Oninit® Legal Center — Data Processing Addendum

Scope

This addendum applies when Oninit processes personal data on behalf of customers.

Roles

• Customer: Data Controller
• Oninit: Data Processor

Security Measures

Oninit maintains reasonable administrative, technical, and organizational safeguards.

Data Deletion

Customer data may be deleted upon request or following account termination, subject to retention requirements. Following termination, Customer Content will be deleted or returned within a commercially reasonable period, typically not exceeding ninety (90) days, except where retention is required by law.

Subprocessors

Oninit engages subprocessors to assist in providing the Services. A current list is available on request to privacy@oninit.com. Customers will be notified of material additions to the subprocessor list with a reasonable opportunity to object on documented data-protection grounds.

Breach Notification

Oninit will notify the Customer without undue delay after becoming aware of a confirmed personal-data breach affecting the Customer’s data, and in any event in accordance with applicable law. Notification will include the categories of data affected, the approximate number of records, likely consequences, and measures taken or proposed in response.

Audit Rights

Oninit will make available information reasonably necessary to demonstrate compliance with this DPA, including responses to reasonable security questionnaires and copies of relevant third-party audit reports or certifications where available. On-site audits, where permitted, will be conducted at the Customer’s expense, on reasonable advance notice, during normal business hours, and subject to confidentiality obligations.

International Transfers

Where Oninit processes personal data across jurisdictions, transfers will be carried out using lawful transfer mechanisms appropriate to the jurisdictions involved.