Data Processing Addendum

1. Scope, Incorporation, and Precedence

1.1 Automatic application. This DPA applies, without signature, to anyone who uses the Services for business or organizational purposes (an organization may be a single person) whenever Owl processes Customer Personal Data on Customer’s behalf. It takes effect when Customer first accepts the Terms or uses the Services for such purposes, and continues until Owl has deleted or returned Customer Personal Data (Section 11).

1.2 Not covered. This DPA does not apply to individuals using the Services for personal, non-commercial purposes (Privacy Notice Section 1.2(d)), or to Personal Data for which Owl is the controller under the Privacy Notice, such as account, billing, Usage Data, and Service Data.

1.3 Precedence. For the processing of Customer Personal Data on Customer’s behalf: (a) the Clauses and UK Addendum (Section 12), where operative, control over everything else; (b) a data processing addendum in a signed Customer Agreement supersedes this DPA for the processing it covers, and this DPA applies only to matters it does not address (including Section 12, if it has no international transfer terms); and (c) otherwise this DPA controls over the Terms and any Order, except that the Terms control ownership of and rights in the Services, Service Data, De-Identified Data, the results of the Training License, and the Owl Purposes (Section 3.2).

2. Definitions

“Customer Personal Data” means Personal Data in Customer Content that Owl processes on Customer’s behalf to provide the Services, including any Biometric Data. It excludes De-Identified Data.

“U.S. State Privacy Laws” means the California Consumer Privacy Act as amended (“CCPA”) and other U.S. state comprehensive privacy laws. “Data Protection Laws” means laws applicable to Owl’s processing of Customer Personal Data, including U.S. State Privacy Laws, the Biometric Laws, and, where Section 12 is operative, International Data Protection Laws.

“Business Purposes” means the purposes in Annex 1. “Security Incident” means a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data held by Owl or its Subprocessors. “Subprocessor” means a Third-Party Provider that processes Customer Personal Data.

“Controller,” “processor,” “sell,” “share,” and “process” have the meanings in Data Protection Laws; “controller” includes “business,” and “processor” includes “service provider” and “contractor.”

3. Roles; Owl’s Independent Purposes

3.1 Processing on Customer’s behalf. Customer is the controller of Customer Personal Data and appoints Owl as its processor for the Business Purposes. If Customer is itself a processor for another controller (such as a league, team, or players’ association), Owl is a sub-processor, and Customer represents that it is authorized to engage Owl, will pass on that controller’s instructions, and is responsible to it. Owl’s obligations run only to Customer.

3.2 Owl’s independent purposes. Under the Terms and the Privacy Notice, Owl also uses Customer Content for its own purposes (the “Owl Purposes”): (a) the Training License (Terms Sections 5.3 and 5.4); and (b) creating De-Identified Data and using it as the Terms permit (Terms Section 5.9). For the Owl Purposes, Owl acts as an independent controller (or business), not as Customer’s processor or service provider. Customer instructs and authorizes disclosure of Customer Content, including Customer Personal Data, to Owl for the Owl Purposes. Sections 4, 5.1, and 11 of this DPA do not apply to the Owl Purposes, which are governed by the Terms (including the limits in Terms Section 5.4, its Biometric Data carve-out, and its opt-out) and the Privacy Notice. Owl will not use Biometric Data for the Owl Purposes unless it has first become De-Identified Data.

3.3 Customer’s responsibility. Customer is responsible for its own lawful basis, notices, consents, and opt-outs for disclosing Customer Personal Data to Owl for the Owl Purposes, and for deciding whether that disclosure is a “sale” or “share” under any law that applies to Customer. Owl does not pay Customer for Customer Personal Data as such, and the Business Purposes involve no sale or sharing of it.

3.4 De-Identified Data. Owl will take reasonable measures to ensure that De-Identified Data cannot be associated with an individual or Customer, publicly commits to use it only in de-identified form, will not re-identify it except as the Terms permit, and will bind any recipient to the same commitments.

4. U.S. State-Law Terms

4.1 Restrictions. Customer discloses Customer Personal Data to Owl only for the limited and specified Business Purposes and Owl Purposes. Except for the Owl Purposes, Owl will not: (a) sell or share Customer Personal Data; (b) retain, use, or disclose it for any purpose, including any commercial purpose, other than the Business Purposes or as U.S. State Privacy Laws otherwise permit a service provider, contractor, or processor; (c) retain, use, or disclose it outside the direct business relationship between Owl and Customer; or (d) combine it with Personal Data that Owl receives from or on behalf of another source or collects from its own interactions with an individual, except as U.S. State Privacy Laws permit. Owl certifies that it understands and will comply with these restrictions.

4.2 Compliance and remediation. Owl will comply with the U.S. State Privacy Laws and Biometric Laws that apply to it, provide the level of privacy protection they require, and notify Customer promptly if it can no longer meet its obligations under them. Customer may take reasonable and appropriate steps, through Section 10, to ensure that Owl uses Customer Personal Data consistently with Customer’s obligations, and, on that notice or a reasonable belief of unauthorized use, may direct Owl to take reasonable and appropriate steps to stop and remediate it.

5. Instructions and Customer Responsibilities

5.1 Instructions. Customer’s documented instructions are this DPA, the Terms and any Order, and its use and configuration of the Services. Further instructions must be written and lawful, and Owl may decline those outside the Services. Owl will tell Customer if it believes an instruction violates Data Protection Laws.

5.2 Customer will: (a) comply with the Data Protection Laws that apply to it; (b) have a lawful basis, give every notice, and obtain every consent and release that Terms Sections 5.6 and 13.2 require; (c) not submit Prohibited Data (Terms Section 5.7) or instruct the Services to perform facial recognition or collect Biometric Data (Terms Section 6.1); and (d) on the self-serve Platform, not submit Customer Content in which any individual under 18 is a subject of analysis (incidental appearance is not a breach, but the Services may not be used to identify or analyze that individual). A Customer Agreement may authorize content involving minors only as it provides.

6. Biometric Data

6.1 Posture. The Services do not perform facial recognition, create face or voice templates, or perform speaker identification. Participants are identified from rosters, jersey numbers, position, and Customer-supplied context. Some Biometric Laws define biometric data broadly enough to reach movement or pose data derived from video; where derived data qualifies, Owl treats it under Privacy Notice Section 6 and this Section 6.

6.2 Destruction. Owl will destroy all analysis data derived from a Video (other than models and De-Identified Data, Section 11.3), including any index held by a Subprocessor: (a) when the Video is deleted; (b) when the account or Organization is deleted; and (c) in all events no later than three (3) years after the data was created. Destruction means deletion from active systems and backups on the Section 11 timelines, and from Subprocessors consistent with Owl’s agreements with them. Owl’s written retention schedule is Privacy Notice Section 6.2.

6.3 Safeguards. Owl will not sell, lease, trade, or profit from Biometric Data; will use it solely to provide the Services to Customer (Terms Section 5.4(b)); will disclose it only with the individual’s consent or authorization, to complete a transaction the individual authorizes, or as required by law or valid legal process (Subprocessors process it only as processors on Owl’s behalf under written agreements, which is not a disclosure to a third party); will encrypt it at rest and in transit; and will limit access to personnel with a need to know.

6.4 Consents. Customer is responsible for the notices, releases, and consents that the Biometric Laws and any collective bargaining agreement require (Terms Section 5.6(e)), and Owl may ask for evidence and decline to process until it receives it (Terms Section 6.4). Owl’s obligations under the Biometric Laws are owed directly, not merely derivatively of Customer’s instructions.

7. Security and Security Incidents

7.1 Security. Owl will maintain administrative, technical, and physical safeguards appropriate to the risk, including at least the measures in Annex 2, and may update them if the update does not materially reduce overall protection. Personnel and Subprocessors authorized to process Customer Personal Data are bound by confidentiality duties.

7.2 Incident notice. Owl will notify Customer without undue delay, and in any event within seventy-two (72) hours after Owl confirms a Security Incident (subject to law-enforcement limits), at the account email address. The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of individuals and records affected, likely consequences, and measures taken or proposed, and Owl will supplement it as it learns more. Owl will take reasonable steps to contain and remediate it. Customer decides whether to notify regulators and individuals; Owl will not name Customer in such a notice unless law requires. Notice is not an admission of fault.

8. Subprocessors

8.1 Authorization and Updates. Customer authorizes Owl to engage Subprocessors, including those on the Subprocessor List at owl.ai/subprocessors, which states each one’s role and location. Updates to the Subprocessor List will occur as set forth therein.

8.3 Objection. Customer may object, on reasonable data-protection grounds, by written notice to privacy@owl.ai within thirty (30) days after Owl’s notice under Terms Section 11.2. The parties will discuss the objection in good faith to reach a commercially reasonable resolution; if none is reached within thirty (30) days, Customer’s sole remedy is to stop using the affected feature or terminate the affected Services and receive a refund of prepaid fees for the unused period.

8.4 Flow-down. Owl will engage each Subprocessor under a written agreement providing materially equivalent protection and remains responsible for its performance of Owl’s obligations (Terms Section 11.3).

9. Assistance and Data-Subject Requests

9.1 Requests. If Owl receives a request from an individual about Customer Personal Data, it will promptly notify Customer and refer the individual to Customer, and will not otherwise respond unless law requires or Customer authorizes. Owl will reasonably assist Customer’s responses, including through Platform features for viewing, exporting, and deleting content. Owl handles requests about the Owl Purposes, including training opt-outs, itself, as the Privacy Notice describes.

9.2 Other assistance. Owl will reasonably assist with Customer’s security, breach-notification, impact-assessment, and regulatory-consultation obligations, given the information available to Owl, and may charge reasonable fees, on notice, for assistance beyond Platform features and ordinary support. If Owl receives a legally binding demand for Customer Personal Data, it will notify Customer unless prohibited and disclose only what the demand requires.

10. Audits and Information

10.1 What Owl provides. To demonstrate compliance, Owl will make available on request: (a) security program summaries; (b) any SOC 2 or comparable independent assessment report or summary that Owl then holds and, to the extent Subprocessors permit, theirs, under confidentiality.

10.2 No on-site audits. The Services are self-serve and multi-tenant, and Customer has no right to audit Owl’s facilities or systems on site or to access source code or other customers’ data, except for an inspection that a regulator with authority over Customer, Data Protection Laws, or the Clauses require. That inspection must be on thirty (30) days’ notice, once per twelve months, in business hours, at Customer’s expense, by an independent auditor bound by confidentiality, and limited to Customer Personal Data processing. Information provided under this Section 10 is Owl’s confidential information (Terms Section 14.3).

11. Deletion and Return

11.1 During the term. Customer can delete Videos and, where the Services offer deletion controls, other Customer Content. Owl provides export tools where the Services offer them (for example, clips, reports, and timelines); for other Customer Content and Output, Owl will provide a copy in a commonly used format on written request, within the deletion windows in Section 11. Deleting a Video also deletes data derived from it as Section 6.2 states.

11.2 On termination. Consistent with Terms Sections 12.1 and 12.5, Owl will delete Customer Personal Data from active systems within thirty (30) days, and from backups within ninety (90) days, after the Terms terminate or Customer’s account or Organization is deleted. Before deletion completes, Customer may request an export as Section 11.1 describes.

11.3 Exceptions. As Terms Section 12.4 provides, deletion does not reach trained or improved models, weights, parameters, and training artifacts, or De-Identified Data (Terms Section 5.4(d)); information Owl must retain for law or a legal hold; routine backups until overwritten; or data Subprocessors retain as that Section describes. Owl will keep protecting retained Customer Personal Data under this DPA and use it only for the purpose requiring retention.

12. International Module

12.1 When operative. This Section 12 and Annex 3 are operative only to the extent that the EU General Data Protection Regulation (“GDPR”), the UK GDPR, the Swiss Federal Act on Data Protection (“FADP”), or another law with comparable processor-contract or transfer requirements (together, “International Data Protection Laws”) applies to Owl’s processing of Customer Personal Data. Otherwise they have no effect, and including them is not a representation that Owl offers, markets, or targets the Services in any country.

12.2 Processor terms. Where an International Data Protection Law applies, Owl will: (a) process Customer Personal Data only on Customer’s documented instructions, including as to transfers, unless law requires otherwise (and then inform Customer unless prohibited); (b) ensure that persons authorized to process it are bound by confidentiality; (c) take the security measures that law requires (Section 7 and Annex 2); (d) engage Subprocessors only as Section 8 provides; (e) assist Customer, by appropriate technical and organizational measures, with data-subject requests (Section 9.1); (f) assist with Customer’s obligations on security, breach notification, impact assessments, and prior consultation (Sections 7.2 and 9.2); (g) at Customer’s choice, delete or return Customer Personal Data at the end of the Services (Section 11); and (h) make available the information necessary to demonstrate compliance and allow for and contribute to audits (Section 10).

12.3 Owl Purposes. Where an International Data Protection Law applies to the Owl Purposes, Owl acts as an independent controller, and Customer is responsible for its lawful basis and transparency for the disclosure.

12.4 Transfers. To the extent Customer Personal Data subject to an International Data Protection Law is transferred to Owl in the United States, or onward, and no adequacy decision or other lawful mechanism covers the transfer:

1. (a)EU SCCs. The standard contractual clauses in Commission Implementing Decision (EU) 2021/914 (the “Clauses”) are incorporated by reference: Module Two (controller to processor) where Customer is a controller, and Module Three (processor to processor) where Customer is a processor, with Customer as data exporter and Owl as data importer, completed as Annex 3 states. Module One (controller to controller) applies to disclosures for the Owl Purposes.
2. (b)UK. The International Data Transfer Addendum to the Clauses issued by the UK Information Commissioner (the “UK Addendum”) is incorporated and completed as Annex 3 states.
3. (c)Switzerland. The Clauses apply to transfers subject to the FADP, as Annex 3 amends them.
4. (d)Data Privacy Framework. Owl does not currently participate in or rely on the EU-U.S., UK Extension, or Swiss-U.S. Data Privacy Framework. If Owl later certifies, it will say so at owl.ai/privacy, and the Clauses remain in effect as an alternative mechanism.
5. (e)Assessments; replacement. Owl will provide information reasonably needed for Customer’s transfer impact assessment and give the notices Clause 15 requires. If a mechanism is invalidated or replaced, the parties will cooperate in good faith to put a valid one in place, and Owl may adopt any replacement the competent authority approves, on notice.

12.5 Priority. The Clauses and UK Addendum prevail over the rest of this DPA and the Terms in a conflict; nothing here limits individuals’ rights under them.

13. Liability and General

13.1 Liability. Each party’s liability under this DPA is subject to the exclusions, caps, and indemnity provisions of the Terms (Sections 18 and 19) as they apply to that party, in aggregate with liability under the Terms. Nothing limits liability that cannot be limited by law, or any individual’s rights under the Clauses, including Clause 12.

13.2 Updates. Owl may update this DPA as Terms Section 22 provides and will version-stamp each update. An update that materially reduces protection of Customer Personal Data is a material change under that Section; updates required by law, or to adopt replacement Clauses, take effect on notice.

13.3 Exemptions; disputes. This DPA does not apply to the extent processing is exempt from Data Protection Laws. Governing law and disputes follow Terms Section 21, except where the Clauses or UK Addendum specify otherwise. Contact: privacy@owl.ai.

Annex 1: Processing Details

Annex 2: Security Measures

1. 1.Hosting and physical security. Production data is hosted with our cloud hosting provider in the United States, whose data centers are designed to provide physical and environmental controls and independent certifications. Company laptops are configured with full-disk encryption.
2. 2.Identity and access. Single sign-on; multi-factor authentication for personnel; least-privilege IAM with separate service accounts; unique user IDs; session timeouts; prompt de-provisioning and periodic access reviews.
3. 3.Data access and separation. Role-based access to production data limited to personnel who need it; tenant data logically isolated; model environments and training data restricted.
4. 4.Encryption. AES-256 at rest, including backups, with keys managed through our cloud hosting provider’s key-management service; TLS 1.2 or higher for external transmission.
5. 5.Network and change control. Default-deny firewall rules; segmentation; audit logging of administrative and data-access events; production changes subject to review and testing before release.
6. 6.Availability and vulnerability management. Redundant regions; automated backups with point-in-time recovery, restoration periodically tested; regular infrastructure and dependency scanning.
7. 7.AI handling and governance. Owl-hosted computer-vision models run in its cloud hosting environment on purpose-specific pipelines; some workflows include human review of AI output; agreements with, and account configurations at, third-party AI providers that are set so those providers do not use Customer Content to train their own models, as Terms Section 5.5 describes.

Annex 3: Transfer Details

A. Clauses. Modules: Two and, where Customer is a processor, Three and One for the Owl Purposes. Clause 7: included. Clause 9(a): Option 2, general authorization, with the Terms Section 11.2 notice period. Clause 13 and Annex I.C: the supervisory authority where the exporter is established or, if it is not established in the EU, where its representative is established. Annex I.B: Annex 1. Annex II: Annex 2. Annex III: the Subprocessor List. Clause 8.9: the Section 10 process, with inspections only as Section 10.2 allows.

B. UK Addendum. Tables 1 to 3: as in Part A. Table 4: Importer may end the UK Addendum as its Section 19 provides. The governing law is that of England and Wales, with its courts.

C. Swiss amendments. References to the GDPR include the FADP. The competent authority is the Federal Data Protection and Information Commissioner for transfers subject exclusively to the FADP, and otherwise as in Part A. For those transfers, Clause 17 is Swiss law, Clause 18(b) is the courts of Switzerland, and “Member State” does not exclude Swiss data subjects from suing in Switzerland.