This Data Processing Addendum ("DPA") forms part of the agreement (the "Agreement") between MetisGrid ("MetisGrid") and the Customer using MetisForge under which MetisGrid processes Personal Data on Customer's behalf.

Capitalized terms not defined in this DPA have the meanings given in the Terms of Service or the applicable Order.

1. Definitions

"Customer Personal Data" means Personal Data contained in Customer Content and processed by MetisGrid on Customer's behalf.

"Data Protection Law" means all privacy and data-protection law applicable to processing covered by this DPA, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and applicable U.S. state privacy laws.

"EEA" means the European Economic Area.

"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision (EU) 2021/914.

"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0.

"Subprocessor" means a third party engaged by MetisGrid to process Customer Personal Data.

"Security Incident" has the meaning in Section 8 of the Terms of Service.

"Security Addendum" means the MetisGrid Security Addendum, which constitutes Annex II of this DPA.

2. Scope and Roles

For Customer Personal Data:

Customer acts as controller, business or equivalent responsible party; and
MetisGrid acts as processor, service provider or equivalent processing party.

Where Customer itself acts as a processor for a third-party controller, MetisGrid acts as Customer's subprocessor, and Customer warrants that its instructions are authorized by the controller.

Each party is responsible for its own compliance with Data Protection Law.

The subject matter, duration, nature and purpose of processing, the types of Personal Data and the categories of data subjects are set out in Annex I.

3. Processing Instructions

MetisGrid will process Customer Personal Data only on Customer's documented instructions, which consist of:

the Agreement, including this DPA;
Customer's configuration and use of the Service; and
documented support requests and other written instructions from Customer's authorized administrators.

MetisGrid will not process Customer Personal Data for any other purpose. Where applicable law requires MetisGrid to process Customer Personal Data other than on Customer's instructions, MetisGrid will inform Customer of that requirement before processing, unless the law prohibits such notice on important grounds of public interest.

If MetisGrid reasonably believes a Customer instruction violates Data Protection Law, MetisGrid will promptly notify Customer and may suspend the affected processing until the parties resolve the issue.

4. Customer Responsibilities

Customer is responsible for:

determining whether and how Customer Personal Data may lawfully be processed;
providing legally required notices to data subjects;
obtaining required consents or establishing another lawful basis;
responding to data subjects whose information Customer controls;
configuring Service access, roles and permissions appropriately; and
limiting Customer Personal Data to information reasonably necessary for Customer's use of the Service, and not submitting special categories of Personal Data or other specially regulated data unless agreed in writing.

5. Confidentiality

MetisGrid will ensure that personnel authorized to process Customer Personal Data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality, and process Customer Personal Data only as instructed.

6. Security

MetisGrid will implement and maintain the technical and organizational measures set out in the Security Addendum (Annex II), designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

MetisGrid may update those measures over time provided that updates do not materially reduce the overall level of protection applicable to Customer Personal Data during a subscription term.

7. Subprocessors

Customer provides general written authorization for MetisGrid to engage Subprocessors to process Customer Personal Data in connection with the Service. The Subprocessors engaged as of the effective date are listed in Annex III (the Subprocessor List page).

MetisGrid will:

impose on each Subprocessor, by written contract, data-protection obligations providing at least the same level of protection as this DPA;
remain fully liable to Customer for the performance of each Subprocessor's obligations; and
give Customer at least 30 days' prior written notice of any new Subprocessor by updating the Subprocessor List page and emailing Customer's administrator of record, or through a subscription mechanism on that page.

Customer may object to a new Subprocessor on reasonable data-protection grounds by notifying MetisGrid in writing within 30 days of the notice. The parties will work in good faith to resolve the objection. If MetisGrid cannot provide a commercially reasonable alternative within 30 days of the objection, Customer may terminate the affected Service by written notice, and MetisGrid will refund prepaid fees for the unused portion of the subscription term.

8. AI Subprocessors

Where an AI provider processes Customer Personal Data on behalf of MetisGrid, that provider is a Subprocessor subject to Section 7.

MetisGrid will engage each AI Subprocessor only on terms that:

prohibit it from using Customer Content to train or improve its models, except where Customer expressly authorizes such use in writing;
limit its retention of Customer Content to the period reasonably necessary to process the request and for safety and abuse monitoring (currently 30 days); and
require security measures appropriate to the processing.

MetisGrid will not transmit to an AI Subprocessor any Customer Personal Data beyond what is reasonably necessary to perform the requested function.

9. Data Subject Requests

Taking into account the nature of the processing, MetisGrid will assist Customer, by appropriate technical and organizational measures, in fulfilling Customer's obligation to respond to requests from data subjects exercising rights under Data Protection Law. Customer may correct and delete Customer Personal Data using Service functionality or by request to MetisGrid, and MetisGrid will export Customer Personal Data on Customer's request.

If MetisGrid receives a request from a data subject relating to Customer Personal Data, MetisGrid will direct the data subject to Customer within 5 business days and will not respond to the substance of the request unless required by law or authorized by Customer.

10. Security Incidents

MetisGrid will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Security Incident affecting Customer Personal Data. Notification will be sent to Customer's administrator of record.

Notification may be provided in phases as information becomes available and will include, to the extent known:

the nature of the Security Incident, including categories and approximate number of affected data subjects and records;
the name and contact details of MetisGrid's point of contact;
the likely consequences; and
measures taken or proposed to address the Security Incident and mitigate its effects.

MetisGrid will cooperate with Customer and take reasonable steps to assist Customer in meeting its own notification obligations.

Notification of a Security Incident is not an admission of fault or liability.

Customer is responsible for determining whether notification to regulators, data subjects or other parties is required, except where Data Protection Law imposes that obligation directly on MetisGrid.

11. Assistance with Assessments and Consultations

Taking into account the nature of the processing and the information available to MetisGrid, MetisGrid will provide reasonable assistance to Customer with data-protection impact assessments and prior consultations with supervisory authorities, where required by Data Protection Law and related to the Service.

12. Audit and Compliance Information

MetisGrid will make available to Customer all information reasonably necessary to demonstrate compliance with its obligations under this DPA and Article 28 GDPR, and will allow for and contribute to audits conducted by Customer or an independent auditor mandated by Customer.

MetisGrid will first satisfy audit requests by providing its then-current security documentation, completed security questionnaires, penetration-test summaries, and any independent audit reports or certifications it holds.

Where Data Protection Law requires an on-site or direct audit beyond that documentation, Customer may conduct or appoint an independent auditor bound by confidentiality to conduct an audit:

no more than once in any 12-month period, unless required by a supervisory authority or following a Security Incident;
on at least 30 days' written notice;
during normal business hours and in a manner that does not unreasonably interfere with MetisGrid's operations;
subject to MetisGrid's reasonable confidentiality and security requirements; and
at Customer's expense, unless the audit reveals a material breach of this DPA by MetisGrid.

Audits will not include access to another customer's information or to information that would compromise the security of the Service.

13. Return and Deletion

During the subscription term, Customer may access, correct and delete Customer Personal Data using Service functionality, and MetisGrid will provide an export on Customer's request.

Following termination or expiration, MetisGrid will make Customer Personal Data available for export for 30 days. At Customer's election, communicated in writing during that period, MetisGrid will return Customer Personal Data in a commonly used machine-readable format. In the absence of an election, or after return, MetisGrid will delete Customer Personal Data from active systems within 30 days after the export period ends, and from backups within 90 days thereafter, and will certify deletion in writing on request.

MetisGrid may retain Customer Personal Data where required by applicable law, or where reasonably necessary to establish, exercise or defend legal claims, for only as long as that requirement applies. Retained data remains subject to this DPA until deleted.

14. International Transfers

Customer acknowledges that MetisGrid processes Customer Personal Data in the United States and that Subprocessors may process it in the locations listed in Annex III.

EEA transfers

To the extent Customer transfers Customer Personal Data subject to the GDPR to MetisGrid, the parties agree that the SCCs, Module Two (controller to processor), are incorporated into this DPA by reference and apply to those transfers, completed as follows:

Clause 7 (docking clause): included.
Clause 9 (use of subprocessors): Option 2 (general written authorization) with a 30-day notice period, as set out in Section 7.
Clause 11 (redress): the optional language is not included.
Clause 13 (supervision): the supervisory authority is determined by the location of Customer's establishment, or, where Customer is not established in the EEA, by the member state in which Customer's EU representative is established or in which the data subjects are located.
Clause 17 (governing law): the laws of Ireland.
Clause 18 (choice of forum): the courts of Ireland.
Annex I of the SCCs is completed by Annex I of this DPA. Annex II of the SCCs is completed by Annex II (the Security Addendum). Annex III of the SCCs is completed by Annex III.

Where Customer itself is a processor, Module Three (processor to processor) applies on the same terms.

UK transfers

To the extent Customer transfers Customer Personal Data subject to the UK GDPR to MetisGrid, the SCCs as incorporated above apply, amended by the UK Addendum, completed as follows:

Table 1: the parties and their details are as set out in Annex I.
Table 2: the Approved EU SCCs with the selections above.
Table 3: Annexes I, II and III of this DPA.
Table 4: either party may end the UK Addendum as set out in Section 19 of the UK Addendum.

Swiss transfers

To the extent Customer transfers Customer Personal Data subject to the FADP, the SCCs apply with these adaptations: references to the GDPR are read as references to the FADP; the Federal Data Protection and Information Commissioner is the competent supervisory authority; the courts of Switzerland are the competent courts under Clause 18(c); and the SCCs protect the data of legal entities until the FADP ceases to do so.

Precedence and alternatives

If the SCCs conflict with this DPA, the SCCs control. If a transfer mechanism above is invalidated, the parties will cooperate in good faith to implement a replacement mechanism. MetisGrid may rely on an adequacy decision or a certification under a recognized data-transfer framework in place of the SCCs where valid and applicable, and will notify Customer of any such change.

15. U.S. State Privacy Law Terms

To the extent MetisGrid processes Customer Personal Data as a "service provider," "contractor," "processor" or equivalent under applicable U.S. state privacy law, MetisGrid will:

process that information only for the limited and specified business purposes set out in the Agreement and Annex I;
not sell or share Customer Personal Data, or process it for targeted or cross-context behavioral advertising;
not retain, use or disclose Customer Personal Data outside the direct business relationship with Customer or for any purpose other than the specified business purposes;
not combine Customer Personal Data with Personal Data received from or on behalf of another person, or collected from its own interaction with individuals, except as permitted by law;
comply with applicable state privacy law and provide the same level of privacy protection as that law requires of Customer;
notify Customer within 10 business days if MetisGrid determines it can no longer meet its obligations under applicable state privacy law;
permit Customer, on reasonable notice, to take reasonable and appropriate steps to ensure MetisGrid uses Customer Personal Data consistently with Customer's obligations, and to stop and remediate unauthorized use; and
ensure each Subprocessor is bound by a written contract imposing the same obligations.

MetisGrid certifies that it understands these restrictions and will comply with them.

16. Liability

Each party's liability arising out of or related to this DPA, including the SCCs, is subject to the exclusions and limitations of liability in the Terms of Service, and the enhanced cap in Section 15 of the Terms of Service applies to breach of this DPA. Nothing in this section limits the rights of data subjects under the SCCs.

17. Term, Precedence and General

This DPA is effective for as long as MetisGrid processes Customer Personal Data on Customer's behalf and survives termination of the Agreement until all Customer Personal Data has been deleted or returned.

If this DPA conflicts with another provision of the Agreement concerning processing of Customer Personal Data, this DPA controls for that processing. Other provisions of the Agreement remain unchanged.

MetisGrid may update this DPA to reflect changes in Data Protection Law or the Service, provided updates do not materially reduce the protection of Customer Personal Data, and will give Customer at least 30 days' notice of material updates.

Annex I: Details of Processing

A. List of Parties

Data exporter (Customer): the Customer identified in the applicable Order or account registration. Role: controller (or processor, where Section 2 applies). Contact: the administrator of record.

Data importer (MetisGrid): MetisGrid, P.O. Box 1105, Wilmington, DE 19899, USA. Role: processor. Contact: privacy@metisgrid.com. Activities: provision of the MetisForge cybersecurity exercise, training and readiness platform.

B. Description of Transfer and Processing

Subject matter: Provision of the Service to Customer, including hosting, processing and AI-assisted generation and analysis of cybersecurity exercise content.

Duration: The subscription term, the export period, and the deletion period set out in Section 13.

Nature and purpose of processing: Hosting, storage, transmission, display, analysis, scoring, report generation, AI-assisted content generation, user authentication, access control, security monitoring, backup and support, for the purpose of enabling Customer to design, conduct, evaluate and report on tabletop exercises and related readiness activities.

Categories of data subjects:

Customer's employees, contractors and consultants who act as administrators, facilitators, participants or observers;
Customer's external participants invited to exercises (for example, advisors, vendors or partner-organization staff);
individuals referenced in Customer Content, including real or fictional persons named in scenarios, injects, responses and reports.

Categories of Personal Data:

identification and contact data: name, work email address, organization, job title;
account data: user identifier, role, permissions, authentication metadata;
exercise participation data: responses, chat and discussion content, facilitator notes, scores, grades, evaluations, training records;
content data: Personal Data that Customer chooses to include in scenarios, injects, uploaded documents and reports;
usage and technical data: IP address, device and browser information, sign-in and activity logs.

Special categories of Personal Data: None intended. Customer undertakes not to submit special categories of Personal Data (Article 9 GDPR), criminal-offense data, or other specially regulated data without MetisGrid's written agreement.

Frequency of transfer: Continuous, for the duration of the subscription.

Retention: As set out in Section 13 and the Terms of Service: deletion from active systems within 30 days after the 30-day export period, and from backups within 90 days thereafter.

Transfers to Subprocessors: As listed in Annex III, for the purposes stated there, for the same duration.

C. Competent Supervisory Authority

Determined in accordance with Clause 13 of the SCCs, as set out in Section 14.

Annex II: Technical and Organizational Measures

The Security Addendum, published at the Security page and incorporated by reference, constitutes Annex II. A copy as of the effective date of this DPA is available on request.

Annex III: Subprocessors

The Subprocessor List, published at the Subprocessor List page and incorporated by reference, constitutes Annex III. The list as of the effective date of this DPA is available on request.