Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Advisacor Terms of Service ("Terms") between Wiseman Financial Technologies, LLC ("Advisacor") and the business customer that accepts the Terms ("Customer"). It takes effect when Customer accepts the Terms or this DPA, whichever comes first. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA controls.

1. Definitions

• Customer Personal Data: personal information within Customer Data that Advisacor processes on Customer's behalf.
• Security Incident: a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
• Sub-processor: a third party Advisacor engages to process Customer Personal Data.

Other capitalized terms have the meanings in the Terms. "Controller," "processor," and "service provider" have the meanings given in applicable data protection law, including the Virginia Consumer Data Protection Act and the California Consumer Privacy Act.

2. Roles and scope

Customer is the controller (or business) and Advisacor is the processor (or service provider) of Customer Personal Data. Annex A describes the processing. Advisacor processes Customer Personal Data only to provide, secure, and support the Service.

3. Customer instructions

Advisacor processes Customer Personal Data only on Customer's documented instructions. The Terms, Customer's use of the Service's features (including approving journal entries for write-back), and this DPA are Customer's complete instructions. Advisacor will tell Customer if it believes an instruction violates law. Advisacor will not sell or share Customer Personal Data, use it for targeted advertising, or combine it with data from other sources except as needed to provide the Service.

4. Personnel

Advisacor limits access to Customer Personal Data to personnel who need it to provide the Service and who are bound by confidentiality obligations.

5. Security

Advisacor maintains the administrative, technical, and physical safeguards in Annex B and may update them if the overall level of protection does not decrease.

6. Sub-processors

Customer authorizes the Sub-processors in Annex C. Advisacor binds each Sub-processor to written data protection terms at least as protective as this DPA and remains responsible for their performance. Advisacor will give at least 30 days' notice of a new Sub-processor by email or in-app notice. Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, Customer may cancel the affected Service and receive a pro-rated refund of prepaid fees for the remaining term.

7. Security incidents

Advisacor will notify Customer without undue delay, and no later than 72 hours after confirming a Security Incident. The notice will describe, as far as known, the nature of the incident, the data and accounts affected, likely consequences, and steps taken. Advisacor will reasonably cooperate with Customer's investigation and any notices Customer must give. Notice is not an admission of fault.

8. Assistance

Advisacor will reasonably assist Customer in responding to requests from individuals exercising privacy rights, and with data protection assessments, to the extent Customer cannot do so through the Service. Advisacor will forward any such request it receives directly to Customer.

9. Return and deletion

Customer may export Customer Data at any time before termination. After cancellation, Advisacor keeps Customer Data for a 30-day grace period, then permanently deletes it from active systems. Customer may request immediate deletion. Encrypted backups expire within 90 days after deletion. Advisacor may retain data where law or a legal hold requires, and keeps deletion records (which contain no accounting data) for seven years.

10. Audits and information

On written request no more than once a year, Advisacor will answer Customer's reasonable security questionnaire and provide summaries of its security controls. Once Advisacor obtains a SOC 2 report, it will provide a copy under confidentiality terms. On-site audits are limited to cases required by law or following a Security Incident, at Customer's expense, on 30 days' notice.

11. Location of processing

Advisacor processes and stores Customer Personal Data in the United States. The Service is offered to organizations located in the United States.

12. Restricted data

Customer will not submit protected health information (PHI) under HIPAA, payment card numbers, or Social Security numbers, except where a Service feature expressly requests them. Advisacor is not Customer's HIPAA business associate unless the parties sign a separate business associate agreement.

13. AI processing

Advisacor uses third-party AI models to process Customer Data only to provide the Service. Neither Advisacor nor its AI Sub-processors use Customer Data to train AI models.

14. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms.

15. Term

This DPA lasts as long as Advisacor processes Customer Personal Data.

Annex A: Description of processing

Annex B: Security measures

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256)
• Row-level security isolating each customer's data in the application database
• Multi-factor authentication for all administrative access and available to all users (authenticator app or security key)
• Least-privilege access to production systems
• OAuth 2.0 for accounting system connections; Advisacor never receives or stores accounting-system passwords
• Human approval required before any entry is written to a customer's accounting system
• Append-only audit logs of privileged actions, AI actions, journal-entry posting, and deletions
• Continuous compliance monitoring against SOC 2 control criteria
• Hosting on providers with SOC 2 Type II reports
• Automated data deletion after cancellation, with a deletion audit trail
• Written information security policy and incident response plan, reviewed at least yearly

Annex C: Sub-processors

Contact

Wiseman Financial Technologies, LLC
Attn: Legal
2023 South Stewart Ave
Covington, VA 24426
Email: mwiseman@advisacor.com