Netra Security Data Processing Addendum

1 Definitions

“Affiliate” means any entity that controls, is controlled by, or is under common control with a party, where “control” means ownership of 50% or more of the voting interests.

“Data Protection Laws” means all laws and regulations applicable to the processing of Personal Data under this DPA, including, as applicable: the EU General Data Protection Regulation 2016/679 (“EU GDPR”); the EU GDPR as it forms part of the law of the United Kingdom (“UK GDPR”); the UK Data Protection Act 2018; the Swiss Federal Act on Data Protection (“FADP”); and the California Consumer Privacy Act, as amended (“CCPA”). The terms controller, processor, data subject, Personal Data, Personal Data Breach, processing, and supervisory authority have the meanings given in the GDPR (meaning the EU GDPR or the UK GDPR, as applicable).

“Company Account Data” means Personal Data relating to Netra’s relationship with Customer, such as the names and contact details of Customer’s authorized administrators and billing contacts, and information Netra needs to manage the relationship, verify identity, or meet legal obligations.

“Company Usage Data” means data about the operation and use of the Services themselves, such as administrator console audit logs, endpoint agent version and health data, and performance and diagnostic data, that Netra uses to operate, secure, and improve the Services and to detect and prevent abuse. Company Usage Data does not include Customer Personal Data.

“Customer Personal Data” means Personal Data that Netra processes on Customer’s behalf in providing the Services, including Personal Data in data the Services collect from Customer’s endpoints, from network traffic routed through the Netra Gateway, and from the identity providers and other systems Customer connects to the Services.

“Standard Contractual Clauses” or “SCCs” means the EU standard contractual clauses in Commission Implementing Decision (EU) 2021/914 of 4 June 2021, and, for UK transfers, the UK International Data Transfer Addendum issued by the ICO (the “UK Addendum”).

“Sub-processor” means any third party engaged by Netra to process Personal Data in connection with the Services.

2 Roles and Processing of Personal Data

2.1 Roles

Customer may act as either a controller or a processor of Personal Data. Except as set out in Section 10, Netra acts as a processor (or sub-processor) on Customer’s behalf. Customer is responsible for the accuracy, quality, and lawfulness of the Personal Data it makes available to Netra, the means by which it obtained that data, and the instructions it gives Netra.

2.2 Instructions

Netra will process Personal Data only (i) for the purposes described in the Agreement and Exhibit A, (ii) in accordance with Customer’s documented instructions (including this DPA), and (iii) as required by applicable law. If Netra is required by law to process Personal Data other than as instructed, it will inform Customer beforehand unless prohibited from doing so. Netra will promptly tell Customer if, in its opinion, an instruction infringes Data Protection Laws.

2.3 Nature of the Services

The Services discover, monitor, and control the use of AI tools, AI agents, and sensitive data across Customer’s endpoints, network, email, SaaS applications, and AI services, as configured by Customer. To do so, Netra processes Customer Personal Data collected by the Netra endpoint agent, the Netra Gateway, and the integrations Customer enables. Content captured under Customer’s policies, such as AI conversations, emails, and screenshots, is stored only in storage that Customer provides and controls, and is not stored in Netra’s systems. Netra hosts other Customer Personal Data as described in Section 6.1. The subject matter, nature, purpose, and duration of processing, the types of Personal Data, and the categories of data subjects are described in Exhibit A.

2.4 Return or Deletion

On termination or expiry of the Services, Netra will, at Customer’s choice, delete or return Customer’s Personal Data, unless retention is required by law. Where deletion is impracticable, Netra will isolate the Personal Data and protect it from further processing. Netra will confirm deletion on Customer’s request.

2.5 CCPA

To the extent the CCPA applies and except with respect to Company Account Data and Company Usage Data, Netra is a “service provider” and receives Personal Data solely for the limited and specified business purpose of performing the Services. Netra will not sell or share such Personal Data; retain, use, or disclose it outside of Netra’s direct business relationship with Customer; combine it with Personal Data received from other sources except as permitted by the CCPA; or retain, use, or disclose it except as necessary to perform the Services or as otherwise permitted by the CCPA. Netra will provide at least the same level of privacy protection required by the CCPA, will notify Customer if it determines it can no longer meet its CCPA obligations, and will cooperate with reasonable Customer measures to verify and remediate compliance.

3 Confidentiality

Netra will ensure that any person authorized to process Personal Data is bound by an appropriate duty of confidentiality. Netra may disclose Personal Data to its advisers, auditors, and Sub-processors as reasonably required to perform its obligations and provide the Services.

4 Sub-processors

4.1 General Authorization

Customer authorizes Netra to engage its Affiliates and the Sub-processors listed at https://www.netrasecurity.ai/compliance-subprocessors/ (the “List”), and to appoint additional Sub-processors as needed to provide the Services.

4.2 Notice and Objection

Netra will update the List at least ten (10) days before a new Sub-processor begins processing Personal Data and will notify Customers that have subscribed to Sub-processor updates by emailing privacy@netrasecurity.ai. Customer may object on reasonable data-protection grounds by written notice within ten (10) days. If Netra cannot offer a commercially reasonable alternative, Customer may discontinue the affected Service; discontinuation does not relieve Customer of fees owed.

4.3 Flow-down and Liability

Netra will impose data-protection obligations on each Sub-processor that are materially equivalent to those in this DPA and will remain liable to Customer for each Sub-processor’s performance.

5 Security

Taking into account the state of the art, cost of implementation, and the nature, scope, and purposes of processing, as well as the risks to data subjects, Netra will maintain appropriate technical and organizational measures to protect Personal Data against a Personal Data Breach. Netra’s current measures are described in Exhibit C.

6 International Data Transfers

6.1 General

Netra hosts the Customer Personal Data that it stores on Amazon Web Services in the Singapore region by default, or in another AWS region agreed with Customer. Netra is a United States company, and Personal Data may be accessed from the United States and from the other countries where Netra and its Sub-processors operate, as shown on the List. Where Netra transfers Personal Data from the EEA, the UK, or Switzerland to a country without an adequacy decision, it will do so under an appropriate transfer mechanism as set out below.

6.2 EEA Transfers

The EU SCCs are incorporated by reference and apply as follows: Module One (controller-to-controller) where Netra acts as a controller under Section 10; Module Two (controller-to-processor) where Customer is a controller; and Module Three (processor-to-sub-processor) where Customer is a processor. For each Module: the optional docking clause (Clause 7) does not apply; in Modules Two and Three, Clause 9(a) Option 2 (general written authorization) applies with the notice period in Section 4.2; the optional Clause 11 language does not apply; the Clause 13 brackets are removed; and Clause 17 and 18 elect the law and courts of Ireland. Exhibit A and Exhibit B provide the information required by Annexes I and III, and Exhibit C provides the information required by Annex II.

6.3 UK Transfers

Transfers subject to the UK GDPR are made under the EU SCCs as amended by the UK Addendum, which is incorporated by reference. For the UK Addendum, both the Importer and the Exporter may end it if the ICO issues a revised Approved Addendum that produces a substantial, disproportionate, and demonstrable increase in a party’s costs or risk; the governing law and courts are those of England and Wales.

6.4 Transfer Assessments

Where required by Data Protection Laws, the parties will complete and document any transfer risk assessment, data protection test, or equivalent assessment required before relying on the EU SCCs, the UK Addendum, or another transfer mechanism. The parties will reasonably cooperate and provide information available to them to support that assessment, including information about the Services, transfer flows, safeguards, and supplementary measures.

6.5 Swiss Transfers

Transfers subject to the FADP are made under the EU SCCs with the following adjustments: references to the GDPR also cover the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent authority for FADP-governed transfers; and data subjects in Switzerland may enforce their rights in their place of habitual residence.

6.6 Supplementary Measures

As of the date of this DPA, Netra has not received any government or intelligence-agency request for access to Customer’s Personal Data. If Netra receives such a request, it will seek to redirect the agency to Customer, will not disclose Personal Data voluntarily, and, where legally permitted, will give Customer reasonable notice and cooperate so Customer can seek a protective order. The parties will discuss in good faith whether transfers should be suspended, and Netra may adopt alternative safeguards if a transfer mechanism ceases to be valid.

7 Data Subject Rights

7.1 If Netra receives a request from a data subject to exercise rights of access, rectification, erasure, portability, restriction, objection, or withdrawal of consent in relation to Customer’s data, Netra will, where legally permitted, advise the data subject to submit the request to Customer. Customer is responsible for responding to such requests.

7.2 Taking into account the nature of the processing, Netra will provide reasonable technical and organizational assistance to help Customer respond to data-subject requests, to the extent Customer cannot do so itself through the Services. Customer is responsible, to the extent legally permitted, for the reasonable costs of such assistance.

8 Assistance, Records, and Audits

8.1 Assistance

Taking into account the nature of the processing and the information available to it, Netra will provide reasonable assistance to Customer with data-protection impact assessments, prior consultations with supervisory authorities, and Personal Data Breach notifications, where required by Data Protection Laws and where Customer cannot obtain the relevant information itself.

8.2 Records and Audits

Netra will keep records sufficient to demonstrate its compliance with this DPA for three (3) years after termination. On reasonable prior written notice, and no more than once per year (unless required by a supervisory authority or following a Personal Data Breach), Netra will either (i) make available current certifications or third-party audit reports (such as Netra’s ISO/IEC 27001 certificate or SOC 2 report), or (ii) where those are not sufficient under Data Protection Laws, allow Customer or its independent auditor to conduct an audit during business hours, subject to reasonable confidentiality controls and Customer’s responsibility for the associated costs.

9 Personal Data Breach

9.1 Netra will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer’s Personal Data, and will take reasonable steps within its control to remediate it.

9.2 Netra will provide Customer with reasonable information and cooperation to help Customer meet its own notification obligations to supervisory authorities and affected data subjects. Netra’s notice and cooperation are not an acknowledgment of fault, and Sections 9.1–9.2 do not apply to breaches caused by Customer’s own acts or omissions.

10 Netra as an Independent Controller

With respect to Company Account Data and Company Usage Data, Netra acts as an independent controller (not a joint controller) to: manage the customer relationship; run its core business operations (accounting, audit, tax, and compliance); detect, prevent, and investigate fraud, security incidents, and misuse; verify identity; comply with its legal obligations; and operate, secure, and improve the Services to the extent permitted by Data Protection Laws. Netra processes this data in accordance with its privacy policy at https://www.netrasecurity.ai/privacy/.

11 Conflict and Incorporation

11.1 Conflict

In case of conflict, the order of precedence is: (1) the Standard Contractual Clauses; (2) this DPA; (3) the Agreement; and (4) Netra’s privacy policy. Claims under this DPA are subject to the limitations and exclusions of liability in the Agreement.

11.2 Incorporation

This DPA is incorporated into and forms part of the Agreement and takes effect on the effective date of the Agreement, without the need for a separate signature. Entering into the Agreement is deemed to include each party’s signature to the Standard Contractual Clauses incorporated by reference. If Customer requires a signed copy of this DPA, Netra will provide one on request to privacy@netrasecurity.ai.

Exhibit A: Details of Processing

Nature and Purpose of Processing

Netra processes Customer’s Personal Data as necessary to provide the Services under the Agreement and this DPA, and in accordance with Customer’s instructions. Processing activities include:

• Collecting, inspecting, and classifying data from Customer’s endpoints, network traffic routed through the Netra Gateway, and connected identity providers and applications, to discover AI tools and agents, detect sensitive data, and apply Customer’s policies;
• Analyzing events and alerts to identify risks and support Customer’s investigations, including through AI-powered features where Customer uses them;
• Receiving and processing Company Account Data and Company Usage Data to provision, operate, secure, and support the Services;
• Storing, organizing, and protecting data, including through encryption and access controls;
• Analyzing usage data to maintain and improve the performance and security of the Services;
• Disclosing data to Sub-processors as permitted by this DPA; and
• Deleting or returning data as instructed.

Duration of Processing

Netra will process Customer Personal Data for the term of the Agreement and until it is deleted or returned under Section 2.4, unless longer retention is required by law. Company Account Data and Company Usage Data are processed and retained as described in Netra’s privacy policy.

Categories of Data Subjects

Customer’s employees, contractors, consultants, administrators, and other users of the endpoints, accounts, and systems covered by the Services; and individuals whose Personal Data appears in the data the Services process, such as senders and recipients of emails and people named in files, prompts, or AI conversations.

Categories of Personal Data

Company Account Data (e.g., name, email address, job title, username, and billing contact details) and Company Usage Data (e.g., console audit logs, device and application identifiers, IP address, and diagnostic data). Customer Personal Data, depending on the Services and features Customer enables, may include: identity and directory data (e.g., name, email address, username, department, job title, and group membership synced from Customer’s identity provider); device and network data (e.g., device names and identifiers, IP addresses, installed applications, and DNS queries); activity data (e.g., use of AI tools, agents, and SaaS applications, file and email activity, uploads, token usage, policy events, and alerts); and content captured under Customer’s policies (e.g., AI conversations, including prompts and responses, email content, and screenshots), which is stored in Customer’s own storage and not in Netra’s systems.

Sensitive or Special Category Data

The Services are not designed to collect special categories of Personal Data or data relating to criminal convictions and offences under Article 9 or Article 10 GDPR. However, content the Services process under Customer’s policies, such as prompts, files, emails, and screenshots, may incidentally contain such data. Customer is responsible for configuring the Services appropriately and for having a lawful basis for that processing. Netra protects all Customer Personal Data with the measures in Exhibit C.

Exhibit B: SCC Annexes (Parties, Transfer, and Sub-processors)

1. List of Parties (Annex I.A)

2. Description of Transfer (Annex I.B)

Data subjects, categories of Personal Data, special-category data, nature and purpose of processing, and retention are as described in Exhibit A. Frequency of transfer: continuous, for the duration of the Services. Competent supervisory authority (Annex I.C): the Irish Data Protection Commission for EEA transfers; the ICO for UK transfers; and the FDPIC for Swiss transfers.

3. Sub-processors (Annex III)

The current list of Authorized Sub-processors is available at https://www.netrasecurity.ai/compliance-subprocessors/ and is incorporated by reference.

Exhibit C: Technical and Organizational Security Measures (Annex II)

Netra maintains a security program that includes, at a minimum, the following measures.