Data Processing Addendum

·Services Terms

·Data Processing Addendum

·Last Updated: October 9, 2026

·This Data Processing Addendum ("DPA") is incorporated into and made part of the Agreement entered into by and between Company and Ramp (each as defined in the Agreement), each a "party" and together the "parties." This DPA replaces and supersedes any previously applicable terms or agreements between the parties related to Personal Data Processing and information security from the effective date of the Agreement or such other date on which the parties otherwise agree to this DPA.

11. Definitions.

·Permanent link: 1. Definitions.

·Capitalized terms used but not otherwise defined in this DPA have the meaning set forth in the Agreement. The following terms used in this DPA have the meanings below:

• ·a. "Agreement" means the contract entered into between Ramp and Company for products or services.
• ·b. "Controller" means the entity that determines the purposes and means of processing Personal Data (and includes a "business" as defined in the CCPA).
• ·c. "Data Protection Law" means any laws, rules, or regulations relating to the Processing of Personal Data that are applicable to a party in the performance of its obligations under the Agreement, including, but not limited to: (1) California Civil Code Section 1798.100 et seq. ("CCPA"); (2) Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 ("GDPR"), the GDPR as applicable in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018, the UK Data Protection Act 2018 ("UK GDPR"), as amended by the Data (Use and Access) Act 2025, and the Swiss Federal Data Protection Act ("FADP"); (3) Canada's Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 ("PIPEDA"); and (4) the Indian Digital Personal Data Protection Act, 2023 ("DPDPA").
• ·d. "Data Subject" means an identified or identifiable natural person to whom Personal Data relates.
• ·e. "Personal Data" means any information Processed in connection with the Agreement that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Data Subject or household.
• ·f. "Process" means any operation or set of operations that are performed on Personal Data or on sets of personal information, whether or not by automated means.
• ·g. "Processor" means an entity which processes Personal Data on behalf of and pursuant to the written instructions of the Controller (and includes a "service provider" or "contractor" as defined in the CCPA).
• ·h. "Restricted Transfer" means, where European Data Protection Law applies, a transfer of Personal Data from the European Economic Area (EEA), Switzerland, or the United Kingdom (as applicable) to another country which is not subject to: (a) an adequacy determination by the European Commission, the Swiss Federal Data Protection Authority, or the UK Information Commissioner (as applicable); or (b) where the UK GDPR applies, adequacy regulations pursuant to Section 17A of the UK Data Protection Act 2018.
• ·i. "Security Incident" means a breach of a party's security controls leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data or Confidential Information of the other party.
• ·j. "Services" has the meaning set out in the Agreement, or if not set out in the Agreement, means the services provided to Company under the Agreement.
• ·k. "Standard Contractual Clauses" or "SCC" means, as applicable: (1) the standard contractual clauses set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj) (the "EU SCCs"); (2) the EU SCCs with appropriate references to the Swiss FADP; (3) the EU SCCs with the International Data Transfer Addendum to the EU SCCs, issued by the Information Commissioner and laid before Parliament in accordance with s.119A of the Data Protection Act 2018 on 2 February 2022 available at https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf (the "UK Addendum") appended; or (4) the Brazilian Standard Contractual Clauses as contained in Annex II of Resolution CD/ANPD No.19 of August 23, 2024 ("Brazil SCCs").
• ·l. "Subprocessor" means any service provider engaged by a Processor to Process Personal Data on behalf of the Controller.

·Where used in this DPA, the terms "business," "business purpose," "commercial purpose," "consumer," "process," "sale/sell," "share," and "supervisory authority" (or any equivalent terms) have the meaning ascribed to them under Data Protection Law or under any guidance, recommendations or codes of practice issued by relevant supervisory authorities.

22. General Roles and Responsibilities.

·Permanent link: 2. General Roles and Responsibilities.

·a. Roles.

·Permanent link: a. Roles.

·In order to provide the Services, Ramp acts as a Controller and a Processor (or Subprocessor) of Personal Data, and Company is a Controller or Processor. Ramp's obligations under this DPA are determined by its role as Processor or Controller depending on the purpose for Processing Personal Data. Each party must comply with Data Protection Law in its Processing of Personal Data, and except as expressly required by Data Protection Law, neither party is responsible for the other party's compliance with Data Protection Law. Details of Processing activities are set out in Annex 1 of this DPA. The same categories of Personal Data may be Processed in different roles for different purposes, as described in Annex 1.

·b. Responsibilities.

·Permanent link: b. Responsibilities.

·Company is solely responsible for the accuracy, quality, and legality of Personal Data it provides or makes available to Ramp. Company represents: (1) to the extent required by Data Protection Law, Company has provided all necessary information, disclosures, notices, and choices, and has secured all necessary rights, consents, and privileges, and has a lawful basis for the Processing of Personal Data as contemplated under the Agreement (including by Ramp and its Subprocessors); (2) Company will not provide to Ramp or cause Ramp to Process any sensitive or special category Personal Data (including biometric information, non-public personal information, protected health information, or information of minors), unless included incidentally in receipts or invoices or expressly permitted in Annex 1 for the applicable Service, feature, and purpose; and (3) where Ramp is a Processor or Subprocessor, Company's instructions will be lawful and will not violate or cause Ramp to violate any Data Protection Law or third-party terms.

·c. Security.

·Permanent link: c. Security.

·Ramp will implement and maintain appropriate information security measures designed to protect Personal Data.

·d. International Transfers.

·Permanent link: d. International Transfers.

·Terms relating to transfers of Personal Data across borders, and jurisdiction-specific terms relating to the Processing of Personal Data under this DPA, are detailed in Annex 2.

33. Ramp as Controller.

·Permanent link: 3. Ramp as Controller.

·This section only applies where Ramp acts as a Controller of Personal Data, in which case Ramp determines the purposes and means of Processing Personal Data under the Agreement and is an independent Controller. Processing carried out on Company's behalf to provide the Services, including customer-directed reporting, access administration, support, and security functions, is governed by Section 4.

·a. Processing Activities.

·Permanent link: a. Processing Activities.

·Ramp acts as a Controller when it uses Personal Data: (1) to comply with legal obligations; (2) in connection with business customer underwriting and risk decisions; (3) to monitor, prevent, detect, and mitigate fraud, illegal activity, violations of Ramp's policies and terms, financial loss, security risks, and other harms; (4) to manage its business, including relationship management, billing, and invoicing; and (5) as otherwise set out in Ramp's Privacy Policy. Ramp will not carry out targeted advertising, sales, or sharing using Personal Data from Company's Ramp account.

·b. Controller Obligations.

·Permanent link: b. Controller Obligations.

·Each party will: (1) Notify the other party if it makes a determination it can no longer meet its obligations under Data Protection Law; (2) reasonably cooperate with the other party to carry out its obligations under Data Protection Law; (3) implement and maintain reasonable security measures to safeguard Personal Data disclosed under the Agreement; and (4) promptly, and without undue delay, Notify the other party if a Security Incident involves Personal Data it received from the other party. Ramp's Security Incident handling processes are described in Annex 3 of this DPA.

44. Ramp as Processor.

·Permanent link: 4. Ramp as Processor.

·This section only applies where Ramp acts as a Processor or Subprocessor of Personal Data, in which case Ramp Processes Personal Data solely on Company's instructions. Ramp acts as a Processor or Subprocessor to provide, provide access to, and maintain the Services.

·a. Processing Activities.

·Permanent link: a. Processing Activities.

·Ramp will Process Personal Data only in accordance with the documented instructions provided by Company, including the Agreement and this DPA, and instructions submitted through the Services by Company or its Authorized Users within their applicable permissions, including enabled integrations, workflows, and available data-handling settings, and as required by applicable law. Ramp will Notify Company if, in Ramp's opinion, instructions given by Company would cause Ramp to violate Data Protection Law.

·b. CCPA.

·Permanent link: b. CCPA.

·To the extent the CCPA applies, Ramp will not: (1) sell or share Personal Data disclosed by Company; (2) retain, use, or disclose Personal Data for any purpose other than for the business purposes specified in the Agreement, as otherwise permitted by the CCPA, or outside of the direct business relationship with Company; (3) combine Personal Data that Ramp receives from Company with Personal Data Ramp receives from another person or persons or collects from its own interaction with a Data Subject, except as permitted by the CCPA or as required to provide the Services; or (4) attempt to re-identify any Personal Data that has been "De-Identified" as defined in the CCPA. Ramp will inform Company if Ramp determines that it can no longer meet its obligations under the CCPA. Company may take the reasonable and appropriate steps stated in this DPA to help ensure that Ramp uses Personal Data in a manner consistent with Company's obligations under the CCPA and, upon reasonable Notice, request that Ramp stop and remediate any unauthorized use of Personal Data.

·c. Security.

·Permanent link: c. Security.

·Ramp will implement and maintain appropriate information security measures designed to protect Personal Data, including the specific security measures described in Annex 3. Ramp will not materially decrease the overall security of the Services during the term of the Agreement. Ramp will respond to Security Incidents as set out in Annex 3 of this DPA.

·d. Subprocessors.

·Permanent link: d. Subprocessors.

• 1Company provides general written authorization for the use by Ramp of the Subprocessors identified at https://trust.ramp.com/ (or a successor site) (the "List"). The List may provide a mechanism to subscribe to Notifications of new Subprocessors, and Company agrees to subscribe to such Notifications where available. At least ten (10) days before authorizing any new Subprocessors to Process Personal Data to deliver Services to Company, Ramp will add the new Subprocessor to the List. Company may object to the new Subprocessor if Company reasonably believes the Subprocessor cannot comply with Data Protection Law by informing Ramp in writing within ten (10) days of Ramp sending Notice of the new Subprocessor. If Company objects in accordance with this section, Ramp will work with Company in good faith to identify an alternative for Company. If Ramp then notifies Company that Ramp must use the Subprocessor to provide the Services to other customers or cannot provide a reasonable alternative prior to the new Subprocessor Processing Personal Data from Company, Company may terminate the applicable Services which cannot be provided by Ramp without the use of the relevant Subprocessor by providing written Notice to Ramp. Termination of all or part of the Services under this section does not relieve Company of any fees owed to Ramp under the Agreement. If Company does not object within the timeframe above, the new Subprocessor will be permitted to Process Personal Data Ramp receives from or on behalf of Company.
• 2Ramp will enter into a written agreement with each Subprocessor containing data protection obligations no less protective than those in this DPA with respect to the protection of Personal Data. Ramp will be responsible to Company for acts and omissions of its Subprocessors that violate the terms of the DPA applicable to Ramp's role as a Processor.

·e. Data Requests.

·Permanent link: e. Data Requests.

·To the extent permitted by Data Protection Law and to the extent Ramp is able to verify that a Data Subject is associated with Company, Ramp will Notify Company if Ramp receives a request from a Data Subject to exercise their rights under Data Protection Law or receives a complaint from a supervisory authority or other third party in relation to Ramp's Processing of Personal Data ("Request") on Company's behalf. Taking into account the nature of the Processing, Ramp will reasonably assist Company to fulfill Company's obligation to respond to the Request to the extent Company is unable to do so without Ramp's assistance. Company is responsible for verifying that the requestor is the Data Subject, and Ramp bears no responsibility for information provided in good faith to Company in reliance on Company's instructions. Ramp is not required to fulfill Requests where doing so would interfere with Ramp's ability to comply with Ramp's legal obligations, or protect its rights or those of a third party.

·f. Additional Assistance.

·Permanent link: f. Additional Assistance.

·Upon request by Company, Ramp will provide such information to Company as is reasonably necessary for Company to carry out data protection impact assessments or transfer impact assessments related to Company's use of the Services, or to engage in prior consultation with supervisory authorities relating to Company's use of the Services. To the extent legally permitted, Company will be responsible for any costs arising from Ramp's provision of assistance under this section. Each party agrees to provide reasonable assistance to the other party as necessary for the other party to fulfill its obligations under Data Protection Law.

·g. Return and Destruction.

·Permanent link: g. Return and Destruction.

·Following termination of the Agreement, Ramp will, upon the written request of Company, delete or destroy all Personal Data in its possession, except for back-ups maintained in the ordinary course of business that will be deleted in accordance with Ramp's retention or back-up policies. Ramp may also retain Personal Data for as long as necessary for Ramp to comply with or demonstrate compliance with Ramp's legal obligations, to prevent or mitigate fraud or security incidents, and to protect or enforce its rights or those of a third party. Ramp will continue to comply with the relevant provisions of this DPA until Personal Data retained by Ramp has been deleted.

·h. Audits and Inspections.

·Permanent link: h. Audits and Inspections.

• 1Upon reasonable written request by Company and subject to confidentiality obligations, Ramp will make available to Company information necessary to confirm Ramp's compliance with its obligations under applicable Data Protection Law. To the extent Data Protection Law or SCCs require Ramp to permit audits or inspections by Company, and information provided to Company by Ramp is not reasonably sufficient to confirm Ramp's compliance with its obligations under this DPA, Ramp will permit Company (or an independent auditor appointed by Company) to conduct audits or inspections to the extent necessary to confirm Ramp's compliance with its obligations under this DPA, subject to the additional requirements set out in this section.
• 2Any request for an audit or inspection must be sent in writing to Ramp's Information Security team at security@ramp.com. Following receipt by Ramp of an audit or inspection request under this section, the parties will work in good faith to agree on a reasonable start date, scope, costs, duration, and security and confidentiality controls applicable to the audit or inspection. Any audit or inspection must be conducted during regular business hours and must not unreasonably disrupt Ramp's business. Company will not be permitted to access confidential information of Ramp's other customers, employees, officers, directors, contractors, or other persons or entities in connection with an audit or inspection. Company will be responsible for the costs of any such audits or inspections, including reimbursement to Ramp for any time expended for on-site audits. Where SCCs apply, the parties agree that the audits described in SCCs will be carried out in accordance with this section. Ramp may object in writing to any auditor appointed by Company that, in Ramp's reasonable opinion, is not suitably qualified or independent, a competitor of Ramp, or otherwise manifestly unsuitable. Following any such objection, Company may appoint another auditor or conduct the audit itself.

55. International Data Transfers.

·Permanent link: 5. International Data Transfers.

·By using the Services, Company agrees to the transfer of Personal Data to and within the United States and other jurisdictions where Ramp operates. Cross-border transfers of Personal Data will be conducted in accordance with this DPA and applicable SCCs, as further described in Annex 2 of this DPA.

66. Liability.

·Permanent link: 6. Liability.

·To the maximum extent permitted by applicable law, and notwithstanding anything to the contrary, each party's liability under this DPA is subject to the disclaimers and limitations of liability under the Agreement.

77. Miscellaneous.

·Permanent link: 7. Miscellaneous.

·This DPA and any incorporated SCCs are an integral part of the Agreement where the Processing of Personal Data by Ramp is subject to Data Protection Law. The DPA and any applicable SCCs are deemed executed by and between the Parties as part of the Agreement. Where Ramp acts as a Processor, this DPA controls over any inconsistent or conflicting statement in Ramp's Privacy Policy or a product-specific privacy notice concerning that Processing.

·IN WITNESS WHEREOF, the parties have caused this Addendum to be executed by their respective duly authorized officers. Ramp | Company

Annex 1Annex 1. Details of Processing Activities

·Permanent link: Annex 1. Details of Processing Activities

·This Annex describes Processing in connection with the Services provided to Company under the Agreement. The categories, activities, and purposes below apply only to the products and features Company uses, the integrations and data sources it enables, and its documented instructions. A category listed for one product does not apply to another product merely because both are covered by this DPA. For example, Company's use of a standalone SaaS product does not, by itself, involve the financial services platform Processing described below. References to files, code, credentials, business records, and other information apply only to the extent that information includes or constitutes Personal Data.

11. List of Parties

·Permanent link: 1. List of Parties

·Data exporter(s):

• ·Name: As set out in the Agreement.
• ·Address: As set out in the Agreement.
• ·Contact person's name, position and contact details: As set out in the Agreement.
• ·Activities relevant to the data transferred under these Clauses: Application for and use of the Services pursuant to the Agreement.
• ·Signature and date: This Annex 1 shall be deemed executed upon execution of the DPA.
• ·Role: Controller (Modules 1 and 2) or Processor (Module 3), as applicable.

·Data importer(s):

• ·Name: Ramp Business Corporation, or if a Ramp affiliate is designated in the Agreement, then the relevant affiliate.
• ·Address: 28 West 23rd Street, Floor 2, New York, NY 10010, United States of America or, for a Ramp affiliate, as set out in our Trust Center.
• ·Contact person's name, position and contact details: As set out in the Agreement.
• ·Activities relevant to the data transferred under these Clauses: Processing as a Controller for the applicable purposes described in Section 3(a) of this DPA and, as a Processor or Subprocessor, to provide the applicable Services on Company's behalf as described in Section 4 and this Annex.
• ·Signature and date: This Annex 1 shall be deemed executed upon execution of the DPA.
• ·Role: Controller (Module 1) or Processor (Modules 2 and 3).

22. Description of Transfer

·Permanent link: 2. Description of Transfer

·Categories of data subjects whose personal data is transferred

·The categories of Data Subjects whose Personal Data is Processed include: (1) Company's personnel, including employees, contractors, administrators, and other Authorized Users; (2) Company's customers, prospects, end users, suppliers, vendors, payees, and other transaction counterparties; and (3) correspondents and other natural persons whose Personal Data is contained in information Company or its Authorized Users submit, connect, retrieve, or generate through the Services, including users of Company's applications and individuals identified in documents, repositories, records, communications, prompts, or outputs. These categories apply only to the extent relevant to Company's use of the Services.

·Categories of personal data transferred

• ·Module 1: Personal Data Processed includes the categories described in Section 3 of Ramp's Privacy Policy and any applicable product-specific privacy notice, but only to the extent Processed in connection with the Agreement for the Controller purposes described in Section 3(a) of this DPA. Such categories may include account and contact information; billing and payment information; browser, device, and network information, including approximate location; metadata and usage data related to the Services and Ramp's websites; support communications; identity-verification information, including a photograph or other identifying information; and, where relevant to a regulated financial product, identity-verification, ownership, underwriting, and risk information. Product-specific privacy notices do not include unrelated website, advertising, event, or prospect processing within the transfers described in this Annex.
• ·Modules 2 and 3: The categories below are Processed on behalf of Company in connection with the applicable Services.

·Shared categories applicable across Services:

• ·Identity, contact and profile information: names, job titles, contact details, account and user identifiers, employer, department, manager or delegate relationships, user status, roles, permissions, memberships, invitations, settings, and preferences.
• ·Authentication information: login and authentication information, API keys, access and refresh tokens, other credentials supplied for connected accounts, and connection configuration and resource identifiers.
• ·Content and Connected Data: Personal Data in documents, files, attachments, messages, images, audio or video, transcripts, structured records, and other information supplied by or on behalf of Company or retrieved from data sources Company connects to the Services, to the extent supported by the applicable Service.
• ·Activity and derived information: session and request identifiers, access and audit logs, workflow and approval history, diagnostic information, and Personal Data extracted, classified, summarized, inferred, or otherwise generated in carrying out Company's instructions.

·Product-specific categories, in addition to the applicable shared categories: Services | Categories of Personal Data

·The Personal Data contained in customer-provided or connected content and generated outputs depends on Company's instructions and use of the applicable Services. This description includes other Personal Data provided or made available by or on behalf of Company or its Authorized Users, or generated in carrying out their instructions, subject to the sensitive-data restrictions below.

·Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

• ·Module 1: Sensitive Personal Data Processed includes the sensitive categories described in Section 3 of Ramp's Privacy Policy or the applicable product-specific privacy notice to the extent Processed for the Controller purposes described in Section 3(a) of this DPA. Financial-product identity-verification or underwriting categories do not apply solely because Company uses a standalone SaaS product. The applicable safeguards in Annex 3 apply to this Processing.
• ·Modules 2 and 3: The following categories are for the applicable Services and purposes described below and to the extent supported by those Services:

·Shared categories applicable across the Services:

• ·API keys, access tokens, and other user-supplied connection credentials required for the applicable Service.
• ·Sensitive Personal Data contained in content supplied by or on behalf of Company and its Authorized Users, retrieved from Company-connected data sources, or generated in carrying out Company's or its Authorized Users' instructions, to the extent expressly permitted under this DPA and supported by the applicable Service.
• ·Contents of communications retrieved through enabled email, calendar, or messaging integrations, unless Ramp is the intended recipient of the communication.

·Product-specific categories, in addition to the applicable shared categories:

·Inferences or other derived data that meet the definition of Personal Data and that reveal a permitted sensitive category are subject to the same product and purpose limitations as that category and are handled in accordance with the source data. Other sensitive or special category Personal Data not listed above, including protected health information, information of minors, or biometric identification data, remain restricted under Section 2(b)(2).

·Safeguards and restrictions: Sensitive Personal Data is subject to the applicable purpose limitations in this Annex, Company's documented instructions for Processor activities, and the access controls, access logging, encryption, personnel training, and other applicable measures set out in Annex 3. Onward disclosure by Ramp in its capacity as Processor is subject to Section 4(d), Company's documented instructions, and the applicable international-transfer provisions.

·The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)

·Personal Data is transferred on an ongoing basis during Company's use of the applicable Services.

·Nature of the processing

• ·If Ramp is a Controller: Processing for the applicable independent Controller activities described in Section 3(a) of this DPA, as further explained in Ramp's Privacy Policy and the applicable product-specific privacy notice.
• ·If Ramp is a Processor or Subprocessor: Collection and retrieval; receipt and transmission; organization, storage, and access; indexing and search where supported; extraction, analysis, classification, summarization, and inference; generation of outputs and artifacts; execution of customer-configured workflows and authorized tool actions; disclosure or sharing at Company's direction; support and maintenance; and return, deletion, or destruction, in each case as applicable to the Services used and in accordance with Section 4 and Company's documented instructions. Processing includes transient handling of Personal Data even where content storage is disabled.

·Purpose(s) of the data transfer and further processing

• ·If Ramp is a Controller: The applicable purposes described in Section 3(a) of this DPA, limited to the Services provided under the Agreement.
• ·If Ramp is a Processor or Subprocessor: To provide, administer, secure, support, and maintain the applicable Services on Company's behalf under Section 4, including the following purposes: Services | Processor purposes

·The period for which the Personal Data will be retained, or, if that is not possible, the criteria used to determine that period.

·Retention depends on the applicable Service, category of Personal Data, purpose of Processing, and any retention or deletion terms agreed with Company. For Processor activities, Ramp retains Personal Data as necessary to provide the applicable Services in accordance with Company's documented instructions, available settings, and Section 4(g). Relevant criteria include: (1) whether content is needed only to fulfill a request or is retained for an enabled history, memory, collaboration, or artifact feature; (2) the period needed for historical usage, cost, transaction, or workflow reporting; (3) the continued need for credentials to maintain an authorized connection; and (4) the applicable periods for access records, operational logs, and backups. Where available in certain Services, disabling content storage does not itself eliminate transient Processing or separately applicable retention of usage data, metadata, or security records, and disconnecting a source does not itself determine the deletion of previously imported information.

·Post-termination retention and deletion, including backups and applicable legal, fraud, security, and rights-protection exceptions, are governed by Section 4(g) and other relevant terms in the Agreement and any applicable product-specific terms agreed with Company. For Controller activities, retention is determined by the applicable purpose under Section 3(a), legal requirements, and the criteria described in the applicable privacy notice. Ramp-side settings do not by themselves establish the retention practices of an independently customer-engaged AI provider or connected service.

·For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

·For transfers by Ramp to Subprocessors, the subject matter, nature, purposes, and duration of Processing are the applicable Services, data categories, activities, purposes, and retention criteria described in this Annex, subject to Section 4(d) and the Agreement. The applicable Subprocessors are identified through the List referred to in Section 4(d). Where Company independently engages an AI provider or connected service and directs Ramp to transmit Personal Data to it, that recipient's Processing is governed by its agreement with Company; Ramp's own Processing remains governed by this DPA. The use of a customer-supplied API key or access token alone does not determine a data recipient's role or contractual relationship.

33. Competent Supervisory Authority

·Permanent link: 3. Competent Supervisory Authority

·The competent supervisory authorities are as follows:

• ·EU SCCs: the competent supervisory authority determined in accordance with Clause 13 of the EU SCCs.
• ·UK Addendum: UK Information Commissioner's Office.
• ·Swiss FADP: Swiss Federal Data Protection and Information Commissioner

Annex 2Annex 2. Cross-border Transfers and Jurisdiction-specific Terms

·Permanent link: Annex 2. Cross-border Transfers and Jurisdiction-specific Terms

11. Brazil.

·Permanent link: 1. Brazil.

·To the extent Company transfers Personal Data to Ramp from Brazil, the parties hereby agree to, and incorporate as part of the DPA, the Brazil SCCs, which will apply to cross-border Personal Data transfers with the following modifications: (1) in Clause 1.1, the first box is completed with Company's information from Annex 1 of the DPA and "Exporter/Controller" is selected, the second box is completed with Ramp's information from Annex 1 of the DPA, "Importer/Controller" is selected to the extent Sections 2 and 3 of the DPA apply, and "Importer/Processor" to the extent Sections 2 and 4 of the DPA apply; (2) Clause 2.1 is completed with the information set out in Annex 1 of the DPA; (3) in Clause 3, the parties select Option B. In Clause 3.1, the information regarding the transfer is set out in Annex 1 of the DPA; and (4) in Clause 4, Option A applies to the extent both Sections 2 and 3 of the DPA apply, and the exporter is responsible for the obligations under Section 4.1 of the Brazil SCCs, but Option B applies to the extent both Sections 2 and 4 of the DPA apply, in which case, Company will provide the relevant information about the third-party Controller.

22. European Economic Area, Switzerland, and the United Kingdom.

·Permanent link: 2. European Economic Area, Switzerland, and the United Kingdom.

·For any Restricted Transfers of Personal Data subject to European Data Protection Law, the parties hereby agree to, and incorporate as part of the DPA, the EU SCCs, with the following modifications: (1) for transfers described in Annex 1 in which Company is the exporter and Ramp is the importer, Module 1 applies where both parties act as Controllers, Module 2 applies where Company is a Controller and Ramp is a Processor, and Module 3 applies where Company is a Processor and Ramp is a Subprocessor; (2) Clause 7 (Docking clause) does not apply; (3) where Ramp is a Processor, in Clause 9(a), Option 2 applies, Company grants Ramp general written authorization, and the time period for prior Notice of a Subprocessor change is set out in Section 4(d) of this DPA; (4) in Clause 11(a) (Redress), the optional language does not apply; (5) in Clause 17 (Governing Law), Option 1 applies, and the member state is Ireland; (6) in Clause 18(b) (Choice of Forum and Jurisdiction), the member state is Ireland; (7) Annex I is completed as set out in Annex 1 of the DPA; and (8) Annex II is completed as set out in Annex 3 of the DPA.

·For purposes of the UK Addendum, the parties agree to change the format of the information set out in Part 1 of the UK Addendum so that: (a) the details of the parties in Table 1 of the UK Addendum are as set out in Annex 1 of this DPA, with Company as the exporter and Ramp as the importer (with no requirement for signature); (b) for purposes of Table 2, the UK Addendum is hereby appended to the EU SCCs as modified above and including the Annexes; (c) the appendix information listed in Table 3 is set out in Annex 1 and Annex 3 of this DPA, and Annex III is not applicable; and (d) either Party may end the UK Addendum as set out in Section 19 of the UK Addendum.

·Where the Swiss FADP applies, the EU SCCs are modified such that the term "member state" must not be interpreted in such a way as to exclude individuals in Switzerland from the possibility of suing to enforce their rights in their place of habitual residence.

33. India.

·Permanent link: 3. India.

·Where the DPDPA applies, a transfer of Personal Data from India to any country outside India that is restricted or prohibited pursuant to the DPDPA is considered a "Restricted Transfer."

Annex 3Annex 3. Technical and Organizational Measures to Ensure the Security of Personal Data

·Permanent link: Annex 3. Technical and Organizational Measures to Ensure the Security of Personal Data

·This Annex describes the technical and organizational measures implemented by Ramp to help ensure an appropriate level of security, taking into account the nature, scope, context, and purpose of the Processing, and the risks to the rights and freedoms of natural persons. The security measures in each part of this Annex apply to Ramp's relevant information systems used to Process Personal Data and Company Data.

·Minimum Technical and Organizational Measures

·Ramp will implement and maintain appropriate technical and organizational measures designed to protect Personal Data and Company Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Company Data and Personal Data, including the policies, procedures, and internal controls set forth in this Annex.

11. Administrative Controls

·Permanent link: 1. Administrative Controls

·Secure Development and Change Management

·Ramp will implement and maintain a secure software development lifecycle policy designed to incorporate security considerations throughout system design, development, testing, and deployment and address secure coding standards, peer code reviews, vulnerability scanning, periodic penetration testing, and documented change management procedures.

·Documentation and Training

·Ramp maintains documentation of its technical and organizational measures for audit and evidentiary purposes and takes measures designed to ensure that personnel are trained on and comply with applicable security and data protection requirements.

·Security Incident Management

·Ramp will Notify Company promptly and without undue delay after becoming aware of a Security Incident that impacts Confidential Information or Personal Data under this Agreement. Ramp will take appropriate steps to investigate, contain, and remediate the Security Incident. Ramp will also provide reasonable assistance to Company in complying with its obligations to Notify any Security Incident to any supervisory authority and/or to affected persons where such Notification is required by applicable law. Ramp will not make public statements regarding a Security Incident that names Company without Company's prior written consent.

22. Technical Controls

·Permanent link: 2. Technical Controls

·Access Control of Processing Environments

·Ramp will implement and maintain measures designed to prevent unauthorized physical and logical access, including review of cloud provider security documentation with respect to: established security controls restricted access paths access authorizations logging and monitoring of access

·Access Control to Data Processing Systems

·Ramp will implement and maintain, as appropriate, the following controls:

• ·access controls based on the principle of least privilege multi-factor authentication
• ·industry-standard encryption technologies
• ·automatic session lockouts including account lockout policies for failed authentication attempts and re-authentication requirements
• ·monitoring of authentication events and logging and tracking of access

·Authorization and Use Control

·Ramp will implement and maintain measures designed to ensure that authorized personnel can access Personal Data only within the scope of their assigned permissions, including: role-based access control individual user accounts monitoring of data modifications secure data release processes encryption technologies controlled data destruction

·Availability Control

·Ramp will implement and maintain measures, including: infrastructure redundancy

• ·regular backups stored in secure cloud environments
• ·documented business continuity and disaster recovery procedures
• ·periodic testing of recovery capabilities

·Logging, Monitoring, and Detection

·Ramp maintains centralized logging and monitoring controls designed to detect unauthorized access, misuse, or anomalies affecting Personal Data or Company Data. Controls are in place that are designed to protect such data from unauthorized access and such data is retained in accordance with legal, regulatory, and security requirements.

·Transmission Control

·Ramp will implement and maintain measures, including:

• ·use of industry-standard firewalls and encryption protocols integrity checks
• ·logging and monitoring of data transfers alerts for incomplete transmissions

·Input Control

·Ramp will implement and maintain controls designed to govern the input, modification, and deletion of Personal Data and Company Data, including:

• ·authorization policies and protective measures for the input, reading, alteration and deletion of data authentication mechanisms unique credentials automatic log-off
• ·audit logging (including, but not limited to, input authorization)
• ·electronic recording of data entries, as applicable

·Encryption and Key Management

·Personal Data and Company Data will be encrypted at rest and in transit using industry-standard algorithms. Encryption keys are managed using centralized key management systems with restricted access, role-based permissions, logging, monitoring, and periodic rotation.

·Monitoring of Administrators

·Ramp will:

• ·assign system administrators individually log and monitor administrative access protect administrative logs
• ·conduct audits of administrative activity to ensure compliance with assigned responsibilities and applicable laws

33. Physical Security Controls

·Permanent link: 3. Physical Security Controls

·Ramp maintains appropriate physical and environmental safeguards, which vary by specific location, but generally include: entry checkpoints and logs facility security personnel

• ·subject to applicable legal requirements, video monitoring of office locations environmental controls