This Data Processing Addendum ("DPA") forms part of the Terms of Service between Round3 AI, Inc., a Delaware corporation ("three.dev", "Processor") and Customer ("Controller"). It applies where three.dev processes personal data on Customer's behalf.

Where this DPA conflicts with the Terms of Service on data protection, this DPA controls. Where it conflicts with Sections 5 and 6 of the Terms of Service on which data may be used for what, those sections control.

---

1. Definitions

"Data Protection Laws" means all laws applicable to the processing of personal data under this DPA, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended ("CCPA"), and other US state privacy laws as applicable.

"Customer Traffic", "Customer Materials", "Customer Criteria", "Platform Artifacts", "Evaluation Signal", "Structured Field", "Free-Text Field", and "Service Data" have the meanings given in Section 5 of the Terms of Service.

"Customer Personal Data" means personal data contained in Customer Traffic, Customer Materials, or Customer Criteria.

"Controller", "processor", "data subject", "personal data", "processing", "personal data breach", and "supervisory authority" have the meanings given in the GDPR. Under the CCPA, three.dev is a "service provider" and Customer is a "business".

2. Roles

Customer is the controller of Customer Personal Data. three.dev is the processor. Customer is responsible for the lawfulness of the personal data it sends, for providing notice to data subjects, and for having a lawful basis for the processing it instructs.

three.dev is a controller of Service Data. That processing is described in the Privacy Policy and is outside the scope of this DPA.

3. Scope and instructions

3.1 Subject matter, duration, nature and purpose. three.dev processes Customer Personal Data for the duration of the subscription, in order to provide the evaluation and experimentation Service described in the Terms of Service: running offline experiments against historical traffic, running live experiments, scoring outputs with AI judges, collecting human assessments, clustering failures, computing experiment statistics, and where agreed, building specialized models for Customer.

3.2 Categories of data subject. Customer's end users, and Customer's own personnel who use the Service.

3.3 Categories of personal data. Whatever Customer chooses to send. Typically this is free-text content generated by end users and model responses to it, plus identifiers and metadata Customer attaches. Customer controls this and should minimize it.

3.4 Special category data. Customer should not send special category data under GDPR Article 9, or sensitive personal information under US state laws, unless the parties have agreed to it in writing and put appropriate additional safeguards in place.

3.5 Instructions. three.dev processes Customer Personal Data only on Customer's documented instructions, which consist of the Terms of Service, this DPA, Customer's configuration of the Service, and any further written instructions Customer gives. three.dev will inform Customer if it believes an instruction infringes Data Protection Laws, and may suspend that instruction until resolved.

3.6 Legally required processing. If law requires three.dev to process Customer Personal Data beyond Customer's instructions, three.dev will inform Customer before processing unless that law prohibits it.

3.7 Children's data. Customer's product may be used by children. Language learning, education, and consumer products commonly are. Because three.dev sees only the traffic Customer sends and cannot determine the age of any end user:

(a) Customer is responsible for determining whether its end users include children, for obtaining any verifiable parental consent or other authorization required by the GDPR (including Article 8), COPPA, the UK Age Appropriate Design Code, and equivalent laws, and for its own age-assurance measures;

(b) Customer will notify three.dev in writing before sending Customer Traffic that Customer knows or reasonably believes originates from children, so the parties can agree appropriate additional safeguards;

(c) where three.dev has been notified under paragraph (b), or otherwise becomes aware that Customer Traffic contains children's personal data, that traffic and all Evaluation Signal derived from it are excluded from the platform-wide license in Section 6.3(b) of the Terms of Service in full, including the metadata carve-out, unless the parties agree otherwise in writing;

(d) three.dev does not knowingly use children's personal data to train or improve any model, and does not profile children or use their data for marketing.

4. Service provider obligations, no sale, no re-identification

4.1 No sale or sharing. three.dev will not sell or share Customer Personal Data as those terms are defined under US state privacy laws, and will not retain, use, or disclose it for any purpose other than performing the Service, or outside the direct business relationship with Customer, except as permitted by Data Protection Laws. three.dev will not combine Customer Personal Data with personal data received from other sources, except as permitted under Data Protection Laws for a service provider.

4.2 Compliance and notice. three.dev will comply with its obligations as a service provider under the CCPA and equivalent US state laws, will provide the same level of privacy protection those laws require, and will notify Customer promptly if it determines it can no longer meet those obligations. Customer may take reasonable and appropriate steps to stop and remediate unauthorized use.

4.3 De-identification standard. Where this DPA or the Terms of Service refer to de-identified data, including de-identified Evaluation Signal under Section 5.3, three.dev:

(a) takes reasonable measures to ensure the data cannot be associated with, and cannot reasonably be linked to, a consumer, household, customer, or device, directly or indirectly; (b) publicly commits to maintain and use the data in de-identified form, and will not attempt to re-identify it, except that three.dev may perform a strictly limited, logged, and access-controlled test solely to validate that its own de-identification is effective, and will re-delete any output of that test; (c) contractually obligates every recipient, including every subprocessor and any other third party, to comply with paragraphs (a) and (b) and not to attempt re-identification.

This Section 4.3 is intended to meet the de-identification standard in Cal. Civ. Code section 1798.140(m) and equivalent provisions of other US state privacy laws. De-identified data that meets this standard is not Customer Personal Data.

5. AI training and model improvement

This section is the operative commitment on AI training. It restates and is consistent with Section 6 of the Terms of Service.

5.1 Customer Traffic and Customer Materials. three.dev does not use Customer Traffic or Customer Materials to train, fine-tune, improve, evaluate, benchmark, or develop any model, feature, dataset, or product that is made available to any other customer or to the public. This applies to first-party models and to any model three.dev builds for another customer.

5.2 Model providers. There are two inference paths and they differ in whose provider account is used.

(a) Customer-account path. Where the Service routes Customer Traffic to a third-party model provider to run Customer's evaluation or experiment, it does so using the API credentials Customer supplies, against Customer's own account with that provider. Customer's agreement with that provider governs the provider's use and retention of that traffic, including any no-training or zero-retention terms Customer has negotiated. three.dev does not substitute its own account for Customer's and obtains no rights to that traffic from the provider. three.dev stores Customer-supplied credentials encrypted per organization using AES-256-GCM.

(b) three.dev-account path. Parts of the Service run on three.dev's own provider account, including AI judges three.dev operates and the generation of cluster titles, descriptions, and taxonomy labels. Those calls transmit content derived from Customer Traffic. For that path the receiving provider is a three.dev subprocessor under Section 8, three.dev is responsible for the contractual terms including no-training and retention limits, and Section 5.1 continues to apply: that content is not used to improve anything made available to another customer or to the public.

The providers on each path are identified at /subprocessors.

5.3 Evaluation Signal. three.dev may use Evaluation Signal to improve the Service and its platform models, including for other customers, as licensed in Section 6.3(b) of the Terms of Service, and only subject to every limit in Section 6.5 of the Terms of Service and the de-identification standard in Section 4.3 of this DPA. In particular:

(a) Structured Fields are used platform-wide without a removal step, on either of two grounds. Controlled values under Section 5.6(a) of the Terms of Service, such as scores, enumerated labels, confidence values, cluster identifiers and sizes, taxonomy labels, statistics, telemetry, and reason codes from a controlled vocabulary, carry no Customer Personal Data by construction. Aggregate characterizations under Section 5.6(b), meaning the label, title, and description generated for a failure cluster, characterize what a group of requests has in common rather than the content of any individual request; three.dev generates them only over clusters meeting a minimum size and screens them against reproduction of individual items, and the contamination rule in Section 6.4A of the Terms of Service applies to any that nonetheless contains Customer Traffic;

(b) Free-Text Fields, being free-form natural language about an individual evaluated item, including judge rationale prose and free-form assessor notes, are treated as Customer Personal Data by default and are excluded from platform-wide use unless and until excerpts of Customer Traffic, excerpts of Customer Materials, and personal data have been removed from them to the standard in Section 4.3;

(c) three.dev will not use Evaluation Signal in a way that enables reproduction of Customer Traffic or Customer Materials, or identification of Customer or its end users;

(d) Customer may opt out of platform-wide use of Free-Text Fields under Section 6.6(b) of the Terms of Service. Structured Fields and Customer Criteria are not subject to opt-out under Section 6.6(a), because they contain no Customer Personal Data. three.dev does not rely on consent as a legal basis for the processing in this Section 5.3, and no consent is withdrawn by an opt-out.

5.4 Customer Criteria. three.dev may use Customer Criteria platform-wide, as licensed in Section 6.3(c) of the Terms of Service, without a removal step, because Customer Criteria describe Customer's standard of quality rather than the content of any end user interaction. Where Customer places Customer Traffic or personal data into a Customer Criteria field or a Structured Field, the contamination rule in Section 6.4A of the Terms of Service applies and that field is treated as Customer Traffic until the contaminating content is removed. Customer Criteria are subject to Sections 5.3(c) and 5.3(d).

5.5 Platform Artifacts. Judge prompts, judge output schemas, reason-code vocabularies, rubric structures, cluster taxonomies, and the other evaluation apparatus the Service creates are Platform Artifacts owned by three.dev under Section 6.2 of the Terms of Service, including where the Service composes them automatically from Customer Criteria. Platform Artifacts contain no Customer Traffic and are not Customer Personal Data. Where a Platform Artifact would otherwise incorporate Customer Traffic, that content is Customer Traffic and Section 5.1 applies to it.

5.6 Standing. Sections 5.1 through 5.5 are Customer's instruction under Article 28(3)(a) GDPR and survive termination.

6. Confidentiality and personnel

6.1 Confidentiality. three.dev ensures that every person authorized to process Customer Personal Data is bound by a written confidentiality obligation owed to three.dev, whether that person is employed directly, engaged through an employer of record, or engaged as a contractor.

6.2 Access. Access to Customer Personal Data is granted on a need-to-know basis under role-based access controls, and is revoked promptly on departure or change of role.

6.3 Administrative access to customer environments. three.dev operates an internal support tool that allows authorized personnel to view a customer organization's environment and act within it, in order to diagnose issues and provide support. It is not exposed to the public internet and is restricted to personnel who already hold access to three.dev's source code. Use of that tool is subject to Sections 6.1 and 6.2 and to the processing limits in Section 3.5.

7. Security measures

three.dev implements and maintains appropriate technical and organizational measures under Article 32 GDPR, including:

• encryption of Customer Personal Data in transit using TLS 1.2 or higher, and at rest;
• role-based access control, unique named accounts, and mandatory multi-factor authentication for administrative access;
• logical separation of each customer's Customer Traffic and Customer Materials;
• vulnerability management, dependency scanning, and timely patching;
• secure development practices including code review and secrets scanning;
• backup and documented restoration procedures;
• an incident response plan that is tested periodically;
• vendor security review before onboarding a subprocessor;
• personnel background checks where lawful, and prompt access revocation on departure.

three.dev may update these measures, provided the level of protection is not materially reduced.

Fill before publishing. This list must match reality. Delete any control that is not actually implemented. An overstated control is a misrepresentation, and it is the first thing a security questionnaire tests.

8. Subprocessors

8.1 General authorization. Customer gives general authorization for three.dev to engage subprocessors. The current list, including each subprocessor's role, processing location, and whether it receives Customer Traffic, is published at /subprocessors.

8.2 Flow-down. three.dev imposes on each subprocessor data protection obligations no less protective than those in this DPA, by written contract, and remains fully liable to Customer for each subprocessor's performance.

8.3 Change notification. three.dev will give at least thirty days' notice before adding or replacing a subprocessor that processes Customer Personal Data, by updating the subprocessor page, and by email to Customer on request. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid, unused fees.

8.4 Emergency changes. three.dev may add a subprocessor with shorter notice where required to address a security or availability emergency, and will notify Customer as soon as practicable.

9. Data subject rights

Taking into account the nature of the processing, three.dev will assist Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling Customer's obligation to respond to data subject requests under Chapter III GDPR and equivalent laws. The Service provides functionality for Customer to access, export, correct, and delete Customer Traffic and Customer Materials itself.

If three.dev receives a request directly from a data subject relating to Customer Personal Data, it will not respond substantively and will forward the request to Customer without undue delay.

10. Personal data breach

three.dev will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. three.dev will provide further information as it becomes available and will reasonably assist Customer with its own notification obligations.

11. Data protection impact assessments

three.dev will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities under Articles 35 and 36 GDPR, taking into account the nature of the processing and the information available to three.dev.

12. Audit

three.dev will make available to Customer the information necessary to demonstrate compliance with Article 28 GDPR. three.dev will satisfy this by providing its then-current security documentation, third-party audit reports or certifications where held, and completed security questionnaires on reasonable request.

Where that is insufficient for Customer to demonstrate compliance, Customer may conduct an audit no more than once in any twelve-month period, on at least thirty days' notice, during business hours, subject to confidentiality, at Customer's expense, and in a manner that does not disrupt the Service or compromise other customers' data. Customer may also audit following a confirmed personal data breach affecting Customer Personal Data.

13. International transfers

Where three.dev transfers Customer Personal Data out of the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, the transfer is governed by the European Commission Standard Contractual Clauses (Decision 2021/914), which are incorporated by reference, with three.dev as data importer and Customer as data exporter, module two (controller to processor), or module three (processor to processor) where Customer is itself a processor.

For those clauses: the optional docking clause applies; in Clause 9, option two (general written authorization) applies with the notice period in Section 8.3; in Clause 11, the optional independent dispute resolution body does not apply; in Clause 17, the governing law is the law of Ireland; in Clause 18(b), the forum is the courts of Ireland. Annexes I, II, and III are set out in full at the end of this DPA.

For UK transfers, the UK International Data Transfer Addendum to the Standard Contractual Clauses applies. For Swiss transfers, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent authority.

14. Retention and deletion

three.dev retains Customer Personal Data for the duration of the subscription. On termination, or on Customer's earlier written request, three.dev will delete or return Customer Traffic and Customer Materials within 30 days, and will delete existing copies unless law requires retention.

Backups containing Customer Personal Data are deleted on the ordinary backup rotation schedule and remain subject to this DPA until deleted.

Evaluation Signal already de-identified and incorporated into platform models under Section 5.3 is not subject to this deletion obligation, because it no longer constitutes personal data. Evaluation Signal that has not been de-identified is deleted with Customer Traffic.

15. Liability

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Laws prohibit that limitation.

---

Annex I

A. List of parties

Data exporter (Controller). Customer, as identified in the order form or account record. Contact: Customer's account administrator and any privacy contact Customer provides. Activities relevant to the transfer: sending production AI traffic and evaluation configuration into the Service in order to evaluate and experiment on its own AI features. Role: Controller. Where Customer is itself a processor for its own customers, Customer is a processor and module three applies.

Data importer (Processor). Round3 AI, Inc., 285 W Wieuca Rd NE STE 67913, Atlanta, GA 30342. Contact: legal@round3.ai. Activities relevant to the transfer: hosting and operating the three.dev evaluation and experimentation platform, including running offline and live experiments, AI judge scoring, human assessment collection, failure clustering, experiment statistics, and where agreed, building specialized models for Customer. Role: Processor.

B. Description of transfer

C. Competent supervisory authority

The supervisory authority of the EU member state in which the data exporter is established. Where the data exporter is not established in the EU, the competent authority is the supervisory authority of the member state in which the data subjects whose personal data is transferred are located.

---

Annex II: Technical and organizational measures

The measures in Section 7 of this DPA apply and are incorporated here in full. Summarized against the Article 32 headings:

Fill before publishing. Annex II must describe controls that actually exist. Delete any row that is not implemented today. Enterprise security reviews test this table directly.

---

Annex III: List of subprocessors

Customer has authorized the subprocessors published at /subprocessors, which identifies for each one its name, role, processing location, and whether it receives Customer Traffic. That page is incorporated into this Annex III and is updated in accordance with Section 8.3.

---

Data protection questions: legal@round3.ai