Data Processing Addendum

1. Purpose & Scope

This Data Processing Addendum ("DPA") applies when CODEXIS FLOW processes personal data on behalf of clients in connection with our services. This DPA supplements and forms part of the service agreement between the parties.

2. Definitions

• Controller: The party that determines the purposes and means of processing personal data (typically the Client).

• Processor: The party that processes personal data on behalf of the Controller (typically CODEXIS FLOW Tech Ltd).

• Personal Data: Any information relating to an identified or identifiable natural person.

• Processing: Any operation performed on personal data, including collection, storage, use, and deletion.

3. Roles & Responsibilities

In most service engagements, the Client acts as the Controller and CODEXIS FLOW acts as the Processor. The Controller determines what data is processed and for what purposes; the Processor follows the Controller's documented instructions.

4. Processor Obligations

• Process personal data only on documented instructions from the Controller.

• Ensure all personnel are bound by appropriate confidentiality obligations.

• Implement appropriate technical and organizational security measures.

• Assist the Controller with data subject requests and compliance obligations.

• Delete or return all personal data upon termination as directed.

• Provide information necessary to demonstrate compliance with obligations.

5. Security Measures

• Encryption: Data encrypted in transit (TLS 1.2+) and at rest (AES-256).

• Access Controls: Role-based access with multi-factor authentication.

• Monitoring: Continuous security monitoring and audit logging.

• Incident Response: Documented procedures for security incident handling.

• Training: Regular security awareness training for all personnel.

6. Sub-Processors

We may engage sub-processors for specific processing activities with appropriate safeguards. A list of current sub-processors is available upon request. We ensure all sub-processors are bound by equivalent data protection obligations.

7. Data Breach Notification

• We will notify the Controller without undue delay upon becoming aware of a personal data breach.

• Notification will include the nature and scope of the breach.

• We will provide categories and approximate number of affected individuals.

• We will describe likely consequences and remedial measures taken or proposed.

8. International Transfers & Contact

Where data is transferred outside the Controller's jurisdiction, we implement appropriate safeguards as required by applicable law, including standard contractual clauses where appropriate. For DPA inquiries, contact us at privacy@codexisflow.com.