Data Processing Addendum

Effective: October 22, 2026 · Shadow LTD, Tel Aviv, Israel

Introduction

This Data Processing Addendum (“DPA”) forms part of the Terms & Conditions between Shadow LTD (“Shadows”, “we”, “us”) and the customer agreeing to them (“Customer”, “you”), and governs our processing of personal data contained in Customer Data on your behalf. Capitalized terms not defined here have the meaning given in the Terms & Conditions.

Where you and Shadows have signed an order form or master subscription agreement that includes its own data processing terms, that agreement prevails over this DPA to the extent of any conflict. This published version reflects our standard template; a countersigned copy for your organization is available on request at [email protected].

1. Definitions

• “Data Protection Law” means all laws applicable to the processing of personal data under this DPA, including, where applicable, the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, and the Israeli Protection of Privacy Law, 5741-1981.
• “controller”, “processor”, “data subject”, “personal data” and “processing” have the meanings given in the GDPR.
• “Customer Personal Data” means personal data contained in Customer Data that we process on your behalf under the Terms.
• “Sub-processor” means any third party engaged by us to process Customer Personal Data.
• “SCCs” means the Standard Contractual Clauses annexed to European Commission Implementing Decision (EU) 2021/914.

2. Roles and scope

For Customer Personal Data, you act as controller (or as processor on behalf of a third-party controller) and we act as your processor. Each party will comply with its own obligations under Data Protection Law. You are responsible for establishing a lawful basis for the processing, for the accuracy and lawfulness of the Customer Personal Data you submit, and for providing any notices and obtaining any consents required from data subjects — including the buyers and prospects a Shadow engages with on your behalf.

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

We process personal data for which we are the controller (for example, account administration and website data) as described in our Privacy Policy. That processing is outside the scope of this DPA.

3. Customer instructions

We will process Customer Personal Data only on your documented instructions, including with regard to international transfers, unless required to do otherwise by applicable law — in which case we will inform you of that requirement before processing, unless the law prohibits such notice. The Terms, this DPA, and your configuration and use of the Service constitute your complete documented instructions. We will inform you if, in our opinion, an instruction infringes Data Protection Law.

We do not sell Customer Personal Data, and we do not use Customer Personal Data to train artificial-intelligence models made available to other customers. Where the Service submits Customer Personal Data to an AI sub-processor to generate Output, it does so solely to provide the Service to you, under terms that prohibit that sub-processor from training its models on that data.

4. Confidentiality

We ensure that persons authorized to process Customer Personal Data are bound by an appropriate obligation of confidentiality and are granted access only on a least-privilege, need-to-know basis.

5. Security

We implement and maintain the technical and organizational measures set out in Annex 2, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risk to data subjects. We may update those measures over time provided the overall level of security is not reduced.

6. Sub-processors

You give us general authorization to engage Sub-processors. The Sub-processors currently approved under this DPA are listed in Annex 3. Each Sub-processor is engaged under a written contract imposing data protection obligations no less protective than those in this DPA, and we remain fully liable to you for each Sub-processor's performance.

We will give you at least 30 days' notice before adding or replacing a Sub-processor that processes Customer Personal Data. You may object on reasonable data protection grounds within that period by writing to [email protected]; if we cannot make a reasonable accommodation, you may terminate the affected part of the Service without penalty for the remainder of the then-current term.

7. Data subject rights

Taking into account the nature of the processing, we will assist you by appropriate technical and organizational measures, insofar as possible, in fulfilling your obligation to respond to requests to exercise data subject rights under Data Protection Law. Where a data subject contacts us directly in relation to Customer Personal Data, we will refer them to you and will not respond substantively except on your instruction or as required by law. The Service provides self-service functionality to access, correct, export and delete Customer Personal Data.

8. Personal data breach

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will assist you in meeting your own notification obligations to supervisory authorities and data subjects.

9. Deletion and return

On termination or expiry of the Terms, we will, at your election, delete or return Customer Personal Data, and delete existing copies, unless applicable law requires continued storage. Residual copies held in routine backup archives are isolated from further processing and deleted on the ordinary backup rotation described in Annex 2.

10. Audits and information

We will make available to you the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR, including our most recent third-party audit reports and security documentation, which may be provided under an obligation of confidentiality in satisfaction of an audit request. Where that information is insufficient, you may request an audit no more than once in any 12-month period, on at least 30 days' written notice, during business hours, subject to confidentiality obligations, and without unreasonably disrupting our operations. Audits following a confirmed personal data breach are not subject to that frequency limit.

11. International transfers

Customer Personal Data is hosted in the United States (Google Cloud region us-central1) and may be processed by Sub-processors in the locations listed in Annex 3. Where we transfer Customer Personal Data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the SCCs (Module Two, controller-to-processor, or Module Three, processor-to-processor, as applicable) are incorporated into this DPA by reference and apply to that transfer, together with the UK International Data Transfer Addendum where the UK GDPR applies. For the purposes of the SCCs: Annex I is populated by Annex 1 and Annex 3 of this DPA, Annex II by Annex 2, the optional docking clause applies, and the governing law and forum for Clauses 17 and 18 are those of Ireland.

Shadows carries out and documents transfer impact assessments for Sub-processors handling Customer Personal Data, and will inform you if we become unable to comply with the SCCs.

12. Order of precedence and liability

In the event of a conflict, the SCCs prevail over this DPA, and this DPA prevails over the remainder of the Terms, in each case to the extent of the conflict and in respect of the subject matter of the conflicting provision. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms.

13. Governing law

Except where Data Protection Law or the SCCs require otherwise, this DPA is governed by and construed in accordance with the laws of the State of Israel, without regard to its conflict-of-laws principles. The competent courts of Tel Aviv-Jaffa will have exclusive jurisdiction over any dispute arising out of or relating to this DPA.

Annex 1 — Details of the processing

Annex 2 — Technical and organizational measures

The following measures are in place as of the effective date of this DPA. They are reviewed at least annually and may be updated provided the overall level of security is not reduced.

Access control and authentication

• Role-based access control on a least-privilege basis; every tenant's data is isolated by a mandatory tenant identifier enforced in the application data layer.
• Authenticator-app multi-factor authentication available on all user accounts, and single sign-on supported for customers who require it.
• Administrative and production access is restricted to named personnel, reviewed periodically, and revoked on role change or departure.
• Credentials, API keys and integration tokens are held in a managed secret store, never in source control, and integration tokens are encrypted at rest with a dedicated key.

Encryption

• Encryption in transit using TLS 1.2 or above for all external connections, with HTTP strict transport security enforced at the edge.
• Encryption at rest for all databases, object storage and backups.

Change management and secure development

• All changes to production are made through version-controlled pull requests. Direct commits of new work to the release branch are prohibited by policy.
• Automated CI checks run on every change — static analysis and linting, type checking, automated unit and integration tests, and a database-seed verification — and must pass before a change is promoted.
• An automated pre-deploy review gate inspects every release for destructive database migrations, missing tenant-scoping, credentials committed in plaintext and similar high-risk changes, and blocks the deploy on a critical finding.
• Each change is recorded with a change tier, the accountable human author, and a deployment record retained as change-management evidence.
• Database migrations are applied forward-only in production by an automated pipeline step; destructive schema operations require documented approval.
• Dependencies are monitored for known vulnerabilities and updated through the same pull-request pipeline.

Resilience, availability and recovery

• The application tier runs as multiple redundant instances distributed across availability zones within the hosting region, behind a managed load balancer, and scales automatically with demand.
• The managed database instance is deployed in a single availability zone. Durability is provided by automated daily backups, retained for 14 days, together with point-in-time recovery from continuously archived transaction logs retained for 7 days.
• Backup restoration is tested periodically, and recovery procedures are documented in an internal runbook.
• The edge layer provides DDoS mitigation and content delivery.

Logging, monitoring and incident response

• Centralized application, infrastructure and audit logging, including database audit logging of schema and role changes.
• An immutable audit trail of agent actions and approvals within the Service.
• A documented incident response plan with defined severity levels, owners and escalation paths, and a 48-hour customer notification commitment for personal data breaches.

Organizational measures

• An information security policy set approved by the CTO as security owner, reviewed at least annually.
• Security awareness training for personnel, and confidentiality obligations in all personnel and contractor agreements.
• A documented data classification and retention policy, and a sub-processor approval process covering security review and data residency before engagement.
• A security program aligned with SOC 2 Trust Services Criteria.

Annex 3 — Approved sub-processors

The following Sub-processors are approved to process Customer Personal Data as of the effective date of this DPA. Sub-processors marked optional process Customer Personal Data only where the Customer enables the corresponding integration or channel.

To be notified of changes to this list, or to request a countersigned copy of this DPA, contact [email protected].

Shadow LTD · Data Protection Officer: Or Lavee · Contact: [email protected]