SafeGora Named Consultant Data Processing Addendum

Document identifier sg-consultant-dpa

Version 2026-10-23.4

Effective Date October 23, 2026

1 Application and standard schedule

This Data Processing Addendum (DPA) forms part of the Agreement between OllieLabs LLC, operating as SafeGora, and the Customer identified in the accepted Order. It governs personal information SafeGora processes on the Customer's behalf through the named-consultant service (Customer Personal Data).

Annex A supplies the standard processing description for this offer. It applies when the Agreement is accepted; no separate customer questionnaire is required for that standard description. The Customer's identity and contact details are incorporated from the Order and maintained account details. An agreed supplement is needed only for a material use outside the standard description or where applicable law requires additional terms.

The Customer is a controller or business for data it controls. Where it acts for an employer as a processor or service provider, it must have authority to appoint SafeGora as a further processor and give the relevant instructions. SafeGora's role follows the actual processing, authority and law. Neither this DPA nor payment creates an employer's permission or transfers ownership of employer records.

SafeGora separately determines the purposes of certain account administration, payment, fraud-prevention and measurement activities described in the Privacy Notice. Calling those activities separate does not permit SafeGora to repurpose Customer Personal Data contrary to this DPA or override the role required by law.

2 Instructions and permitted use

The Agreement, the standard schedule, the Customer's authorized configuration and feature use, and lawful written directions are the Customer's documented instructions. SafeGora may process Customer Personal Data only to provide the agreed service, maintain its security and reliability, improve the Services as the Terms permit, carry out those instructions, or comply with applicable law. SafeGora will notify the Customer before legally compelled processing unless the law prohibits notice.

A customer-enabled integration described in the Terms is a Customer instruction. A third-party host that receives results through such an integration is not a subprocessor under section 5.

The Customer must provide necessary notices, establish an appropriate legal basis and obtain required permissions for the information and instructions it supplies. SafeGora will tell the Customer if it reasonably believes an instruction violates applicable data-protection law and may pause the affected instruction while the parties resolve it. That pause must be limited to what is reasonably necessary.

Where California service-provider or contractor rules apply, SafeGora will not sell or share Customer Personal Data, retain, use or disclose it outside the specified business purposes or direct business relationship, or combine it with other personal information except as applicable law permits. Where SafeGora acts as a contractor under the California Consumer Privacy Act, it certifies that it understands these restrictions and will comply with them. SafeGora will provide the required level of protection, notify the Customer if it can no longer meet these obligations, and permit reasonable steps to stop and remedy unauthorized use. These restrictions also govern relevant downstream processing. They do not eliminate individuals' statutory rights.

Do not provide data requiring a HIPAA business associate agreement, a government-specific agreement or another special authorization unless that agreement or authorization is in place for the proposed use. Ordinary employment information is not automatically HIPAA-regulated merely because it concerns health; its actual source, holder and use matter. The parties must assess sensitive information and minimize it to the authorized purpose.

3 People, security and incidents

SafeGora will limit access to persons who need it for their duties, require confidentiality obligations, and maintain reasonable technical and organizational measures appropriate to the information and risks, including Annex B. SafeGora remains responsible for its personnel's compliance. The Customer must maintain its user roster and employer permissions and promptly report suspected compromise.

SafeGora will notify the Customer without undue delay after becoming aware of a security breach affecting Customer Personal Data, and meet any shorter applicable legal deadline. The notice will include known facts about the incident, affected information, likely consequences, containment and remediation, and a contact. SafeGora may provide information in stages as the investigation develops. It will take reasonable steps to contain and remedy the incident, preserve relevant evidence and assist the Customer with applicable notification duties. Notice is not an admission of liability.

An unsuccessful attack or blocked attempt that does not compromise Customer Personal Data is not itself a reportable breach under this clause. The parties must not use that distinction to withhold notice of an actual incident. SafeGora will not notify affected individuals on the Customer's behalf without instructions unless law requires it.

4 AI assistance

Where AI assistance and retrieval are made available and enabled for the Customer, the processing described in this section uses the Google services identified in Annex C. Processing may include questions, notes, authorized record context, compliance summaries and photographs used in visit-report drafting, as well as creating embeddings from text. An instruction to use an enabled workflow includes the processing reasonably necessary for that workflow as described in the Agreement; it does not authorize unrelated model development or advertising use of Customer Personal Data.

SafeGora must choose and operate provider services under written terms compatible with this DPA. Provider products may have different data-use terms; the particular service used must satisfy this DPA. SafeGora will send Customer Data only to AI services offered under paid terms that prohibit the provider from using it to train or improve the provider's models. It will not send Customer Data to a connection subject to Google's Unpaid Services data-use terms. Before sending Customer Data to an AI service, SafeGora will verify that the provider service, account terms and configuration meet these requirements. A change to a provider service that materially expands permitted data use requires the notices, agreement and any separate consent required by the Agreement and law.

SafeGora receives no general license to train foundation models on Customer Data. Provider processing may nevertheless involve retention, caching and safety or abuse review under applicable service terms. This DPA does not promise zero provider retention, no possible human review, perfect redaction or a particular physical location for a global endpoint. Provider terms cannot reduce SafeGora's own obligations under this DPA. AI results require the human review described in the Terms.

5 Providers

The Customer generally authorizes the service providers described in Annex C for their stated processing purposes. SafeGora will impose written data-protection obligations appropriate to their role and no less protective of Customer Personal Data than this DPA requires, taking account of the nature of their services. SafeGora remains responsible for a subprocessor's performance of the processing obligations it delegates.

SafeGora will give the Customer at least 30 days' direct notice before adding or replacing a subprocessor or materially expanding a listed subprocessor's processing of Customer Personal Data. Notice must identify the provider, purpose and material location or data-use change. A listing update alone is insufficient notice. The Customer may object during that period on reasonable data-protection grounds.

The parties will try to resolve a reasonable objection through an appropriate alternative, safeguards or removal of the affected processing. SafeGora must not send the Customer's Personal Data to the disputed new processing while a timely reasonable objection remains unresolved. If no reasonable solution is available, either party may terminate the affected service before the change takes effect. The Customer receives the unused prepaid-fee refund specified in the Refund Policy. For this offer, the affected service is the whole subscription unless the parties have separately priced and accepted a distinct component. This agreed refund does not require a further discretionary approval.

6 Assistance and rights

Taking account of the processing and information available to it, SafeGora will reasonably assist the Customer with access, correction, deletion, portability, restriction, objection and other applicable privacy rights; security and incident obligations; legally required assessments; and consultations with regulators. It will promptly forward a request concerning Customer Personal Data unless authorized to respond directly. It may verify the requester's identity and authority proportionately.

The Customer remains responsible for deciding and documenting its lawful response. SafeGora will not disclose employer information to a consultant whose permission has expired or been revoked merely because that person requests an export or exercises an account right. A rights request does not authorize destruction of another organization's lawfully retained records.

7 Transfers

The Customer understands that the primary application region, an AI endpoint and a provider's support locations are different matters. Processing can occur in the locations described in Annex C, including global services. SafeGora will use legally required transfer safeguards for Customer Personal Data. If a particular transfer requires additional standard contractual clauses or another instrument, the parties must put the required instrument and particulars in place before that transfer. This DPA alone does not constitute an executed set of EU standard contractual clauses, a UK addendum or a HIPAA agreement.

8 Information reviews and audits

SafeGora will provide information reasonably necessary to demonstrate compliance with this DPA. The parties will ordinarily begin with current relevant reports, security information and written responses under confidentiality protections. This clause does not represent that SafeGora holds any particular certification or audit report.

If that information is insufficient for a reasonable compliance assessment, the Customer may request a proportionate audit by itself or a qualified independent auditor bound by confidentiality. Ordinarily an audit requires reasonable advance notice, occurs during business hours and is limited to once in twelve months. Additional or urgent review is allowed when reasonably necessary after a relevant incident, credible evidence of material noncompliance, or a regulator's or applicable law's requirement.

The parties will agree a reasonable scope and method that protects other customers, confidential security details and service availability. Intrusive testing of production systems requires advance written agreement unless competent legal authority requires it. SafeGora may offer equally effective evidence or a less disruptive method, but may not use scheduling, cost or confidentiality to frustrate a legally required review or reasonable verification and remediation rights.

The Customer normally pays its own auditor and expenses. Any charge for exceptional assistance beyond ordinary information requests must be reasonable and agreed in advance. SafeGora bears its own remediation costs and, if the review establishes its material breach of this DPA, the reasonable external audit costs attributable to that breach. No additional fee is a condition of meeting a nonwaivable legal obligation.

9 Return, deletion and retention

During the service and for at least 30 days after termination or expiry, the Customer may request a reasonable export of data it remains authorized to receive. SafeGora may use a secure assisted export if ordinary account access would be unsafe. This right does not require a new paid subscription or preserve revoked employer permissions.

After the export period, SafeGora will return or delete Customer Personal Data at the Customer's lawful choice. If the Customer gives no choice, SafeGora will delete it under the documented retention schedule. Retention beyond that is limited to specific legal requirements and narrowly necessary billing, security or dispute records where applicable law and the parties' actual roles permit it. SafeGora must identify the basis, minimize and restrict retained information to that purpose, and delete or lawfully and irreversibly de-identify it when the basis ends. Where applicable processor law permits retention only when law requires storage, that stricter rule controls. Employer records governed by a separate continuing relationship must be handled under that relationship and the employer's lawful instructions.

Backup copies may remain until their scheduled rotation and expiry. They must remain protected and must not be used for ordinary business processing. If restored, applicable deletion instructions and revoked access must be reapplied. SafeGora will provide available information about completion on a reasonable request. Moving information to an archive is not by itself deletion.

Annex D identifies the relevant retention categories. There is no blanket 90-day deletion promise. Google Cloud's required audit bucket has a fixed 400-day retention period, and copies in other destinations are subject to their own applicable schedules. SafeGora must maintain a documented, purpose-limited retention schedule and review it; this DPA does not authorize indefinite retention for convenience.

10 Liability and priority

The Terms' liability provisions, including the separate limit for privacy, security and confidentiality claims and their exceptions, apply to this DPA. They do not restrict a regulator's powers or an individual's nonwaivable rights. Where this DPA conflicts with another part of the Agreement about processing Customer Personal Data, this DPA controls. An executed mandatory transfer instrument controls to the extent it requires. All other conflicts follow the Terms' order of priority.

Annex A Standard processing description

This schedule applies to the ordinary named-consultant offer without a separate customer form.

Annex B Contractual safeguards

SafeGora will maintain controls appropriate to the service risks: individual user and administrator access; least-privilege and tenant/role restrictions; timely removal of obsolete permissions; confidentiality and appropriate personnel instruction; protection of data in transit and at rest; controlled management of credentials and secrets; vulnerability and change management; relevant security logging and incident response; and reasonable backup and recovery arrangements.

The Customer must protect its credentials and devices, assign appropriate roles, maintain accurate users and client permissions, and avoid unnecessary sensitive information. The parties will cooperate on suspected misuse. These safeguards are contractual obligations. They do not constitute a certification of flawless control operation or a promise of a particular authentication product, encryption suite, uptime or restoration deadline.

Annex C Provider services and locations

The table identifies the provider services within the described offer. A service listed as configuration-dependent is used only when the corresponding configuration or feature applies. SafeGora's obligations in sections 2, 4, 5 and 7 apply in every case.

Google Analytics and Google Ads measurement are described separately in the Privacy Notice. They do not receive authority under this table to use employer record contents for advertising. Adding a different AI provider requires the applicable provider-change process. Third-party AI hosts that a user connects through a customer-enabled integration are outside this table; the Terms govern them.

Annex D Retention categories

The following categories describe the applicable retention framework. Actual retention must comply with section 9 and the limits in this DPA.

Customer records follow section 9 and the actual employer's lawful recordkeeping instructions. The consultant's loss of access does not erase those records. Ordinary operational logs follow their configured schedule and justified security needs. Google Cloud required administrative and system audit logs remain in the required bucket for 400 days; separately exported copies have separate schedules. Billing, tax, acceptance, dispute and privacy-request evidence is retained for its applicable legal or accountability purpose. AI provider records and caches follow the actual service's lawful and compatible terms and configuration. Backups remain protected until scheduled expiry, with deletion and permission restrictions reapplied on recovery.

SafeGora must document the relevant periods or objective criteria, review continuing needs and make relevant information available for a reasonable compliance request. The documented retention schedule must reflect the applicable provider service and SafeGora's actual configuration, within the limits of this DPA. Any agreed more specific schedule must be compatible with mandatory provider retention and applicable law.

Annex E Contacts and requests

Send privacy, incident, processing-instruction and provider-objection notices to Ollie@safegora.com, identifying the Customer and the affected account or employer without including unnecessary sensitive data. SafeGora will use the Customer's maintained authorized contact for notices. Each party must keep its contact information current. Actual authority must be verified before releasing information or changing another organization's records. The Terms govern ordinary notice timing; urgent incidents and statutory requests remain subject to their applicable duties and deadlines.