Data Processing Addendum

Last updated: 18 September 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Legion Code Inc. ("OSPRY", "we", "us") and the customer identified in the applicable order form ("Customer", "you"). It governs our processing of personal information on your behalf.

If you have signed a negotiated data processing agreement with us, that document governs and this one does not apply.

1. What this DPA covers, and what it does not

This is the most important section of this document. Read it before the rest.

OSPRY handles personal information in two different capacities, and only one of them is covered here.

Covered: Customer Personal Data. This is personal information you give us or direct us to process so that we can provide the Services to you. It includes the contact and account records you upload, the records you connect through an integration, the data you send to our API, and the personal information of your own staff who use the portal. For this data you are the controller and we are your processor. We process it only on your documented instructions. Everything below applies to it.

Not covered: Output Data from visitor identification. Our visitor identification service works by matching a visitor against identity graphs that our identity-resolution partners build and operate. Those partners maintain their own databases, decide independently what goes into them and how it is used, and serve their own customers as well as us. For that data we and those partners each act as an independent controller, not as your processor, because the processing is not carried out on your instructions and we could not stop it on your instruction alone.

This is a deliberate carve-out, not an oversight. A DPA that promised we process everything solely on your instructions would be inaccurate for this part of the Services, and an inaccurate assurance is worse than a clearly drawn boundary. How that processing works, and what choices individuals have over it, is described in the Privacy Notice under "Our visitor identification services" and on the Sub-Processors page.

Your own obligations as a controller when you deploy our tag, including the consent banner requirement, are in Section 5 of the Terms. They are conditions of use, not recommendations, and nothing in this DPA relieves you of them.

2. Definitions

"Data Protection Law" means all privacy and data protection laws applicable to the processing under this DPA, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws including the California Consumer Privacy Act as amended ("CCPA").

"Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the GDPR. "Business", "service provider", "sell" and "share" have the meanings given in the CCPA.

"Customer Personal Data" means personal data within Section 1 that we process on your behalf.

"Sub-processor" means a third party engaged by us to process Customer Personal Data.

3. Processing instructions

We process Customer Personal Data only on your documented instructions, which consist of this DPA, the Terms, your configuration of the Services, and any further written instruction you give us.

We will tell you if, in our opinion, an instruction infringes Data Protection Law. We may suspend the affected processing until the instruction is withdrawn or amended.

The subject matter, nature, purpose and duration of the processing, and the categories of data subject and personal data, are set out in Annex 1.

4. Confidentiality

We ensure that every person we authorise to process Customer Personal Data is bound by an appropriate obligation of confidentiality, and that access is limited to those who need it to provide or support the Services.

5. Security

We implement and maintain the technical and organisational measures set out in Annex 2, taking account of the state of the art, the cost of implementation, and the nature, scope, context and purposes of processing, as well as the risk to individuals.

We may update those measures as the Services evolve. We will not make a change that materially reduces the overall level of protection.

6. Sub-processors

You give us general authorisation to engage sub-processors. Our current sub-processors are listed at ospry.ai/legal/subprocessors, which is the authoritative list.

We will give you at least 15 days' notice before a new sub-processor begins processing Customer Personal Data. You may object on reasonable grounds within 10 days of that notice. If we cannot accommodate your objection, either party may terminate the affected Services without penalty for the unused portion of any prepaid fees.

We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain liable to you for their performance.

This notice right does not extend to the identity-resolution partners and the identity networks behind them. Those parties are not our sub-processors: they do not process Customer Personal Data, and they act as independent controllers of Output Data as described in Section 1. We do not hold a contractual right to advance notice of changes within those networks, so we cannot pass one to you and do not pretend to. We list them on the Sub-Processors page for transparency and we update that page when our own arrangements change. If the identity of those partners is material to you, raise it before signature rather than relying on this Section.

7. Assistance with data subject rights

Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures, so far as is reasonably possible, to respond to requests from data subjects to exercise their rights.

If we receive a request that relates to Customer Personal Data, we will not respond to it directly except to tell the individual to contact you, unless legally required to do otherwise. We will forward the request to you without undue delay.

Requests concerning identification Output Data are handled by us as controller, through the process described in the Privacy Notice. They are not covered by this Section.

8. Personal data breach

We notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

Where we cannot provide all of that at once, we provide it in phases without further undue delay. We assist you with your own notification obligations to supervisory authorities and data subjects.

9. Data protection impact assessments

We provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, where these relate to our processing of Customer Personal Data and taking into account the information available to us.

10. Return and deletion

On termination, you may export Customer Personal Data through the portal or API. As stated in Section 4 of the Terms, a limited export-only sign-in remains available for 30 days after your paid period ends.

At the end of that period we return or delete Customer Personal Data at your election. If you make no election, we delete it. We may retain a copy where Data Protection Law requires us to, for as long as that requirement lasts, and the obligations in this DPA continue to apply to any copy we retain.

Backups are overwritten on their ordinary cycle rather than deleted on demand. Data in a backup is not restored to active use after a deletion request.

11. Audits and information

We make available to you the information reasonably necessary to demonstrate compliance with this DPA, and we allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

Audits are at your expense, on at least 30 days' written notice, no more than once in any 12 month period except where required by a supervisory authority or following a personal data breach, during business hours, and subject to confidentiality. We may satisfy an audit request by providing a report or questionnaire response where that reasonably addresses your request.

We do not hold a SOC 2 attestation of our own. As stated in Section 9 of the Terms, the SOC 2 report covering parts of the identity-resolution supply chain belongs to our data provider, not to us, and we are not permitted to present it as ours. We do hold a contractual right to obtain compliance information from that provider and to audit it, and we will exercise that right on reasonable request where it is relevant to your assessment.

12. International transfers

Where we transfer Customer Personal Data out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the transfer is governed by the European Commission's Standard Contractual Clauses (Decision 2021/914), which are incorporated into this DPA by reference.

• Module Two (controller to processor) applies where you are a controller.
• Module Three (processor to processor) applies where you are a processor acting for your own customer.
• For UK transfers, the UK International Data Transfer Addendum applies to the Clauses.
• For Swiss transfers, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the Federal Data Protection and Information Commissioner is the competent authority.

For the purposes of Annex I to the Clauses, you are the data exporter and we are the data importer, the details of processing are in Annex 1, the security measures are in Annex 2, and the sub-processor list is the Sub-Processors page. The governing law and forum are those stated in the Terms unless the Clauses require otherwise.

13. United States state privacy law

For Customer Personal Data we act as a service provider (CCPA) or processor (other US state laws). We:

• do not sell or share Customer Personal Data, as those terms are defined;
• do not retain, use or disclose it for any purpose other than performing the Services, or as otherwise permitted by the CCPA;
• do not retain, use or disclose it outside our direct business relationship with you;
• do not combine it with personal information from another source, except as the CCPA permits for a service provider; and
• notify you if we determine we can no longer meet these obligations.

You may take reasonable and appropriate steps to stop and remediate unauthorised use.

These commitments are about Customer Personal Data. They are not statements about identification Output Data, which is addressed in the Privacy Notice, and you should not read them as covering it.

14. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in Section 12 of the Terms.

15. Order of precedence

In the event of conflict, this DPA prevails over the Terms in respect of the processing of Customer Personal Data. The Standard Contractual Clauses prevail over this DPA to the extent of any conflict.

16. Term

This DPA takes effect when you accept the Terms and continues until we no longer process Customer Personal Data. Sections 4, 10, 11 and 14 survive termination.

17. Contact

Legion Code Inc. privacy@legioncodeinc.com

Annex 1: Details of processing

Annex 2: Technical and organisational measures

Specific product and vendor names are on the Sub-Processors page rather than here, so that a vendor change does not require an amendment to this DPA.

Annex 3: Sub-processors

The current list is published at ospry.ai/legal/subprocessors and is incorporated into this DPA by reference. Section 6 governs changes to it.