Attune Data Processing Addendum

Last Updated: September 25, 2026

This Data Processing Addendum (“DPA”) forms part of the agreement between Clozd, Inc., as provider of Attune (“Attune”), and the customer using the Services (“Customer”), whether the Attune Terms of Service or another written agreement governing Customer’s use of the Services (the “Agreement”).

This DPA applies when Attune processes Customer Personal Data on behalf of Customer in connection with the Services.

1. Definitions

For purposes of this DPA:

“Customer Personal Data” means any Personal Data processed by Attune on behalf of Customer in connection with the Services.

“Data Protection Laws” means all privacy, data protection, and data security laws applicable to the processing of Customer Personal Data under the Agreement, including, where applicable, the GDPR, UK GDPR, Swiss data protection law, the California Consumer Privacy Act as amended by the California Privacy Rights Act, and other applicable U.S. state privacy laws.

“GDPR” means Regulation (EU) 2016/679.

“Personal Data” means personal data, personal information, or other information relating to an identified or identifiable individual or household, as defined by applicable Data Protection Laws.

“Personal Data Breach” means a breach of security that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.

“Processing” and “process” have the meanings given under applicable Data Protection Laws.

“Subprocessor” means a third party engaged by Attune to process Customer Personal Data on Customer’s behalf in connection with the Services.

“UK GDPR” means the GDPR as incorporated into the laws of the United Kingdom.

“Controller,” “Processor,” “Data Subject,” and similar terms have the meanings given under applicable Data Protection Laws.

Capitalized terms not defined in this DPA have the meanings given in the Agreement.

2. Roles and Scope of Processing

As between the parties, Customer is a Controller or Processor of Customer Personal Data, as applicable, and Attune acts as a Processor or Subprocessor on Customer’s behalf.

Each party will comply with the obligations applicable to it under Data Protection Laws.

Where Customer acts as a Processor on behalf of another Controller, Customer represents that it is authorized to engage Attune as a Subprocessor and to provide Attune with the instructions contemplated by the Agreement and this DPA.

The subject matter, nature, purpose, duration, categories of Data Subjects, and categories of Customer Personal Data processed under this DPA are described in Appendix 1.

3. Processing of Customer Personal Data

Attune will:

(a) process Customer Personal Data only on Customer’s documented instructions, including as necessary to provide, operate, secure, support, and maintain the Services and otherwise perform the Agreement;

(b) inform Customer if Attune reasonably believes an instruction violates applicable Data Protection Laws, unless prohibited by law from doing so;

(c) ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations;

(d) implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data, as further described in Appendix 2;

(e) taking into account the nature of the processing and information available to Attune, provide reasonable assistance to Customer with Customer’s obligations under Data Protection Laws relating to Data Subject requests, data protection impact assessments, and consultations with supervisory authorities;

(f) if Attune receives a request directly from a Data Subject concerning Customer Personal Data, direct the Data Subject to Customer or otherwise notify Customer, unless prohibited by applicable law; and

(g) delete or return Customer Personal Data following termination or expiration of the Services as described in Section 9.

Attune may charge reasonable fees for assistance under subsection (e) that requires material effort beyond functionality or assistance ordinarily included with the Services, to the extent permitted by applicable law.

4. Customer Responsibilities

Customer is responsible for ensuring that its collection and processing of Customer Personal Data complies with applicable Data Protection Laws.

Customer is responsible for:

(a) having all necessary rights, permissions, and lawful bases to provide Customer Personal Data to Attune for processing;

(b) providing notices and obtaining consents or other authorizations required by applicable Data Protection Laws;

(d) determining whether the collection or processing of sensitive or special-category Personal Data is appropriate and lawful for Customer’s particular use of the Services.

5. Artificial Intelligence

Attune will not use Customer Personal Data to train or fine-tune general-purpose artificial intelligence models.

Attune will require providers of general-purpose artificial intelligence models that process Customer Personal Data on Attune’s behalf not to use that data to train or fine-tune their models.

Attune will not use Customer Personal Data to train or fine-tune any artificial intelligence or machine-learning model without Customer’s express consent and in accordance with applicable Data Protection Laws.

6. Subprocessors

Customer provides Attune with general authorization to engage Subprocessors to process Customer Personal Data in connection with the Services.

Attune maintains a current list of Subprocessors atwww.tryattune.ai/subprocessors.

Attune will:

(a) enter into written agreements with Subprocessors imposing data protection obligations that provide substantially the same level of protection for Customer Personal Data as the obligations applicable to Attune under this DPA, as required by applicable Data Protection Laws;

(b) remain responsible for the performance of its Subprocessors to the extent required by applicable Data Protection Laws; and

(c) provide at least thirty (30) days’ advance notice before a new Subprocessor begins processing Customer Personal Data.

Attune will give that notice by email to the account administrators designated in Customer’s Attune account, or by another reasonable means. Customer is responsible for keeping its administrator contact details current.

Customer may object to a new Subprocessor on reasonable data-protection grounds within thirty (30) days after the date of the applicable notice. Attune and Customer will work in good faith to address the objection.

If the parties cannot reasonably resolve the objection, either party may terminate the affected Services in accordance with the Agreement.

7. Personal Data Breaches

Attune will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

Attune will provide Customer with information reasonably available to Attune regarding:

(a) the nature of the Personal Data Breach;

(b) the categories and approximate number of affected Data Subjects and records, where reasonably available;

(d) measures taken or proposed to address and mitigate the Personal Data Breach.

Where complete information is not available at the time of initial notification, Attune may provide information in phases as it becomes available.

Attune will reasonably cooperate with Customer as necessary for Customer to comply with its obligations under applicable Data Protection Laws.

Attune’s notification of a Personal Data Breach does not constitute an admission of fault or liability.

8. Compliance Information and Audits

Attune will make available information reasonably necessary to demonstrate compliance with this DPA, which may include relevant independent audit reports, certifications, security documentation, questionnaires, or similar compliance materials.

Customer will first use such information to assess Attune’s compliance.

To the extent required by applicable Data Protection Laws and the available information is insufficient to demonstrate Attune’s compliance, Customer may request an audit of Attune’s processing of Customer Personal Data.

Any such audit will:

(a) be limited to matters relevant to Attune’s obligations under this DPA;

(b) be conducted on reasonable advance notice and during normal business hours;

(d) avoid unreasonable interference with Attune’s business operations or the security or confidentiality of information relating to other customers.

Customer will bear its reasonable costs associated with an audit and may be responsible for Attune’s reasonable costs of supporting an audit that requires material effort, except to the extent an audit identifies material noncompliance by Attune.

9. Return and Deletion

Upon termination or expiration of the Services, Attune will delete or return Customer Personal Data in accordance with Customer’s instructions and the Agreement, unless applicable law requires retention.

Customer Personal Data retained in backups or disaster-recovery systems will remain protected in accordance with this DPA and will be deleted in accordance with Attune’s ordinary backup and retention cycles.

Where Attune is required by applicable law to retain Customer Personal Data, Attune will continue to protect that data under this DPA and will process it only to the extent required by applicable law.

10. U.S. State Privacy Laws

To the extent Customer Personal Data is subject to applicable U.S. state privacy laws, Attune will act as a processor, service provider, contractor, or equivalent role, as applicable.

Attune will process Customer Personal Data only for the purposes specified in the Agreement and Customer’s documented instructions and as otherwise permitted by applicable Data Protection Laws.

Except as permitted by applicable Data Protection Laws, Attune will not:

(a) sell Customer Personal Data;

(b) share Customer Personal Data for cross-context behavioral advertising or use Customer Personal Data for targeted advertising;

(d) combine Customer Personal Data with Personal Data received from or on behalf of another person or collected through Attune’s independent interactions with an individual, except as permitted by applicable Data Protection Laws.

Attune will notify Customer if Attune determines that it can no longer meet its obligations under applicable U.S. state privacy laws and will cooperate with Customer regarding reasonable steps required by applicable law to stop and remediate unauthorized processing.

11. International Transfers

Customer authorizes Attune and its Subprocessors to process Customer Personal Data in the United States and other countries in which Attune or its Subprocessors operate, subject to the requirements of applicable Data Protection Laws.

11.1 European Economic Area

Where Customer Personal Data subject to the GDPR is transferred to Attune in a country that does not benefit from an applicable adequacy decision and a transfer mechanism is required, the Standard Contractual Clauses adopted by the European Commission pursuant to Implementing Decision (EU) 2021/914 (“EU SCCs”) are incorporated into this DPA by reference.

For purposes of the EU SCCs:

(a) where Customer is a Controller and Attune is a Processor, Module 2 applies;

(b) where Customer is a Processor and Attune is a Subprocessor, Module 3 applies;

(d) Customer grants Attune general written authorization to engage Subprocessors in accordance with Section 6 of this DPA;

(e) the information in Appendix 1 constitutes the information required by Annex I of the EU SCCs;

(f) the measures described in Appendix 2 constitute the information required by Annex II of the EU SCCs;

(g) Attune’s Subprocessor List constitutes the information required by Annex III of the EU SCCs;

(h) the governing law for Clause 17 will be the law of Ireland; and

(i) the courts of Ireland will have jurisdiction for purposes of Clause 18.

11.2 United Kingdom

Where Customer Personal Data subject to the UK GDPR is transferred to Attune and an international-transfer mechanism is required, the EU SCCs as incorporated above will apply together with the then-current International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (“UK Addendum”).

For purposes of the UK Addendum: (a) the information required for Table 1 is provided by the Agreement, this DPA, and Appendix 1; (b) the EU SCCs incorporated under Section 11.1 constitute the Approved EU SCCs identified in Table 2; (c) Appendix 1 and Appendix 2, together with Attune’s Subprocessor List, provide the information required for Table 3; and (d) either party may terminate the UK Addendum as permitted by Section 19 of the UK Addendum.

11.3 Switzerland

Where Customer Personal Data subject to Swiss data protection law is transferred to Attune and an international-transfer mechanism is required, the EU SCCs will apply with modifications necessary for them to operate under applicable Swiss data protection law, including interpreting references to the GDPR, European Union, supervisory authorities, governing law, and courts as necessary to give effect to Swiss law.

11.4 Priority

If the EU SCCs or UK Addendum conflict with this DPA, the EU SCCs or UK Addendum, as applicable, will control to the extent of the conflict.

12. Relationship to the Agreement

Except as modified by this DPA, the Agreement remains unchanged and in full force and effect.

If there is a conflict between this DPA and the Agreement regarding the processing of Customer Personal Data, this DPA controls.

All liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability contained in the Agreement, except to the extent applicable Data Protection Laws or the EU SCCs prohibit such limitation.

13. Updates to this DPA

Attune may update this DPA from time to time to reflect changes in applicable law, regulatory requirements, the Services, or Attune’s data processing practices.

Attune will provide reasonable notice of material changes that materially reduce Customer’s data-protection rights during a then-current paid subscription term.

Unless required by applicable law or agreed with Customer, Attune will not apply a material reduction in Customer’s contractual data-protection rights retroactively.

Appendix 1 Details of Processing

A. Parties to the Transfer

Data Exporter: Customer. The data exporter’s name, address, and contact details are those associated with Customer’s Attune account or otherwise provided to Attune in connection with the Agreement. The data exporter’s activities relevant to the transfer are Customer’s use of the Services as described in the Agreement.

Data Importer: Clozd, Inc., as provider of Attune, 1300 W Traverse Parkway, Suite 400, Lehi, UT 84043 USA; privacy@tryattune.ai. The data importer provides the Services described in the Agreement.

Where Customer acts as a Controller, Customer is the Controller and Attune is the Processor. Where Customer acts as a Processor, Customer is the Processor and Attune is the Subprocessor.

Competent Supervisory Authority: The competent supervisory authority will be determined in accordance with Clause 13 of the EU SCCs.

B. Subject Matter

Processing of Customer Personal Data in connection with Attune’s provision of the Services under the Agreement.

C. Duration

For the duration of the Agreement and thereafter for the limited period necessary to return or delete Customer Personal Data in accordance with this DPA, subject to applicable legal-retention requirements and ordinary backup-retention cycles.

D. Nature and Purpose

Attune processes Customer Personal Data as necessary to provide, operate, secure, maintain, support, and deliver the Services in accordance with the Agreement and Customer’s documented instructions.

Processing activities may include collection, recording, organization, storage, retrieval, consultation, analysis, transcription, transmission, disclosure to authorized Subprocessors, deletion, and other processing necessary to provide the Services.

E. Categories of Data Subjects

Customer Personal Data may relate to:

research participants and respondents;
Customer’s Authorized Users; and
other individuals whose Personal Data is submitted to or processed through the Services at Customer’s direction.

F. Categories of Customer Personal Data

Depending on Customer’s use of the Services, Customer Personal Data may include:

contact and professional information;
account or organizational information;
audio and video recordings;
transcripts;
interview, survey, screening, and research responses;
opinions, feedback, and other information voluntarily provided by research participants;
research materials and information supplied by Customer;
technical, device, and usage information; and
other Personal Data submitted to or collected through the Services at Customer’s direction.

G. Sensitive or Special-Category Personal Data

Customer Personal Data may include sensitive or special-category Personal Data depending on the nature of Customer’s research and information provided by research participants.

Customer determines and controls the extent to which such data is collected and is responsible for ensuring that its collection and processing complies with applicable Data Protection Laws, including obtaining any required consent or authorization.

H. Frequency of Processing

Continuous or as initiated by Customer through its use of the Services.

I. Subprocessors

Attune’s current Subprocessors are identified on the Attune Subprocessor List atwww.tryattune.ai/subprocessors.

Appendix 2 Technical and Organizational Measures

Attune maintains appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

Attune’s security program includes, as appropriate to the nature and risk of the processing:

identity and access management controls;
authentication and authorization controls;
encryption of data in transit and at rest;
system and network security controls;
vulnerability identification and remediation processes;
logging, monitoring, and security-event detection;
incident response procedures;
data backup, disaster recovery, and business continuity measures;
secure software-development and change-management practices;
personnel security and confidentiality obligations;
security awareness and training;
vendor and Subprocessor risk-management processes; and
policies and procedures governing information security and data protection.

Attune is built and operated within Clozd’s SOC 2 Type II environment and under Clozd’s information security program. Attune is being added to the scope of Clozd’s next SOC 2 audit and is not yet covered by a SOC 2 Type II report of its own. See trust.clozd.com.

Attune may update its technical and organizational measures from time to time, provided that such updates do not materially reduce the overall level of protection for Customer Personal Data during the applicable term.

Additional information regarding Attune’s security practices is available at trust.clozd.com.