Data Processing Addendum

1 Definitions

• AI Agents – Software-based autonomous or semi-autonomous systems, workflows, automations, models, or intelligent agents operating within the Platform that may perform tasks such as drafting, reviewing, extracting, analyzing, negotiating, summarizing, classifying, routing, or recommending actions in relation to agreements or workflows.
• Authorized Users – Employees, consultants, representatives, agents, or personnel authorized by Customer to access or use the Platform.
• Customer – The legal entity subscribing to or using the Platform.
• Customer Data – All agreements, templates, playbooks, workflows, prompts, files, data, communications, approvals, comments, metadata, instructions, and information uploaded, generated, stored, or processed by or on behalf of Customer through the Platform.
• Platform – The DonePact platform including websites, mobile applications, APIs, browser extensions, Microsoft Word Add-ins, integrations, workflow modules, AI capabilities, and associated software and services.
• Services – The subscription-based agreement operations, workflow, automation, AI assistance, collaboration, document management, e-signature, analytics, integration, and related services made available by DonePact.
• Subscription Term – The period during which Customer is authorized to access and use the Services.
• Workflow Engine – The orchestration and automation capabilities within the Platform enabling request, approval, review, negotiation, execution, renewal, obligation management, or related agreement lifecycle workflows.

2 Platform Overview

DonePact is an AI-native agreement and workflow platform designed to help organizations collaborate before, during, and after execution of agreements.

The Platform may include:

• workflow orchestration
• approval routing
• contract drafting and negotiation tools
• AI-assisted redlining and summarization
• metadata extraction
• search and analytics
• integrations with enterprise systems
• AI Agents
• collaboration tools
• e-signature and execution workflows
• obligation and renewal tracking.

Certain functionalities may be powered by machine learning systems, third-party AI providers, rules engines, automations, or AI Agents.

3 Account Registration & Security

3.1 Eligibility

By using the Services, Customer represents and warrants that:

• it is a recognized business entity
• it has authority to enter into these Terms
• its Authorized Users are authorized to use the Platform.

3.2 Account Responsibility

Customer is responsible for:

• maintaining confidentiality of credentials
• all activities conducted through Customer accounts
• managing user access permissions
• ensuring Authorized Users comply with these Terms.

DonePact shall not be liable for unauthorized access arising from Customer's failure to maintain security controls.

3.3 Administrative Control

Customer administrators may configure workflows, permissions, AI settings, approval hierarchies, integrations, and automation rules. Customer is solely responsible for such configurations.

4 Subscriptions, Fees & Payments

4.1 Subscription Activation

Services become active only upon:

• execution or acceptance of applicable order forms (if any)
• realization of subscription fees in DonePact's designated bank account and
• activation by DonePact.

4.2 Fees

Customer shall pay all applicable subscription fees, usage fees, implementation fees, integration fees, AI usage fees, and taxes.

4.3 Taxes

All fees are exclusive of GST and other applicable taxes.

4.4 No Refunds

Except where required by applicable law or expressly agreed in writing, fees are non-refundable.

4.5 Suspension

DonePact may suspend access for non-payment, security risks, unlawful usage, or material breach.

5 License & Acceptable Use

5.1 License Grant

Subject to compliance with these Terms, DonePact grants Customer a limited, non-exclusive, non-transferable, revocable right to access and use the Services during the Subscription Term for internal business purposes.

5.2 Restrictions

Customer shall not:

• reverse engineer or attempt to extract source code
• use the Platform to develop competing products
• sublicense or resell the Services unless expressly authorized
• bypass security mechanisms
• use the Platform for unlawful, infringing, fraudulent, abusive, or deceptive activities
• upload malware or malicious code
• use AI features in violation of applicable law or third-party rights.

5.3 AI Usage Restrictions

Customer shall not:

• intentionally use AI features to generate unlawful, discriminatory, defamatory, infringing, or harmful content
• represent AI-generated outputs as professional legal advice
• use the Platform to make fully automated legally binding decisions without appropriate human oversight where required by applicable law.

6 AI Agents, Automation & Human Oversight

6.1 AI-Assisted Services

The Platform may provide AI-assisted capabilities including:

• drafting suggestions
• clause recommendations
• summarization
• extraction of metadata
• workflow recommendations
• negotiation assistance
• semantic search
• analytics
• AI Agent-based automations.

6.2 Human-in-the-Loop Requirement

Unless expressly stated otherwise in writing, AI Agents operate as assistive systems and not as independent decision-makers. Customer acknowledges and agrees that AI outputs may contain inaccuracies, omissions, hallucinations, inconsistencies, or incorrect interpretations human review and validation are mandatory before execution or reliance Customer remains solely responsible for legal, commercial, operational, and compliance decisions.

6.3 AI Agents Acting on Instructions

AI Agents may perform tasks based on Customer prompts, configured workflows, playbooks, approval rules, prior instructions, integrations, or training configurations. Customer is solely responsible for reviewing and validating such configurations.

6.4 No Guarantee of Accuracy

DonePact does not warrant that AI outputs will be accurate, complete, or legally compliant AI Agents will correctly interpret intent or automations will operate uninterrupted or error-free.

6.5 Third-Party AI Providers

Certain AI features may utilize third-party AI or cloud infrastructure providers. Customer authorizes DonePact to process Customer Data through such providers solely for providing the Services.

7 Customer Data & Data Rights

7.1 Ownership

Customer retains ownership of Customer Data.

7.2 Limited License to DonePact

Customer grants DonePact a limited right to host, process, transmit, analyze, index, store, reproduce, and use Customer Data solely to provide the Services to maintain security to support workflows and integrations to improve platform performance and as otherwise permitted under these Terms.

7.3 Tenant Isolation

DonePact employs commercially reasonable tenant isolation measures designed to segregate Customer Data from other customers.

7.4 AI Training Restrictions

Unless expressly authorized by Customer in writing, DonePact shall not use Customer contract text or confidential agreements to train generalized foundational AI models for unrelated third parties Customer-specific confidential data shall remain logically isolated.

7.5 Aggregated & Anonymized Data

DonePact may use aggregated, anonymized, statistical, or de-identified metadata for analytics, benchmarking, platform optimization, product development, and AI improvement.

7.6 Customer Responsibility

Customer represents and warrants that it has all necessary rights, permissions, consents, and lawful basis to upload and process Customer Data through the Platform.

8 Confidentiality

Each party agrees to protect Confidential Information using reasonable care use Confidential Information solely for purposes related to the Services and restrict disclosure to personnel and contractors with a need to know.

Confidential Information does not include information that is publicly available without breach was lawfully known prior to disclosure is independently developed or is lawfully obtained from third parties.