Data Transfers Addendum

1. Introduction

This Data Transfers Addendum is incorporated by reference into the Data Processing Addendum between You and TITLEMAN Inc, which governs TITLEMAN Inc’s Processing of DPA Data (“DPA”). You may be referred to as “You” or “Customer” in Your TITLEMAN Inc Platform Agreement, or any other agreement entered into between You and TITLEMAN Inc pertaining to Your use of TITLEMAN Inc’s software-as-a-service offering (“Agreement”) and the DPA. Any capitalized terms not defined in this Data Transfers Addendum have the meanings given to them in the DPA or Agreement.

2. Order of Precedence

If, in connection with TITLEMAN Inc providing the Service to You, more than one of the following data transfer mechanisms could apply under applicable Data Protection Law to a transfer of DPA Data, You and TITLEMAN Inc agree that the transfer will be subject to one data transfer mechanism only, in the following order of precedence:

1. the Data Privacy Framework;
2. the UK International Data Transfer Addendum;
3. the EEA Standard Contractual Clauses (“EEA SCCs”); and
4. any other data transfer mechanism available under Data Protection Law that is incorporated into the DPA.

3. Data Privacy Framework

TITLEMAN Inc is self-certified under the Data Privacy Framework.

Where You transfer DPA Data originating from the EEA, the United Kingdom, or Switzerland to TITLEMAN Inc, TITLEMAN Inc will receive such DPA Data pursuant to the Data Privacy Framework and will process such data in accordance with the applicable data privacy principles and relevant supplemental principles set forth therein.

TITLEMAN Inc will notify You without undue delay if its self-certification under the Data Privacy Framework is withdrawn, terminated, revoked, or otherwise invalidated, in which case an alternative data transfer mechanism will apply in accordance with this Data Transfers Addendum.

4. The EU Standard Contractual Clauses

Module 2 (Controller to Processor) of the EEA SCCs, as completed in this Data Transfers Addendum, applies to any transfer of DPA Data from You to TITLEMAN Inc that is subject to Data Protection Law in the EEA and processed under the DPA.

The Parties agree that the EU Standard Contractual Clauses are incorporated by reference and form an integral part of this Addendum.

5. Module 2 (Controller to Processor)

The text of Module 2 (Controller to Processor) of the EEA SCCs, including Clauses 1 through 18 and all related obligations, applies without modification, except as expressly supplemented or completed by this Data Transfers Addendum, including the Appendices below.

• All references to “data importer” shall mean TITLEMAN Inc.
• All references to “data exporter” shall mean You.

Appendix to Module 2 (Controller to Processor)

A. LIST OF PARTIES

B. DESCRIPTION OF TRANSFER

• Categories of data subjects:
  Individuals identified in Customer Data and Content, including users and end clients.
• Categories of personal data:
  Account identifiers, contact information, technical identifiers, usage data, prompts, generated outputs, metadata, support communications, and any personal data uploaded by the Customer into the Service.
• Sensitive data:
  Any sensitive personal data included in Customer Data and Content, subject to appropriate safeguards. Not intentionally processed. If processed by Customer, such processing occurs solely under Customer’s responsibility and subject to appropriate safeguards.
• Frequency of transfer:
  Continuous.
• Nature and purpose of processing:
  Provision of the Service in accordance with the Agreement and DPA.
• Retention period:
  The term of the Agreement and any additional period specified in the Terms.

C. COMPETENT SUPERVISORY AUTHORITY

The data protection authority of the EU Member State in which the data exporter is established.

ANNEX II

Technical and Organizational Measures

TITLEMAN Inc will maintain and implement the technical and organizational measures described in the Security Addendum.

ANNEX III

List of Sub-Processors
Sub-processors are listed at:
https://titleman.ai/legal/subprocessors

6. UK International Data Transfer Addendum

The UK International Data Transfer Addendum, completed in accordance with this Data Transfers Addendum, applies to any transfer of DPA Data from You to TITLEMAN Inc that is subject to UK Data Protection Laws and processed under the DPA.

All references to Titleman AI Corporation are replaced with TITLEMAN Inc, and all references to Titleman.ai URLs are replaced with titleman.ai URLs where applicable. The substantive protections, mandatory clauses, governing law, and jurisdiction provisions apply unchanged, as required under UK Data Protection Laws.

7. Data Transfers from Switzerland

For transfers of DPA Data subject to Swiss Data Protection Law, the EEA SCCs apply as adapted by this Data Transfers Addendum, with references interpreted to include Switzerland, the Federal Act on Data Protection (FADP), and the Swiss Federal Data Protection and Information Commissioner (FDPIC), as applicable.