DATA PROCESSING AGREEMENT

This Data Processing Agreement (this “DPA”) is a part of the Platform Services Agreement (the “Agreement”) available at https://sandstone.com/master-services-agreement or other terms that govern the provision and use of the Services entered into between Glaze AI, Inc., a Delaware corporation doing business as Sandstone (“Sandstone”), and the entity identified as “Customer” in the applicable Order Form (“Customer”). This DPA describes Sandstone’s commitments regarding the Processing of Personal Data in connection with the Services provided under the Agreement. This DPA is effective as of the effective date of the Agreement and will remain in force as set out in Section 12 below.

1. DEFINITIONS

Terms defined in Applicable Data Protection Laws (including, “Controller,” “Processor,” “Data Subject,” “Supervisory Authority,” and “Processing”) have the meanings given to them in those laws. Capitalized terms not defined in this DPA have the meanings provided in the Agreement.

1.1 “Applicable Data Protection Laws” means all data protection and privacy laws applicable to a Party’s Processing of Customer Personal Data under the Agreement, including: (i) European Data Protection Laws; (ii) Canadian Privacy Laws; and (iii) US Privacy Laws; in each case as may be amended, superseded, or replaced.

1.2 “Canadian Privacy Laws” means, as applicable: (i) the federal Personal Information Protection and Electronic Documents Act (PIPEDA); (ii) the provincial Personal Information Protection Act in place in each of Alberta and British Columbia; (iii) an Act Respecting The Protection of Personal Information In The Private Sector (Québec) as amended by Law 25; and (iv) the Canada Anti-Spam Act Legislation (CASL) and their implementing regulations.

1.3 “Customer Personal Data” means Personal Data contained within Customer Data (as defined in the Agreement) that Sandstone Processes on behalf of Customer in connection with the delivery of the Services.

1.4 “Data Privacy Framework” or “DPF” means, as applicable, the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, each as administered by the U.S. Department of Commerce and as may be amended, superseded, or replaced.

1.5 “European Data Protection Laws” means, as applicable: (i) Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”); (ii) Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector, as amended by Directive 2009/136/EC (e-Privacy Directive); (iii) any applicable national implementations of (i) and (ii); (iv) the Switzerland Federal Act on Data Protection, as amended by the Federal Act of 25 September 2020 on Data Protection (nFADP), and its ordinances (“Swiss DPA”); and (v) the United Kingdom (“UK”) Data Protection Act 2018 and the GDPR as saved into UK law by virtue of Section 3 of the UK’s European Union (Withdrawal) Act 2018 (“UK GDPR”) and the Privacy and Electronic Communications (EC Directive) Regulations 2003 as they continue to have effect by virtue of Section 2 of the UK’s European Union (Withdrawal) Act 2018; in each case as may be amended, superseded, or replaced.

1.6 “Personal Data” means information relating to an identified or identifiable natural person, or as otherwise defined under Applicable Data Protection Laws.

1.7 “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of Customer Personal Data being Processed by Sandstone or its Sub-processor.

1.8 “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses as adopted by the European Union Commission by means of the Implementing Decision EU 2021/914 of June 4, 2021 found at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en.

1.9 “Sub-processor” means any third party engaged by Sandstone to Process Customer Personal Data in connection with its delivery of the Services.

1.10 “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under Section 119A(1) of the Data Protection Act 2018.

1.11 “US Privacy Laws” means all U.S. state data privacy and data breach notification laws applicable to Processing of Customer Personal Data by Sandstone in connection with its performance of the Services, including, the California Consumer Privacy Act as amended by the California Privacy Rights Act.

2. ROLES AND SCOPE

2.1 Roles of the Parties. For Customer Personal Data, Sandstone acts as Processor and Customer acts as Controller under Applicable Data Protection Laws. Where Customer itself acts as a Processor on behalf of its own clients, Sandstone acts as a Sub-processor. The obligations in this DPA apply regardless of which role applies.

2.2 Independent Controller Activities. Sandstone acts as an independent Controller solely with respect to account registration data, billing data, and usage analytics, and Processes such data to manage its relationship with Customer, provide and improve the Services, and for other business purposes such as billing, account management, and security, as further described in the Agreement.

2.3 Customer Data Rights. Between the Parties, Customer is solely responsible for the accuracy, content, legality and quality of Customer Personal Data. Customer represents and warrants that it has provided all necessary notices and obtained all consents, permissions, and rights required by Applicable Data Protection Laws for Sandstone to lawfully Process Customer Personal Data for the purposes contemplated by the Agreement and this DPA. Sandstone is not responsible for assessing the legality or accuracy of Customer Personal Data.

2.4 Scope of Processing. Sandstone will Process Customer Personal Data solely to provide the Services in accordance with the Agreement, this DPA, and Customer's documented instructions that include the terms of the Agreement, the Order Form, and this DPA. The details of Processing are described in Annex 1.

3. PROCESSING INSTRUCTIONS AND RESTRICTIONS

3.1 Restrictions. Sandstone will not: (a) sell Customer Personal Data; (b) share or Process Customer Personal Data for cross-context behavioral advertising or targeted advertising; (c) use Customer Personal Data in violation of the Agreement (this prohibition extends to all Sub-processors and survives termination of the Agreement); (d) retain Customer Personal Data beyond what is necessary to provide the Services unless required by Applicable Data Protection Laws; or (e) combine Customer Personal Data with personal information from other sources except as permitted by Applicable Data Protection Laws. For clarity, the restrictions in this Section 3 do not prevent Sandstone from training or fine-tuning models dedicated exclusively to Customer’s use, providing workspace self-learning capabilities, or delivering analytics for Customer’s benefit. Sandstone may collect, use, and disclose aggregated, anonymized, or de-identified data derived from Customer’s use of the Services for product improvement, benchmarking, and analytics, provided such data does not identify Customer, any user, or any individual. Sandstone will take commercially reasonable measures to prevent re-identification and will contractually require any recipients to maintain those protections.

3.2 Customer Instructions. Sandstone will Process Customer Personal Data in accordance with Customer’s documented instructions, which consist of the Agreement, this DPA, and Customer’s configuration and use of the Services. If Sandstone reasonably believes that a Customer instruction infringes Applicable Data Protection Laws, Sandstone will promptly notify Customer and may suspend performance of the relevant instruction until Customer modifies or confirms it. If Sandstone is required by applicable law to Process Customer Personal Data outside the scope of Customer’s documented instructions, Sandstone will inform Customer of that legal requirement before commencing such Processing, unless the law prohibits prior notification on important grounds of public interest.

4. CONFIDENTIALITY AND PRIVILEGE

4.1 Personnel Obligations. All personnel authorized to Process Customer Personal Data will be bound by written confidentiality obligations before access is granted and will receive appropriate data protection training.

4.2 Privilege Protection. The Parties acknowledge that Customer Personal Data may include materials protected by attorney-client privilege, work product doctrine, or other legal professional privileges. Sandstone will treat all content uploaded to the platform as confidential and potentially privileged. Nothing in this DPA or the Agreement is intended to constitute a waiver of any privilege or protection.

4.3 Law Enforcement Requests. Sandstone will promptly notify Customer of any legally binding request from law enforcement or a governmental authority relating to Customer Personal Data, to the extent permitted by law, and will limit any disclosure to the minimum required by law.

5. SECURITY

Sandstone will implement and maintain technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access, including encryption at rest (AES-256) and in transit (TLS 1.2 or higher). Sandstone’s security program is designed in alignment with NIST Cybersecurity Framework (CSF) 2.0. These measures are described in detail in Annex 2. Sandstone will maintain SOC 2 Type II certification (or any successor certification), and will make its then-current report available to Customer upon request, subject to appropriate confidentiality obligations. Sandstone may update its security measures from time to time, provided that any update does not materially diminish the overall level of protection afforded to Customer Personal Data. Customer is responsible for properly configuring security features available within its account, including single sign-on (SSO), multi-factor authentication (MFA), and integration permissions.

6. SUB-PROCESSORS

6.1 General Authorization. Customer grants Sandstone general written authorization to engage Sub-processors to Process Customer Personal Data. A current list of Sub-processors appears in Annex 3 and is maintained at trust.sandstone.com/subprocessors, which Sandstone will update to reflect any new or replacement Sub-processors. Sandstone will impose on each Sub-processor contractual data protection obligations no less protective than those in this DPA. Sandstone remains liable for the acts and omissions of its Sub-processors if an act or omission causes a breach of Sandstone’s obligations under this DPA and to the same extent as if performing the Processing directly.

6.2 Notice and Objection. Sandstone will provide Customer at least 7 days advanced notice before engaging a new Sub-processor or replacing an existing one by updating the Sub-processor list at trust.sandstone.com/subprocessors and sending an email notification to the email address Customer has registered for Sub-processor updates. The notice will identify the proposed Sub-processor, its location, and the Processing activities involved. Customer may object in writing within 7 days of receiving such notice, provided the objection identifies specific, reasonable, and substantiated data protection concerns relating to the proposed Sub-processor. The Parties will work in good faith for at least 90 days to resolve the objection. If the objection remains unresolved, Customer may terminate only the specific Services that would require the use of the objected-to Sub-processor, and, if applicable, will receive a pro-rata refund of any prepaid fees for the terminated Services.

7. SECURITY INCIDENT NOTIFICATION

7.1 Notice Requirements. Sandstone will notify Customer within 48 hours of confirming a Security Incident. The notification will include, to the extent reasonably available at the time: (a) the nature and scope of the Security Incident; (b) the categories of Customer Personal Data affected; (c) the likely consequences; (d) the remediation steps taken or planned; and (e) a designated point of contact for further communications. Where full details are not available within the initial 48-hour period, Sandstone will provide information in phases without further undue delay as additional facts become known.

7.2 Investigation Cooperation. Sandstone will cooperate with Customer in investigating and mitigating any Security Incident, including by preserving relevant evidence and providing reasonable assistance with any notifications Customer is required to make under Applicable Data Protection Laws. A notification under this Section 7 does not constitute an acknowledgment of fault or liability by Sandstone.

8. DATA SUBJECT REQUESTS AND ASSESSMENTS

8.1 Data Subject Requests. Sandstone will provide reasonable assistance to Customer in responding to requests from Data Subjects exercising rights under Applicable Data Protection Laws. If Sandstone receives a request directly from a Data Subject, Sandstone will promptly notify Customer and will not respond to the request except on Customer’s documented instructions or as required by Applicable Laws.

8.2 Data Protection Impact Assessments. Sandstone will provide reasonable cooperation and information to Customer where a data protection impact assessment is required under Applicable Data Protection Laws in connection with the Services.

8.3 Customer Audit Rights.

(a) Subject to the terms of this Section 8.3, Customer has the right, at Customer's expense, to conduct an audit of reasonable scope and duration pursuant to a mutually agreed-upon audit plan with Sandstone that’s consistent with the Audit Parameters (an “Audit”). Customer may exercise its Audit right: (i) to the extent Sandstone’s provision of an Audit Report does not provide sufficient information for Customer to verify Sandstone’s compliance with this DPA or the Parties’ compliance with Applicable Data Protection Laws, (ii) as necessary for Customer to respond to a government authority audit, or (iii) in connection with a Security Incident.

(b) Each Audit must conform to the following parameters (“Audit Parameters”): (i) be conducted by an independent third party that will enter into a confidentiality agreement with Sandstone; (ii) be limited in scope to matters reasonably required for Customer to assess Sandstone’s compliance with this DPA and the Parties’ compliance with Applicable Data Protection Laws; (iii) occur at a mutually agreed date and time and only during Sandstone's Business Hours; (iv) occur no more than once annually (unless required under Applicable Data Protection Laws or in connection with a Security Incident); (v) cover only facilities controlled by Sandstone; (vi) restrict findings to Customer Personal Data only; and (vii) treat any results as confidential information to the fullest extent permitted by Applicable Data Protection Laws. Customer agrees that any of its audit rights set out in the SCCs and other Applicable Data Protection Law shall be subject to, and carried out in accordance with, the terms of this Section 8.3.

8.4 Supervisory Authority Cooperation. Sandstone will, at Customer’s request and expense, cooperate with any competent Supervisory Authority in the performance of its tasks, to the extent required by Applicable Data Protection Laws.

8.5 Records of Processing. To the extent required by Applicable Data Protection Laws, Sandstone will create and maintain records of its Processing activities carried out on behalf of Customer, including the categories of Processing performed and, where applicable, transfers of Customer Personal Data to third countries. Sandstone will make such records available to Customer or to the competent Supervisory Authority upon request.

9. INTERNATIONAL DATA TRANSFERS

9.1 Data Hosting. Sandstone hosts all Customer Personal Data in the United States.

9.2 Data Privacy Framework. To the extent Sandstone has self-certified under the applicable DPF, Sandstone may receive Customer Personal Data from the EEA, United Kingdom, and Switzerland in reliance on that certification. If the DPF is invalidated or Sandstone can no longer rely on it, the Parties will rely on another valid transfer mechanism, including the SCCs.

9.3 EEA Transfers. The EU SCCs are incorporated by reference as Annex 4. Module 2 (Controller to Processor) applies where Customer acts as Controller; Module 3 (Processor to Processor) applies where Customer acts as Processor. Variable clauses are completed in Annex 4.

9.4 UK Transfers. The UK Addendum is incorporated by reference as Annex 5.

9.5 Swiss Transfers. The EU SCCs as amended by Annex 6 (Swiss Data Transfer Addendum) apply to transfers from Switzerland.

9.6 Adequacy and Precedence. The SCCs will not apply to any transfer covered by a valid adequacy decision. If an adequacy decision is later invalidated, the SCCs will automatically apply as a fallback. In the event of conflict between this DPA and the SCCs or UK Addendum, the SCCs or UK Addendum will prevail with respect to the transferred data.

9.7 Other Jurisdictions. For transfers from jurisdictions outside the EEA, United Kingdom, or Switzerland that restrict cross-border transfers without adequate safeguards, the SCCs are deemed amended to the minimum extent necessary: references to the GDPR become references to local law, the competent Supervisory Authority becomes the local authority, governing law and forum shift to that jurisdiction, and Data Subjects retain the right to bring claims in their habitual residence. If a jurisdiction formally adopts its own transfer mechanism, the Parties will incorporate it. This clause operates automatically without amendment to this DPA.

10. US PRIVACY LAW PROVISIONS

With respect to Customer Personal Data subject to US Privacy Laws, Sandstone acts as a “Service Provider,” “Processor,” or equivalent designation under each applicable statute. Sandstone certifies that it understands and will comply with its obligations under US Privacy Laws applicable to its Processing of Customer Personal Data. If Sandstone determines that it can no longer meet those obligations, Sandstone will promptly notify Customer, and Customer may take reasonable and appropriate steps to stop and remediate any unauthorized Processing. The restrictions in Section 3 above apply to all Processing governed by US Privacy Laws, including the prohibitions on selling Customer Personal Data, sharing for cross-context behavioral advertising, and using Customer Personal Data for AI model training.

11. DATA RETENTION AND DELETION

Customer may access, retrieve, or delete Customer Data at any time during the Subscription Term. Following expiration or termination of the Subscription Term, Customer may request return or deletion of Customer Data (including Customer Personal Data) by submitting an email to legal@sandstone.com. Sandstone will return Customer Data per the terms of the Agreement and will delete all Customer Data (including Customer Personal Data) from all systems within 30 days of Customer’s request, except to the extent retention is required by Applicable Data Protection Laws. Notwithstanding the foregoing, backup copies containing Customer Personal Data will be purged in accordance with Sandstone's standard backup rotation schedule and Applicable Data Protection Laws. Sandstone may retain Customer Personal Data to the extent required by Applicable Data Protection Law and any data so retained will remain subject to the protections of this DPA and confidentiality obligations until deleted. De-identified data derived under Section 3 is not subject to the deletion obligations in this Section 11, provided that all recipients of such data are contractually bound to maintain de-identification protections.

12. GENERAL PROVISIONS

12.1 Applicability. The obligations placed upon Sandstone under this DPA shall start when Sandstone or its Sub-processors process Customer Data on Customer’s behalf in connection with the Services, and will survive for so long that Sandstone or its Sub-processors process Customer Data on Customer’s behalf. Any claims against Sandstone or its affiliates based on or related to this DPA may only be brought by the entity that is the contracting party to an Order Form. In no event shall this DPA or any Party restrict or limit the rights of any Data Subject or of any competent Supervisory Authority. Other than as required by the SCCs, this DPA does not confer any third-party beneficiary rights and it is intended for the benefit of the Parties hereto, respective permitted successors, and assigns only, and is not for the benefit of, nor may any provision hereof be enforced by, any other person.

12.2 Cost Allocation and Limitation of Liability. Each Party shall bear the costs of investigation, remediation, mitigation, and other related costs to the extent a Security Incident is caused by such Party. Each Party will bear the costs of fines, penalties, damages, or other related amounts imposed by an authorized regulatory body, governmental agency, or court of competent jurisdiction to the extent arising from such Party’s breach of its obligations under this DPA. To the maximum extent allowed under Applicable Laws (including, Applicable Data Protection Laws), each Party’s aggregate liability under this DPA is subject to the limitations and exclusions of liability set forth in the Agreement. Nothing in this DPA or the Agreement limits either Party’s liability to Data Subjects under the SCCs or the UK Addendum.

12.3 Conflict. If a provision of this DPA conflicts with a provision in the Agreement, this DPA controls solely with respect to the Processing of Customer Personal Data and solely to the extent of the conflict. Subject to the foregoing, the Agreement continues to govern the provision and use of the Services and remains unchanged and in full force and effect.

12.4 Governing Law and Dispute Mechanisms. This DPA is governed by the law specified in the Agreement, except where the SCCs or UK Addendum require a different governing law for the purposes of those instruments. Other than as required by the SCCs or UK Addendum, the dispute mechanisms, including those related to venue and jurisdiction, set forth in the Agreement govern any dispute pertaining to this DPA.

12.5 Amendments and Entire DPA. No modification of this DPA will be effective unless in writing and signed by authorized representatives of both Parties. This DPA, together with Annexes 1 through 6 and the incorporated SCCs and UK Addendum, constitutes the complete agreement between the Parties regarding the Processing of Customer Personal Data and supersedes all prior representations on that subject.

Last updated: October 1, 2026

ANNEX 1: DETAILS OF PROCESSING

This Annex 1 describes the Processing of Customer Personal Data carried out by Sandstone in connection with the Services.

• Subject Matter: Provision of the Sandstone AI-powered legal operations platform pursuant to the Agreement and as described in the applicable Order Form.
• Duration: Subscription Term of the applicable Services plus any post-termination period required for data deletion under this DPA and the Agreement.
• Nature and Purpose: Processing Customer Data (that may include Customer Personal Data) to provide the Services. Such data may include (varies based on Customer’s select usage): document upload, storage, and retrieval; AI-powered contract review, drafting, redlining, and analysis; intake classification and routing of legal requests; agentic workflow automation; communications; user authentication and access management; billing and payment processing; and platform performance monitoring.
• Categories of Data Subjects: (a) Customer’s employees, contractors, partners, customers, vendors, and Users; (b) individuals whose Personal Data appears in communications, files, or other data from Third-Party Services integrated with the Services or created or uploaded to the platform (e.g., contracting parties, counterparties, and third parties referenced in legal materials).
• Types of Personal Data: Names; contact information (email, phone, addresses); account credentials and authentication data; IP addresses; usage and telemetry data; billing information; and any Personal Data contained in communications, documents, or other data Processed by the platform.
• Special Categories of Data: The platform may Process special categories of data or sensitive personal information to the extent included in communications, files, or documents. Customer is solely responsible for ensuring a valid lawful basis before uploading such data.

ANNEX 2: TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

The measures described in this DPA and the Agreement, and as described in further detail in the materials available at the Sandstone Trust Center (https://trust.sandstone.com/).

ANNEX 3: LIST OF SUB-PROCESSORS

The current list of Sub-processors is available at: https://trust.sandstone.com/subprocessors

ANNEX 4: EU STANDARD CONTRACTUAL CLAUSES

The standard contractual clauses adopted by the European Commission under Implementing Decision (EU) 2021/914 (“SCCs”) are incorporated by reference into this DPA and apply to transfers of Customer Personal Data from the EEA to Sandstone in the United States. The following clause-by-clause elections apply:

• Modules: Module 2 (Controller to Processor) where Customer acts as Controller; Module 3 (Processor to Processor) where Customer acts as Processor.
• Clause 7 (Docking Clause): Optional docking clause: included.
• Clause 9(a) (Sub-processors): Option 2 (General Written Authorization) selected. Sandstone will provide advance notice per this DPA.
• Clause 11 (Redress): Optional language: omitted.
• Clause 13 (Supervision): Competent Supervisory Authority determined per the rules in Clause 13. Where the data exporter is not established in an EEA Member State, the Irish Data Protection Commission.
• Clause 17 (Governing Law): Option 1: laws of Ireland
• Clause 18 (Forum): Courts of Ireland
• SCC Annex I: Populated by Annex 1 of this DPA
• SCC Annex II: Populated by Annex 2 of this DPA
• SCC Annex III: Populated by Annex 3 of this DPA

In the event of any conflict between this DPA and the SCCs, the SCCs will prevail with respect to Customer Personal Data transferred from the EEA.

ANNEX 5: UK ADDENDUM

This Annex 5 incorporates by reference the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (Version B1.0, in force 21 March 2022) issued by the UK Information Commissioner under Section 119A(1) of the Data Protection Act 2018 (the “UK Addendum”). The Part 1 Tables are completed as follows:

• Table 1 (Parties): As set out in Annex 1 of this DPA. Sandstone is the data importer; Customer is the data exporter.
• Table 2 (Selected SCCs): The Approved EU SCCs incorporated in Annex 4 of this DPA, including the Module(s) and clause elections specified therein.
• Table 3 (Appendix Information): Annex I: Annex 1 of this DPA. Annex II: Annex 2 of this DPA. Annex III: Annex 3 of this DPA.
• Table 4 (Ending the Addendum): Sandstone (as data importer) may end this UK Addendum as set out in Section 19 of the Mandatory Clauses.

The Part 2 Mandatory Clauses of the Approved Addendum are incorporated without modification. The competent Supervisory Authority for purposes of the UK Addendum is the UK Information Commissioner’s Office (ICO). In the event of any conflict between this DPA and the UK Addendum, the UK Addendum will prevail with respect to transfers of Customer Personal Data from the United Kingdom.

ANNEX 6: SWISS DATA TRANSFER ADDENDUM

This Annex 6 (the “Swiss Addendum”) amends the Standard Contractual Clauses incorporated as Annex 4 to the extent they apply to transfers of Customer Personal Data governed by the Swiss Federal Act on Data Protection (“FADP”). The following modifications apply:

(a) References to “Regulation (EU) 2016/679” or the “GDPR” will be read as references to the FADP. References to the “EU,” “Union,” or “Member State” will be read as references to Switzerland.

(b) The competent Supervisory Authority under Clause 13 will be the Swiss Federal Data Protection and Information Commissioner (“FDPIC”).

(c) The governing law under Clause 17 will be the laws of Switzerland.

(d) The forum for disputes under Clause 18 will be the courts of Switzerland.

(e) Data Subjects habitually resident in Switzerland will not be prevented from bringing claims in their place of habitual residence.

(f) Where a transfer is subject to both the GDPR and the FADP, the FDPIC will serve as competent authority for aspects governed by the FADP, and the Supervisory Authority identified in Annex 4 will serve as competent authority for aspects governed by the GDPR.

(g) In the event of any conflict between the SCCs as amended by this Swiss Addendum and any other provision of this DPA, the provision most protective of Data Subjects will prevail.