Data Processing Addendum

Version 1.0 — November 14, 2026

1. Scope, parties and acceptance

This Data Processing Addendum ("Addendum") supplements the agreement governing the Customer’s use of Manufact’s hosted services (the "Agreement"), including the Terms of Service at https://manufact.com/terms and any applicable order form. The provider is Manufact, Inc., a Delaware corporation ("Manufact"). The Customer is the legal person identified in the Agreement and its account records. Each party’s address and authorized contacts are those recorded in the Agreement or supplied through the account. Manufact’s privacy and service contact is [email protected]; its security contact is [email protected].

This Addendum applies only to personal data Manufact processes on the Customer’s behalf in providing the Service ("Customer Personal Data"). The Customer acts as controller, or as a processor appointing Manufact as a subprocessor. Manufact’s separate processing as controller of account, billing, business-contact and marketing information is described in its Privacy Policy at https://manufact.com/privacy.

This Addendum becomes part of the Agreement through valid electronic acceptance of the Agreement incorporating it, or separate written or electronic acceptance of this Addendum by authorized representatives. For existing Customers, applicable contractual notice and acceptance requirements must be met. Publication alone does not retroactively amend an existing Agreement or replace a previously executed customer DPA.

Version 1.0 is dated November 14, 2026. The effective date for each Customer is the date of valid acceptance, subject to any applicable notice period. The applicable version and acceptance are identified by the publication and acceptance records. This Addendum continues while Manufact processes Customer Personal Data, including retained copies following termination.

2. Data protection terms

“Applicable Data Protection Laws” means laws governing personal-data processing that apply to the processing under the Agreement, including, where applicable, the EU GDPR, UK GDPR, Swiss Federal Act on Data Protection, and California Consumer Privacy Act as amended. Personal data, processing, controller, processor, personal data breach, and supervisory authority have their meanings under those laws. A “Subprocessor” is a provider engaged by Manufact to process Customer Personal Data on the Customer’s behalf. A “Security Incident” is a confirmed personal data breach involving Customer Personal Data; unsuccessful attempts without a compromise of personal data are not themselves Security Incidents.

“EU SCCs” means the unmodified standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/914. “UK Addendum” means the ICO’s International Data Transfer Addendum to those clauses, version B1.0 in force from 21 March 2022, including mandatory revisions required by law. “Restricted Transfer” means an international transfer requiring safeguards under Applicable Data Protection Laws.

3. Documented instructions and customer responsibilities

Manufact will process Customer Personal Data only to provide, secure, maintain and support the Service in accordance with the Agreement, this Addendum, the Customer’s configuration and use of the Service, and additional lawful written instructions acknowledged by Manufact, unless applicable law requires otherwise. Where permitted, Manufact will inform the Customer of that legal requirement before processing. Manufact will immediately inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws, and notify the Customer if it cannot follow an instruction.

The Customer determines the purposes of processing and the data it submits, supplies required notices and establishes a lawful basis, obtains authorizations from its controllers where relevant, and configures access, payload capture, integrations and retention appropriately. These responsibilities do not remove Manufact’s own processor obligations.

The processing particulars are in Annex I. The Customer must not submit special-category data, criminal-offence data, protected health information requiring a HIPAA business associate agreement, or other specially regulated data unless the parties expressly agree in writing to the necessary scope and safeguards. No HIPAA business associate agreement or authorization to process PHI is created by this Addendum.

Where the CCPA applies and Manufact acts as a service provider or contractor, Manufact will process Customer Personal Data only for the specified business purposes in this Addendum and the Agreement; will not sell or share it, retain, use or disclose it outside those purposes or the direct business relationship, or combine it with other personal information except as permitted by the CCPA; and will provide the required level of privacy protection. Manufact will notify the Customer if it can no longer meet those obligations, permit reasonable and appropriate steps to verify compliant use and to stop and remediate unauthorized use, and bind relevant Subprocessors to the required restrictions. Manufact certifies that it understands and will comply with these restrictions.

4. Confidentiality and security

Manufact will ensure personnel authorized to process Customer Personal Data are subject to confidentiality obligations and access it only as necessary for their duties. Manufact will implement and maintain technical and organizational measures appropriate to the risks, taking account of the nature, scope, context and purposes of processing, as described in Annex II.

The Trust Center at https://trust.manufact.com/ provides current security information and available evidence. Access-controlled reports may be provided subject to confidentiality and access conditions. Trust Center updates do not authorize a material reduction in the protection required by this Addendum or Applicable Data Protection Laws, and no certification, audit report or service level is promised merely because it is requested.

Manufact may update the implementation of its security measures to reflect technical developments, provided the changes do not materially reduce the overall protection of Customer Personal Data or conflict with applicable law or transfer clauses. General marketing statements and Trust Center descriptions do not create a customer-specific warranty, certification commitment or service level beyond an express commitment in the Agreement or this Addendum.

5. Subprocessors and changes

The Customer generally authorizes Manufact to engage the Subprocessors identified at https://trust.manufact.com/?tab=subprocessors. That register forms Annex III and identifies the providers, their processing roles and locations. The register may change as the Service and its suppliers change, subject to the requirements below.

Manufact will provide written notice to the Customer’s designated privacy contact or account administrator at least 30 calendar days before a new or replacement Subprocessor begins processing Customer Personal Data. Updating the register alone does not replace the required notice. The notice will provide the information needed to assess the change, including the Subprocessor’s identity, location and processing tasks.

The Customer may object within 30 calendar days after notice on reasonable data-protection grounds. The parties will work in good faith to resolve the objection before the proposed Subprocessor begins processing Customer Personal Data. If they cannot resolve the objection, the Customer may terminate the affected Service as its sole contractual remedy for that objection. No refund of previously paid fees will be due, and committed fees under the Agreement remain payable. Nothing in this paragraph restricts termination, suspension, refund or other rights that cannot lawfully be limited under Applicable Data Protection Laws or applicable EU SCCs or the UK Addendum.

Manufact will impose written obligations on Subprocessors that provide the data-protection safeguards required by this Addendum and Applicable Data Protection Laws, including Article 28(3) where applicable. Manufact remains responsible for its Subprocessors’ processing obligations, subject to Section 10 and mandatory rights. On request, it will make relevant contractual protections available, with confidential information appropriately redacted where permitted.

6. Security Incident response

After becoming aware of a Security Incident, Manufact will notify the Customer without undue delay and no later than 72 hours after awareness, or sooner where required by Applicable Data Protection Laws. Manufact will provide available information about the nature of the incident, affected data and people, likely consequences and mitigation, and a contact for further information. Information may be provided in phases as it becomes available.

Manufact will take reasonable steps to investigate, contain and remediate the Security Incident and cooperate with the Customer in meeting applicable obligations. Notification is not an admission of fault or liability. The Customer remains responsible for its own regulatory and data-subject notifications, without limiting Manufact’s independent legal duties.

7. Assistance, audits and evidence

Taking account of the nature of processing and information available to it, Manufact will provide reasonable assistance with data-subject rights, data protection impact assessments, transfer impact assessments and required consultations with supervisory authorities. It will forward relevant requests to the Customer and not independently respond on the Customer’s behalf except as instructed or legally required. The Customer will use available self-service functions where appropriate.

Manufact will make available information necessary to demonstrate compliance and allow for and contribute to legally required audits, including inspections. Current confidential reports, questionnaires and remote evidence will be used first where sufficient to demonstrate compliance. A customer-requested inspection must be limited to processing relevant to the Customer, protect other customers’ data, security, confidentiality and service availability, and use reasonable advance notice, normal business hours and an appropriately qualified auditor subject to reasonable confidentiality obligations. A direct competitor may not act as auditor where an appropriate independent alternative is available. This paragraph does not restrict access required by applicable law, applicable transfer clauses or a competent authority.

Routine customer-requested audits are limited to once in 12 months unless a Security Incident, reasonable evidence of noncompliance, applicable law, the EU SCCs, or a competent authority requires otherwise. Customer-requested penetration tests or other intrusive testing require advance written agreement on scope and safeguards, without limiting mandatory audit rights. Necessary audit and assistance rights are not conditional on an Enterprise subscription.

The Customer bears its own auditor’s costs. To the extent legally permitted, Manufact may charge reasonable, documented costs for non-routine assistance or inspections beyond the ordinary evidence supplied through the Service or Trust Center, after providing advance information about those costs. Manufact will not charge for work necessary to remedy its own breach. A fee discussion, disagreement or unpaid charge will not delay or prevent legally required cooperation, incident notification, a data subject’s rights or a competent authority’s access.

8. Return, deletion and retention

During the Service, Manufact will support deletion consistent with available functionality and lawful Customer instructions. Following termination, the Customer may request return or deletion during the 30-day export/request period in the Agreement; Manufact will then return or delete Customer Personal Data as instructed, including copies, unless law requires retention.

Where immediate deletion from backups is not technically practicable, retained copies remain protected, are isolated from ordinary use and deleted according to the documented backup cycle. Where law requires retention, Manufact will restrict further processing to that purpose and continue the applicable protections. At the Customer’s request, Manufact will certify deletion as required by applicable transfer clauses.

Retention periods depend on the contracted features, the Customer’s configuration and the applicable service documentation. Manufact will retain Customer Personal Data only for the period necessary to provide the contracted Service and complete the return or deletion process in this Section, unless applicable law requires further retention. Retained backup copies remain subject to the protections and restrictions above. The Customer remains responsible for copies held in systems it independently controls.

9. International transfers

The Customer authorizes processing in the United States and other locations identified for relevant Subprocessors, subject to Applicable Data Protection Laws. Manufact will implement required safeguards for Restricted Transfers. This Addendum makes no representation that Manufact is certified under the EU–US Data Privacy Framework.

Where a transfer to Manufact requires the EU SCCs and is within their scope, they are incorporated without modification and deemed executed through valid acceptance of this Addendum. Module Two applies where the Customer is controller; Module Three applies where the Customer is processor. For each applicable module: Clause 7’s docking option is not used; Clause 9 uses general written authorization with the 30-day notice in Section 5; Clause 11’s optional independent dispute-resolution language is not used; the competent supervisory authority is determined under Clause 13 and Annex I(C).

For EU SCC Clauses 17 and 18, the governing law is the law of Ireland and disputes will be resolved by the courts of Ireland, subject to the rights and mandatory provisions of the applicable EU SCCs. The Agreement’s ordinary commercial governing law remains unchanged. Nothing removes a data subject’s rights to bring proceedings in another court as provided by the SCCs.

For Restricted Transfers governed by UK law, the UK Addendum applies to the SCCs: Table 1 is completed by the parties and contacts in Annex I(A) and their acceptance records; Table 2 refers to the applicable SCC modules and selections above; Table 3 is completed by Annexes I–III; for Table 4 neither party may end the Addendum solely under Section 19. Its Mandatory Clauses remain unchanged. Required updates to the approved clauses will be implemented in accordance with law.

For transfers subject to Swiss law, references in the EU SCCs to the GDPR include the Swiss Federal Act on Data Protection as applicable, the Swiss FDPIC is competent to the extent Swiss law applies, and protections extend to relevant Swiss data subjects. The SCCs are not interpreted to exclude proceedings in Switzerland where required by Swiss law.

The applicable SCCs and UK Addendum take precedence over inconsistent commercial terms. If an applicable transfer falls outside these clauses or they do not supply a lawful mechanism, the parties must establish appropriate safeguards before relying on the transfer.

10. One commercial liability cap

To the maximum extent permitted by applicable law, Manufact’s total aggregate liability to the Customer arising out of or relating to the Agreement and this Addendum combined, whether in contract, tort (including negligence), breach of statutory duty or otherwise, will not exceed the greater of US$300 and the subscription and usage fees actually paid by the Customer to Manufact under the Agreement during the six months immediately preceding the first event giving rise to a claim. Connected events and related claims are treated as a single event for that measurement. The cap is one aggregate limit for the Agreement and this Addendum, not a separate limit per document, claim, incident, renewal, claimant or legal theory.

The Agreement’s enforceable exclusions of indirect and consequential damages apply to claims under this Addendum. Amounts paid in satisfaction of a claim under either document count toward the same aggregate cap, and the Customer may not recover twice for the same loss. Neither an allegation under multiple legal theories nor parallel claims under both documents increases the cap. These rules do not restrict mandatory compensation or contribution rights.

This Addendum creates no additional voluntary indemnity, defense obligation, reimbursement guarantee, higher cap, service credit or obligation to pay the Customer’s fines or penalties. Any such additional commitment must be expressly agreed in a separate agreement signed by authorized representatives. Customer fee-payment obligations remain governed by the Agreement.

The limitations and exclusions apply only to the extent legally permitted. Nothing in the Agreement or this Addendum limits or excludes liability under applicable EU SCCs or the UK Addendum contrary to those clauses, restricts data subjects’ rights or the powers of competent authorities, or limits or excludes liability that cannot lawfully be limited or excluded. Applicable transfer clauses prevail in a conflict. This exception operates only to the extent the relevant limitation or exclusion is prohibited; it does not voluntarily make every claim concerning privacy, confidentiality, security or personal data uncapped.

The Customer will take reasonable steps to mitigate losses and remains responsible for its lawful instructions, submitted data, access permissions, credentials, configurations and independently selected third-party integrations. Manufact is not contractually responsible to the extent a loss results from those matters without a breach of Manufact’s own obligations. This allocation does not excuse Manufact’s own failures, its responsibility for Subprocessors, or liability imposed by applicable law or transfer clauses.

11. Standard terms and Enterprise requests

This standard Addendum is offered for the Service, including Pro, where Manufact processes Customer Personal Data on the Customer’s behalf. Individually negotiated data-protection terms, additional contractual indemnities, higher negotiated caps, SLAs, dedicated infrastructure and customer-specific security commitments may be considered under a separate Enterprise agreement based on the Customer’s requirements.

An Enterprise subscription by itself does not change any cap or promise additional protection: the parties must expressly agree those terms. Standard privacy-law rights, processor duties, and mandatory audit and transfer rights are not contingent on Enterprise pricing. A previously executed customer DPA remains governed by its own amendment and precedence rules.

12. Order of precedence and updates

For personal-data processing, applicable EU SCCs and the UK Addendum control first, this Addendum second, and the Agreement third. A separately executed DPA or negotiated Enterprise amendment controls to the extent expressly agreed and legally permitted. The Privacy Policy governs Manufact’s controller processing and does not expand instructions for Customer Personal Data processed on the Customer’s behalf.

Material revisions are subject to the Agreement’s applicable notice and acceptance requirements, including its 30-day notice provision where applicable. Changes to a Trust Center page or to the Addendum’s URL do not silently amend an existing signed DPA or impose a new cap retroactively.

This is an adapted Manufact document, not Common Paper’s unmodified standard or an endorsement by Common Paper. The source is Common Paper Data Processing Agreement Standard Terms v1.1, used under the Creative Commons Attribution 4.0 license. The acceptance mechanism, plan treatment, liability allocation, subprocessor procedure and annexes have been adapted.

Except for rights expressly granted by applicable transfer clauses or required by law, this Addendum confers no third-party beneficiary rights. If a commercial limitation is held unenforceable, the remaining lawful limitations continue to apply to the maximum extent permitted by law. No severability or construction provision permits modification of the mandatory EU SCCs or UK Addendum, or reduces their priority.

Annex I — Processing details and parties

A. Parties. Data exporter: the Customer identified in the Agreement, account and acceptance records, with its business address and designated privacy/account contact recorded there, acting as controller or processor as applicable. Its activity is using or providing MCP-enabled products, services and workflows. Data importer: Manufact, Inc., Delaware, at the business address stated in the applicable Agreement and account documentation; [email protected] (privacy/service), [email protected] (security), acting as processor or subprocessor. Its activity is providing the contracted hosting, connection/gateway, testing, publishing-readiness, observability and related support services. Acceptance records supply the authorized representatives and dates; neither party’s identity is determined by an arbitrary account display name.

B. Data subjects. The Customer’s users, employees, contractors, representatives and other individuals whose data the Customer lawfully includes in a configured MCP workflow, tool call, test, submitted content or support request.

B. Data categories. As actually submitted or generated for the contracted Service: identifiers and contact/account details, organization and role details, user or session identifiers, authentication-related metadata and access credentials where necessary for configured connections, IP addresses and user-agent/client data, timestamps and diagnostics, tool names, request/response and resource content where capture is enabled, prompts, test/evaluation content and results, and relevant support communications. This list describes possible categories, not a representation that every payload is collected by default or that public blockchain data is always personal data.

B. Subject matter, nature and purpose. Hosting and executing customer deployments; routing configured MCP calls; connecting authorized clients; authenticating connections; producing customer-requested tests, readiness reports and submission assets; storing and analyzing configured logs and diagnostics; maintaining security, reliability, and support. Operations include collection, transmission, storage, retrieval, analysis, disclosure to authorized recipients and deletion solely as needed for those purposes.

B. Frequency and duration. Transfers occur on a continuing basis as the Customer uses and configures the Service. Processing continues for the Agreement term and the return/deletion period; lawful retention and protected backup copies remain subject to Section 8. Operational logs follow the applicable feature-specific retention settings. Account information processed by Manufact as controller follows the Privacy Policy. Special-category and other specially regulated data are restricted by Section 3; any approved exception requires documented safeguards.

C. Supervisory authority. For EU SCC transfers the competent authority is selected under Clause 13, based on the exporter’s establishment, representative or relevant data subjects, as applicable. For UK and Swiss transfers the ICO and FDPIC apply to the extent required by the applicable law. The Customer must supply the information necessary to identify the competent authority; Manufact’s Delaware incorporation does not select an EU authority.

Annex II — Minimum security measures

Manufact will implement and maintain the following technical and organizational measures for the applicable Service, taking account of the risks and other considerations in Section 4. Current security descriptions and available evidence are maintained at https://trust.manufact.com/. These measures do not create additional customer-specific service levels or guarantees beyond the express terms of the Agreement and this Addendum.

Access and confidentiality: role-appropriate access, least-privilege authorization, individual authentication for administrative access, controls for granting and revoking access, confidentiality obligations and appropriate personnel awareness.

Transmission and storage: encryption for Customer Personal Data in transit and at rest as appropriate to the relevant systems, protected credential and key handling, and measures preventing unauthorized disclosure across customers and environments.

Resilience and integrity: risk-appropriate backup and restoration procedures, operational monitoring, vulnerability management, change controls, and periodic assessment of the effectiveness of relevant security measures.

Accountability and incident response: relevant access/security logs, documented incident escalation and response, and processes supporting the notification and cooperation obligations in this Addendum.

Data lifecycle and vendors: data minimization, configured retention and deletion, restricted use of retained backups, disposal controls, and assessment and contractual oversight of relevant Subprocessors. No general EEA-only hosting, 24-hour breach-notification promise, HIPAA coverage or customer-specific recovery SLA is implied.

Annex III — Approved Subprocessors

The current register is https://trust.manufact.com/?tab=subprocessors. The register is incorporated for the identities, roles and processing locations of relevant Subprocessors, subject to Section 5’s written notice and objection rights. It may be updated without replacing this page, but an update cannot override mandatory safeguards or the agreed change process.

The register must be accessible to the Customer and contain the information necessary for the relevant transfer annexes. Where access-controlled information is needed, contact [email protected]. The parties will retain the applicable register and security evidence with the accepted version where required to demonstrate compliance.

Adapted from Common Paper DPA Standard Terms v1.1 under CC BY 4.0. Modified for Manufact; no endorsement is implied.