Ontra Data Processing Addendum | Ontra

Ontra Data Processing Addendum

Last Updated: June 15, 2026

This Data Processing Addendum (this “DPA”) is entered into between the Customer identified in the Order Form and Ontra, and is governed by the Ontra Customer License General Terms and Conditions (the “General Terms”). By executing the Order Form, Customer agrees to the terms and conditions set forth in this DPA on behalf of itself and, to the extent required under applicable Data Protection Laws, in the name and on behalf of its Affiliates, if any. This DPA incorporates the terms of the General Terms, and any terms not defined in this DPA shall have the meaning set forth in the General Terms.

Subject to the terms and conditions set forth herein, the Parties agree as follows:

1 Definitions

1.1. “Account Data” means data, including personal data, that relates to Ontra’s relationship with Customer or individual users of the Services or other Ontra offerings, including the names or contact information of individuals authorized by Customer to access Customer’s account and billing information. Account Data also includes any data Ontra may need to collect for managing its relationship with Customer, identity verification, or as required by applicable laws and regulations and all meta data or technical system data created in connection with Ontra’s delivery of Services.

1.2. “Authorized Sub-Processor” means a Sub-Processor who is either (i) listed at https://trust.ontra.ai/subprocessors (the “List”) or (ii) subsequently authorized under Section 3.1(b) or Section 3.2 of this DPA, and that may process Customer Personal Data in connection with the provisions of those services.

1.3. “Data Protection Laws” means any applicable laws and binding regulations relating to the processing of Personal Data including: (i) the California Consumer Privacy Act (Cal. Civ. Code §§ 1798.100 et seq.), as amended by the California Privacy Rights Act of 2020 (“CCPA”) and other U.S. state comprehensive data protection laws; (ii) the General Data Protection Regulation (EU) 2016/679 (“EU GDPR”); (iii) the UK GDPR; (iv) the Swiss Federal Act on Data Protection; (v) the UK Data Protection Act 2018; (vi) the Privacy and Electronic Communications (EC Directive) Regulations 2003; and (vii) the Personal Data (Privacy) Ordinance (Chapter 486 of the laws of Hong Kong).

1.4. “EU SCCs” means the standard contractual clauses approved by the European Commission for transfers of personal data to countries not recognized as offering an adequate level of protection.

1.5. “Ontra Group” means Ontra, LLC and all of its Affiliates.

1.6. “Standard Contractual Clauses” means the EU SCCs and the UK SCCs.

1.7. “Sub-Processor” means a third-party engaged by Ontra to enable Ontra to perform its obligations under this DPA or the General Terms.

1.8. “Usage Data” means Service usage data collected and processed by Ontra in connection with the provision of the Services.

2 Relationship of the Parties; Processing of Data

2.1. The Parties acknowledge and agree that, except as set forth in Section 8 of this DPA, Ontra shall act as a processor in connection with the processing of Personal Data. Customer shall process Personal Data, and provide instructions for the processing of Personal Data, in compliance with Data Protection Laws.

2.2. Ontra shall not process Personal Data (i) for purposes other than those set forth in the General Terms, (ii) in a manner inconsistent with this DPA, or (iii) in violation of Data Protection Laws.

2.3. The subject matter, nature, purpose, and duration of this processing, as well as the types of Personal Data collected and categories of Data Subjects, are described in Exhibit 1 to this DPA.

2.4. Ontra shall ensure that any employees authorized to process Personal Data are subject to appropriate confidentiality obligations.

2.5. Following completion of the Services or upon Customer’s written request, Ontra shall return or delete Customer’s Personal Data unless further storage is required by applicable law.

2.6. To the extent the CCPA applies to Customer’s Personal Data processed within the Services, the Parties acknowledge and agree that, except as set forth in Section 8 of this DPA, Ontra shall act as a service provider to Customer.

2.7. Ontra shall not "sell" or "share" Personal Data provided by Customer under the General Terms.

2.8. Ontra shall only retain, use, or disclose Personal Data for necessary purposes to perform the Services for Customer.

2.9. Ontra shall not combine Personal Data received from Customer with other parties' data in violation of the CCPA.

2.10. To the extent required under US Data Protection Law, where Ontra creates or processes Deidentified data, appropriate measures will be adopted.

3 Authorized Sub-Processors and Third Parties

3.1. Customer acknowledges that Ontra may share Personal Data with all entities that are part of Ontra Group and Authorized Sub-Processors to allow processing.

3.2. The List will be made available to Customer at a link provided, which may be updated by Ontra.

3.3. If Customer reasonably objects to an engagement in accordance with Section 3.2, Customer may discontinue the use of the affected Service.

3.4. If Customer does not object to a third-party engagement, that third party will be deemed an Authorized Sub-Processor.

3.5. Ontra will enter into a written agreement with the Authorized Sub-Processor imposing comparable data protection obligations.

4 Security of Personal Data.

4.1. Ontra shall maintain reasonable technical and organizational measures to meet a level of security appropriate to the risk of processing Personal Data.

5 Transfers of Personal Data.

5.1. Ontra may transfer Personal Data processed under this DPA outside the country in which the Customer or relevant Data Subjects are located, including outside of the EEA.

5.2. The Standard Contractual Clauses will apply to Customer’s Personal Data subject to the GDPR transferred to any Third Country.

5.3. The Standard Contractual Clauses will not apply to transfers of Customer’s Personal Data where Ontra has adopted an alternative compliance mechanism.

6 Rights of Data Subjects

6.1. Ontra shall notify Customer upon receipt of a request by a Data Subject to exercise their rights under Data Protection Law.

6.2. Ontra shall, at the request of the Customer, assist in complying with Customer’s obligations relating to Data Subject Requests.

7 Actions and Access Requests; Audits

7.1. Ontra shall provide Customer with reasonable cooperation for compliance with Data Protection Laws to conduct data protection impact assessments.

7.2. Ontra shall provide Customer with cooperation and assistance for any consultation with Supervisory Authorities.

7.3. Ontra shall maintain records or information sufficient to demonstrate its compliance.

7.4. Ontra will allow for reasonable inspections or audits, to the extent required by Data Protection Laws.

7.5. Ontra shall immediately notify Customer if an instruction infringes Data Protection Laws.

7.6. In the event of a Personal Data Breach, Ontra shall inform Customer and take steps to remediate such violation.

8 Ontra’s Role as a Controller.

8.1. The Parties acknowledge that with respect to Account Data and Usage Data, Ontra is an independent controller.

9 Assignment.

9.1. Ontra may subcontract its obligations under this DPA to an Authorized Subprocessor.

10 Conflict.

10.1. In the event of any conflict among the following documents, the order of precedence will be: (1) the applicable terms in the Standard Contractual Clauses; (2) the terms of this DPA; (3) the General Terms; (4) Ontra’s privacy policy.

Exhibit 1

Nature and Purpose of Processing: Ontra will process Customer’s Personal Data as necessary to provide the Services. The nature of processing includes:

Duration of Processing: Ontra will process Customer’s Personal Data as long as required to provide the Services.

Categories of Data Subjects: Customer’s individual employees, consultants, agents, contractors, customers, partners, fund participants, investors, and other Authorized Users.

Categories of Personal Data: Ontra processes Personal Data contained in Account Data, Usage Data, and any Personal Data provided by Customer.

Sensitive Data or Special Categories of Data: In limited circumstances for Services specifically requested by Customer, Ontra may process Sensitive Data or Special Categories of Data.

Exhibit 2

The Parties

Data exporter(s): The Customer

Data importer(s): Ontra
Address: 2041 East Street PMB 39 Concord, CA 94520

Exhibit 3

Description of Technical and Organizational Security Measures

Technical and Organizational Security Measure Details
Encryption of personal data Data is encrypted at rest with AES-256.
Ongoing confidentiality Administrative and technical measures to protect Personal Data.
Availability of personal data AWS Aurora backup systems utilized.
Access control measures Strong passwords and two-step authentication required.
Data logging Activity is routinely logged for security purposes.
Data destruction procedures Upon request, all customer data will be deleted.

Exhibit 4

European Data Transfers

  1. Definitions: Data Exporter (Customer), Data Importer (Ontra)
  2. Transfer Description: The personal data processed under this DPA is detailed in Exhibit 2.
  3. Competent Supervisory Authority: The Supervisory Authority for the Data Exporter as determined under EU and UK Data Protection Law.

Previous Versions: