Data Sharing Addendum

Personal Data: Any information relating to an identified or identifiable natural person.

Lead Data: Personal data of potential customers shared with Vendors through the Platform.

Data Controller: The party that determines the purposes and means of processing personal data.

Data Processor: The party that processes personal data on behalf of the Data Controller.

Data Subject: An individual whose personal data is being processed.

3.1 Cadonex as Controller: For data collected on the Platform, Cadonex acts as Data Controller.

3.2 Vendor as Controller: Upon receiving Lead Data, Vendor becomes an independent Data Controller for that data.

3.3 Joint Processing: Where data is processed jointly, both parties share Controller responsibilities.

Lead Data may include:

• Name and contact information (email, phone)
• Company name and size
• Industry and role
• Product/service interests
• Inquiry details and requirements
• Consultation/demo preferences

Sensitive Data: No sensitive personal data (health, religion, etc.) is shared.

5.1 Consent: Data subjects provide consent when submitting inquiries or requesting contact.

5.2 Legitimate Interest: Processing is necessary for the legitimate interests of connecting buyers with vendors.

5.3 Contract: Processing is necessary for performing requested services.

6.1 Purpose Limitation: Lead Data may only be used to respond to inquiries and provide requested services.

6.2 Security Measures: Vendor must implement appropriate technical and organizational security measures including:

• Encryption of data in transit and at rest
• Access controls and authentication
• Regular security assessments
• Employee training on data protection

6.3 Data Retention: Lead Data should not be retained longer than necessary. Maximum retention: 24 months from last interaction.

6.4 Sub-processors: Any third-party processing requires equivalent data protection obligations.

6.5 No Sale: Lead Data may not be sold to third parties.

Vendor must facilitate the following data subject rights:

• Access: Right to obtain copy of personal data
• Rectification: Right to correct inaccurate data
• Erasure: Right to deletion ("right to be forgotten")
• Portability: Right to receive data in structured format
• Objection: Right to object to processing
• Restriction: Right to limit processing

Response Time: Requests must be fulfilled within 30 days.

Notification: Vendor must notify Cadonex of any data subject requests within 48 hours.

8.1 Definition: A data breach is any unauthorized access, disclosure, or loss of personal data.

8.2 Notification to Cadonex: Vendor must notify Cadonex of any breach within 24 hours of discovery.

8.3 Notification Content: Breach notifications must include:

• Nature of the breach
• Categories and number of data subjects affected
• Likely consequences
• Measures taken or proposed

8.4 Regulatory Notification: Vendor is responsible for notifying relevant authorities as required by law.

9.1 Transfer Mechanisms: For transfers outside the EEA/UK, appropriate safeguards must be in place:

• Standard Contractual Clauses (SCCs)
• Binding Corporate Rules
• Adequacy decisions

9.2 US Transfers: For US-based vendors, EU-US Data Privacy Framework certification or SCCs apply.

10.1 Right to Audit: Cadonex may audit Vendor's compliance with this DSA upon reasonable notice.

10.2 Cooperation: Vendor agrees to cooperate with audits and provide necessary documentation.

10.3 Third-Party Audits: Cadonex may engage third-party auditors subject to confidentiality obligations.

11.1 DPO: If required, Vendor must appoint a Data Protection Officer.

11.2 Records: Vendor must maintain records of processing activities.

11.3 DPIA: For high-risk processing, a Data Protection Impact Assessment must be conducted.

12.1 Service Provider: Vendor acts as a "service provider" under CCPA.

12.2 No Sale: The sharing of Lead Data does not constitute a "sale" under CCPA.

12.3 Disclosure: Vendor must provide required disclosures to California residents.

13.1 Upon Termination: Vendor must cease using Lead Data for new marketing.

13.2 Data Deletion: Upon request, Vendor must delete or return all Lead Data within 30 days.

13.3 Certification: Vendor must provide written certification of data deletion.

14.1 Vendor Liability: Vendor is liable for breaches of this DSA and resulting damages.

14.2 Indemnification: Vendor indemnifies Cadonex against claims arising from Vendor's data processing violations.