization, and each request is checked against the signed-in user's organization.
4. Salesforce writes. A single per-workspace switch (Off by default) is checked on every write path. Automatic corrections are limited to Opportunity fields Customer allows and never include amount, stage, owner, close date or currency; the previous value recorded in the audit log comes from a fresh read of Salesforce. RevPass never deletes Salesforce records. RevPass recommends a dedicated Salesforce integration user with a minimal permission set and publishes the exact objects and access needed. When Salesforce is connected, RevPass checks whether the connected user holds "Modify All Data" or "View All Data" and warns administrators if so; it does not refuse the connection.
5. AI processing. Documents are processed through Anthropic's API under commercial terms that exclude training. When reading a document, its text is passed to the model as delimited data, separate from RevPass's instructions, and extracted values are checked against the document before they can drive an automatic correction. Natural-language rules can raise findings but cannot trigger a Salesforce write. Per-organization rate limits and a monthly AI processing limit apply.
6. Audit logging. Sign-ins, document uploads and downloads, data exports, Salesforce writes (with field, new value and previous value for corrections), bookings and key review actions are recorded with the person or agent responsible and the time.
7. Application security. Inbound webhooks are signature-checked; shared secrets are compared in constant time; requests are authenticated and authorised per route; production and test databases are separate, and scripts refuse to run against production without an explicit override. Errors are reported to Sentry with email addresses removed. Browser security headers (HSTS, content-type and referrer protections, frame restrictions) are set on every page. Errors never include document text or model output.
8. Backups and recovery. Database backups are provided by the database provider (Supabase) under its standard service.
9. Monitoring and incident response. Errors are reported to Sentry.
10. Retention and deletion. Customer-set retention, workspace deletion after a 7-day grace, and user erasure, as described in section 13.
11. Personnel. Production access is limited to named RevPass personnel bound by confidentiality.
12. Certifications. None today. SOC 2 Type I and a third-party penetration test are on RevPass's roadmap.

Annex III — Subprocessors

Salesforce and Slack process Customer Personal Data only when Customer connects them. Customer controls these connections (see section 7.5).