CCPA Service Provider Addendum

Terms used but not defined here have the meanings given in the CCPA/CPRA.

• "Business" means you, the customer organization that is subject to the CCPA/CPRA and that uses Sentsai.
• "Service Provider" means Sentsai Inc., which processes Personal Information on behalf of the Business pursuant to a written contract.
• "Personal Information" has the meaning set forth in Cal. Civ. Code § 1798.140(v): information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.
• "Sell" / "Share" have the meanings given in Cal. Civ. Code §§ 1798.140(ad) and (ah).

Sentsai, as Service Provider, shall:

• (a) Process Personal Information only for the Business Purpose specified in this Addendum and the Terms of Service (providing Microsoft 365 license analysis services), and for no other commercial purpose;
• (b) Not sell or share Personal Information, as those terms are defined in the CCPA/CPRA;
• (c) Not retain, use, or disclose Personal Information for any purpose other than providing the service, including not retaining, using, or disclosing the Personal Information for a commercial purpose other than providing the service;
• (d) Not combine Personal Information received from the Business with Personal Information received from or collected in connection with other sources or clients;
• (e) Not use Personal Information for cross-context behavioral advertising;
• (f) Implement and maintain reasonable security procedures and practices appropriate to the nature of the Personal Information, as required by Cal. Civ. Code § 1798.81.5;
• (g) Notify the Business if Sentsai determines it can no longer meet its obligations under the CCPA/CPRA;
• (h) Grant the Business the right to take reasonable and appropriate steps to ensure Sentsai uses Personal Information in a manner consistent with the Business's obligations under the CCPA/CPRA;
• (i) Allow reasonable audits by the Business or its designated auditor to verify compliance with this Addendum, on the notice, frequency, scope, cost and confidentiality conditions set out in clause 13 of the Data Processing Agreement, which apply to audits under this Addendum.

Sentsai processes Personal Information solely for the following Business Purposes:

• Analyzing Microsoft 365 license assignments, usage patterns, and security configuration to identify potential cost savings and compliance gaps;
• Generating written reports summarizing findings for the Business;
• Maintaining audit logs for security and compliance;
• Fulfilling data subject rights requests on behalf of the Business as required by applicable law.

Sentsai certifies that it understands these restrictions and will comply with them.

The Personal Information processed includes the following CCPA/CPRA categories:

• Identifiers - Employee names, email addresses (user principal names), Microsoft user IDs;
• Internet or network activity - Last sign-in timestamps, Exchange, OneDrive, SharePoint and Teams last-activity dates, mailbox storage usage, and MFA registration status;
• Professional or employment-related information - License assignments, directory role assignments, account status (enabled or disabled), and guest account flag and creation date.

The categories listed above are the complete set of Personal Information Sentsai processes, and none of them falls within the definition of sensitive personal information in Cal. Civ. Code § 1798.140(ae). Sentsai does not receive account passwords or other credentials, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, the contents of mail, email or text messages, genetic or biometric data, health information, or information concerning sex life or sexual orientation.

The Business is responsible for receiving and responding to consumer (employee) rights requests under the CCPA/CPRA. Sentsai will assist the Business to the extent technically feasible:

• Right to Know / Access - Sentsai provides a data export endpoint (GET /gdpr/export) containing all Personal Information held for the Business;
• Right to Delete - Sentsai provides a deletion endpoint (DELETE /gdpr/erase) to remove all Personal Information;
• Right to Correct - Sentsai holds a point-in-time copy of directory data retrieved from the Microsoft Graph API at each scan; it does not hold live data. Corrections are made in the Business's own Microsoft 365 tenant. Once corrected there, the Business can run a new scan, which produces a current snapshot. Earlier snapshots are deleted at the end of the configured retention period, on a tenant-wide erasure, or, for a single individual, on written request to privacy@sentsai.com as described in clause 9 of the Data Processing Agreement;
• Right to Opt Out of Sale/Sharing - Not applicable. Sentsai does not sell or share Personal Information.

If a consumer submits a rights request directly to Sentsai, Sentsai will forward it to the Business without undue delay and will not respond to the consumer on the Business's behalf without authorization.

Business obligations. The Business is responsible for providing its employees, contractors and other consumers with the notice at collection required by Cal. Civ. Code § 1798.100(a) before their Personal Information is processed by Sentsai, for verifying the identity of a consumer making a request, and for deciding how to respond. Sentsai's assistance works as follows: the export endpoint returns the Personal Information held for the whole tenant, and the Business locates the records for the individual concerned; the deletion endpoint deletes the Personal Information for the whole tenant; and deletion for a single individual is handled by emailing privacy@sentsai.com with the user's UPN or Microsoft object ID, which Sentsai completes within 30 days by deleting the scan records that contain that individual, removing the findings, the report and the PDF together, as set out in clause 9 of the Data Processing Agreement. Where the Business asks for assistance that goes beyond these tools, clause 6 of the Data Processing Agreement (additional instructions, assistance and costs) applies.

Sentsai uses the following sub-processors that may process Personal Information. Each is engaged under a written contract that imposes comparable privacy obligations and requires the sub-processor to remain liable to Sentsai for the acts and omissions of its own sub-processors:

Sentsai retains Personal Information for the retention period configured by the Business - 90 days by default, configurable between 30 and 365 days - after which it is automatically deleted. On termination of the agreement, or on request, all Personal Information is deleted within 30 days. Three exceptions, disclosed for accuracy. First, payment records: Stripe, our payment processor, retains its own ledger under its own legal obligations and outside our control (we delete the Stripe customer record and any saved payment method, but we cannot erase that ledger), and we separately keep a de-identified transaction record of our own - amount, date, pricing tier, payment reference and refund status - as a financial record, as described in Section 6 of the Privacy Policy. Second, entries in our immutable audit trail are retained as a record that an action occurred. Their IP address and user-agent fields are erased, leaving an action name, a timestamp and internal identifiers that do not identify a person. Third, where a sub-processor's own deletion cycle is longer than 30 days, the copy that sub-processor holds is deleted within that cycle, which we will state on request (clause 11 of the Data Processing Agreement). Separately, copies in the automated backups of our managed database expire in the ordinary course within 14 days and are used only for disaster recovery.

Sentsai implements reasonable security measures including: encryption in transit for internet-facing traffic (TLS 1.2+), field-level encryption at rest, tenant-level data isolation, access logging, and retention-based automatic deletion. In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Information, Sentsai shall notify the Business without undue delay and in any event within 72 hours of becoming aware, as set out in clause 10 of the Data Processing Agreement.

To the extent there is any conflict between this Addendum and the Terms of Service or DPA with respect to CCPA/CPRA obligations, this Addendum shall control solely with respect to such CCPA/CPRA obligations.

This Addendum allocates compliance responsibilities; it does not change either party's liability. Sentsai's liability under or in connection with this Addendum is subject to Section 10 of the Terms of Service and clause 14 of the Data Processing Agreement, and the cap in those provisions is a single shared amount, not an additional one.