All Raise Independent Controller Data Processing Addendum

You or the entity you represent (“you” or “your”) are entering (or have entered) into an agreement with Crunchbase, Inc. and All Raise Inc. (“we”, “us” and “our”) and together with you, the “Parties,” each, a “Party”, for the provision of certain Services. The Parties agree that the Services may include certain personal information such as names, employment or educational history, social media identifiers, and other information. This Data Processing Addendum (“Addendum”) shall apply to all personal information, personal data, and other personal identifiers that may be included in the Services, however defined by applicable law (“Personal Data”). All terms used but not defined in this Addendum shall have the meanings set forth in (a) the Terms, or (b) applicable privacy law(s).

I. Certain Definitions

“Applicable Privacy Law” means the CCPA, GDPR, and any other data protection, privacy, data breach, or similar or related laws applicable to a Party’s use or other processing of Personal Data.

“CCPA” means the California Consumer Privacy Act of 2018, as amended.

“GDPR” means EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016.

“Included Data” means any Personal Data included in the Services.

II. Obligations

For purposes of the GDPR, the Parties acknowledge that they are each a separate and independent controller of any Included Data. The Parties do not and will not process Included Data as joint controllers. Each Party shall comply with the obligations that apply to it as a controller under the GDPR, and each Party shall be individually and separately responsible for its own compliance.

You shall process Included Data only for the purposes set forth in the Terms or as otherwise agreed in writing by the Parties, provided such processing strictly complies with all applicable privacy laws and your obligations under this Addendum. You shall maintain a publicly-accessible privacy policy on your mobile applications and websites that satisfies all applicable transparency and notice requirements set forth in any Applicable Privacy Law with respect to your processing of Included Data. Notwithstanding anything to the contrary in the Terms, you shall immediately delete or destroy all Included Data in your possession upon the expiration or earlier termination of your use of the Service or, if sooner, upon the conclusion of your purpose for processing such Included Data.

In the event that you receive a request from an individual relating to the processing of such individual’s data by us, you will (i) promptly notify us of such request, (ii) direct the individual to us in order to enable us to respond directly to the request, and (iii) reasonably cooperate with us in responding to such request. Without limiting the foregoing, you agree that you will promptly (and in any event within five (5) business days) notify us of any request pursuant to Article 16 (Right to rectification), Article 17 (Right to erasure), or Article 18 (Right to restriction of processing) of the GDPR that relates in any way to the Service.

You acknowledge that, from time to time, Included Data may be updated, modified, augmented, or removed from the Service. You shall regularly check the Service and ensure that you are using the most up-to-date version of the Included Data. Without limiting the foregoing, you agree to promptly delete and, if applicable, cease all sales of, any Included Data for which we notify you that we have received a deletion or opt-out request, and will indemnify us for any claims relating to your breach of the foregoing.

Each Party shall implement appropriate technical and organisational measures to protect the Included Data. You are not required to certify to the EU-US and Swiss-US Privacy Shield Framework and Principles issued by the U.S. Department of Commerce, both available at https://www.privacyshield.gov/EU-US-Framework (the “Privacy Shield Principles”); however, you shall use at least the same level of privacy protection as is required by the Privacy Shield Principes and shall promptly notify us of any inability to provide such protection.

In the event that you suffer any actual or suspected data breach (including any unauthorized access or use) with respect to the Included Data, you shall notify us without undue delay and the Parties shall reasonably cooperate with each other in taking such measures as may be necessary to notify affected individuals, comply with each Party’s obligations under Applicable Privacy Law, and mitigate or remedy the effects of such data breach.

Where required, any transfer of Included Data made subject to this Addendum to any countries which do not ensure an adequate level of data protection shall be undertaken by you and us through the European Commission Decision C(2004) 5271 Standard Contractual Clauses for Controllers to Controllers (“Model Clauses”), the terms of which are herein incorporated by reference or, if available, an alternative compliance mechanism authorized pursuant to Applicable Privacy Laws or subsequent guidance from EEA or United Kingdom regulators, as applicable. For purposes of such transfer, we shall be deemed the “Data Importer” and you shall be deemed the “Data Exporter.” The optional clauses of the Model Clauses are expressly not included. Each party’s agreement to this Addendum shall be considered a signature to the Model Clauses. If required by the laws or regulatory procedures of any jurisdiction, the parties shall execute or re-execute the Model Clauses as separate documents.

If and to the extent you transfer any Included Data to any third party, you shall first enter into contractual arrangements with such third party obligating such third party to process the Included Data in accordance with the requirements of Applicable Privacy Law. You shall comply with Applicable Privacy Law in connection with your transfer (including any sale) of Included Data to third parties.