Data Processing Addendum

1.1 "Account Data" means Personal Data that Lightbringer processes for its own purposes in connection with its relationship with Customer, including names and contact details of Authorised Users and billing contacts in account or billing systems; purchase and invoice records, payment and Credit-pack transactions, paid-plan administration and approved additional-work orders; and data it collects for identity verification, account management and legal compliance. The same information, where it forms part of Customer Content, is Customer Personal Data.

1.2 "Customer Personal Data" means Personal Data contained in Customer Content or otherwise processed by Lightbringer on Customer's behalf in providing the Services, as described in Exhibit A; it excludes Account Data and Usage Data, being data Lightbringer processes for its own purposes under Section 10.

1.3 "Data Protection Laws" means all laws and regulations applicable to a party relating to the processing of Personal Data, including: (i) Regulation (EU) 2016/679 ("EU GDPR"); (ii) the EU GDPR as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 ("UK GDPR") (together with the EU GDPR, the "GDPR"); (iii) the UK Data Protection Act 2018; (iv) the Swedish Data Protection Act (lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning); and (v) the Swiss Federal Act on Data Protection of 25 September 2020 ("FADP"); in each case as amended or replaced from time to time, and in each case only to the extent applicable to the relevant party. The terms "Data Subject", "Personal Data", "Personal Data Breach", "processing", "processor", "controller" and "supervisory authority" have the meanings set forth in the GDPR.

1.4 "EU SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as completed under Sections 6.3 and 6.8.

1.5 "List" means the section headed "Sub-processors of Customer Content" of Lightbringer's sub-processor page at https://lightbringer.com/privacy/subprocessors, as updated in accordance with Section 4.

1.6 "Restricted Transfer" means (i) a transfer of Personal Data subject to the EU GDPR to a country outside the EEA not covered by a Commission adequacy decision; (ii) a transfer of Personal Data subject to the UK GDPR to a country outside the UK not covered by UK adequacy regulations ("ex-UK Transfer"); or (iii) a transfer of Personal Data subject to the FADP to a country not recognised by the Swiss Federal Council as adequate.

1.7 "Standard Contractual Clauses" means the EU SCCs and, where the UK Addendum applies, the EU SCCs as amended by the UK Addendum.

1.8 "Sub-Processor" means a third party, including an Affiliate of Lightbringer, engaged by Lightbringer to process Customer Personal Data on Lightbringer's behalf. The Attorney Partner and any Connected AI Agent are not Sub-Processors.

1.9 "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under s.119A Data Protection Act 2018, in the form set out in Exhibit D.

1.10 "Usage Data" means service usage data collected and processed by Lightbringer in connection with the Services, including activity logs, telemetry and non-content metering information used to calculate and record eligible AI Credit deductions or included platform usage (such as action type, model or provider, quantities or tokens, timestamps and applicable Credit amounts), and data used to secure, maintain and optimise the Services and to investigate and prevent misuse. Usage Data does not include Customer Content, including prompts, invention descriptions or document payloads; where a log does contain such content, that content remains Customer Personal Data to the extent it contains Personal Data.

2.1 Roles. Unless expressly agreed otherwise in writing, Customer is the controller of Customer Personal Data and Lightbringer is its processor. If Customer processes the relevant data on behalf of another controller, Customer must disclose that role and ensure the required written instructions and Article 28 processor-to-sub-processor terms are in place before the affected processing begins. Each party shall comply with its own obligations under Data Protection Laws. Customer is responsible for the accuracy and lawfulness of its instructions and the Customer Personal Data supplied.

2.2 Instructions. Lightbringer shall process Customer Personal Data only on Customer's documented instructions, including with regard to transfers to a third country, unless required to do so by Union or Member State law (or, for UK Personal Data, UK law) to which Lightbringer is subject; in that case Lightbringer shall inform Customer of the legal requirement before processing, unless that law prohibits such information on important grounds of public interest. Customer's instructions are: (i) this DPA; (ii) the Agreement; (iii) Customer's and its Authorised Users' configuration and use of the Services; and (iv) any further written instructions agreed between the parties. For the avoidance of doubt, Lightbringer does not use Customer Content to train, fine-tune or otherwise develop any machine-learning model, ensures that any Sub-Processor providing AI model inference is contractually prohibited from doing so, and any right under the Agreement to use Customer information to improve the Services does not extend to such use.

2.3 Details of processing. The subject matter, duration, nature and purpose of the processing, the categories of Customer Personal Data and the categories of Data Subjects are set out in Exhibit A.

2.4 Term of processing, deletion and return.

(a) Lightbringer processes Customer Personal Data for as long as Customer's account exists. Whether and when an account continues, is downgraded or is closed is governed by the Agreement. Expiry or cancellation of a paid plan, a professional-service allowance or a prepaid Credit lot does not by itself close Customer's account or change the deletion period in this Section.

(b) Customer may at any time request deletion of Customer Content, in whole or in part, or export it in a commonly used electronic format. Lightbringer shall carry out a deletion request within thirty (30) days, including from backups within ninety (90) days, and confirm in writing on request.

(c) On closure of the account, whether by Customer or by Lightbringer in accordance with the Agreement, the provision of the Services ends. Customer may export Customer Content for thirty (30) days after closure. Lightbringer shall delete Customer Personal Data, including from backups, within ninety (90) days of closure, unless retention is required by applicable law, in which case Lightbringer shall isolate and protect the retained data and process it only for that purpose. Where the EU SCCs apply, the certification under Clauses 8.1(d) and 8.5 is provided on request.

2.5 Attorney Partner.

(a) Separate provider. Attorney Partner Services, including filing and prosecution with patent offices and instructing foreign associates and local counsel, are provided by the Attorney Partner under the LSA, not by Lightbringer. The Attorney Partner is a separate legal entity which determines the purposes and means of its professional-services records and acts as an independent controller of Personal Data processed for those services and its professional obligations. It is not a Sub-Processor, and Lightbringer is not responsible for its processing as controller.

(b) Instruction. Where Customer engages or instructs the Attorney Partner, including by instructing a filing, through the Services, Customer instructs Lightbringer to make the relevant Customer Content, including any Customer Personal Data it contains, available to the Attorney Partner. The Attorney Partner's access through the Services is limited to the matters on which Customer has instructed it.

(c) Attorney Partner records. The Attorney Partner uses the Services to keep its professional records. For that processing, Lightbringer acts as the Attorney Partner's processor under a written data-processing agreement between them satisfying applicable Data Protection Laws, not under this DPA. Deletion under Section 2.4 does not extend to those records, which the Attorney Partner retains as required by its professional obligations.

(d) Personnel. Qualified professionals engaged to perform Attorney Partner Services may also be employed by Lightbringer AB. When acting for the Attorney Partner on an instructed matter, such personnel shall perform professional work under the Attorney Partner's professional oversight, confidentiality and applicable professional duties, pursuant to documented arrangements between the entities. Lightbringer AB remains responsible for its own platform and processing obligations. Access to Customer Content in either capacity shall be role-appropriate, authorised and logged.

2.6 US state privacy laws. To the extent any US state privacy law applies to Customer Personal Data, Lightbringer acts as a service provider or processor, shall not sell or share such data, shall not retain, use or disclose it other than to perform the Services, and shall notify Customer if it can no longer meet these obligations.

3.1 Lightbringer shall ensure that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and process the data only as instructed. Lightbringer may disclose Customer Personal Data other than Customer Content to its professional advisers and auditors bound by confidentiality no less protective than the Agreement, to the extent strictly necessary for the performance of this DPA. Any other disclosure to a third party is subject to Section 2.5, Section 4, Section 6.6 or Section 7.

3.2 Customer Content that is not Personal Data. The last sentence of Section 2.2, and Sections 2.4, 2.5, 3.1, 5, 6.1, 6.6 and 7 and Exhibit C, apply to all Customer Content, whether or not it contains Personal Data, and the Agreement relies on them for that purpose. For Customer Content that is not Personal Data, references in those provisions to Customer Personal Data are read as references to Customer Content.

4.1 General authorisation. Customer grants Lightbringer general written authorisation to engage the Sub-Processors on the List and to engage additional or replacement Sub-Processors in accordance with this Section 4.

4.2 The List. The List identifies each Sub-Processor, the location in which it processes Customer Personal Data, the processing it performs and the categories of data it processes, and shows the date on which the List was last updated. Lightbringer informs Customer of any intended addition or replacement of a Sub-Processor by adding it to the List at least fourteen (14) days before the new Sub-Processor processes Customer Personal Data; the date shown on the List as last updated is the date of that notice. Customer may subscribe on the List page to receive notification of changes by email. In addition, Lightbringer sends notice of the change to Customer's account owner by email or by a durable in-product notification, and keeps a record of its dispatch. The objection period in Section 4.3 runs from the date shown on the List.

4.3 Objection. Customer may object in writing to a new Sub-Processor within fourteen (14) days of the date shown on the List as last updated, on reasonable grounds relating to data protection. The parties shall discuss the objection in good faith. Until the objection is resolved or the affected Services end, Lightbringer shall either not use the new Sub-Processor to process Customer Personal Data or suspend the affected Services for Customer. If Lightbringer cannot offer a reasonable alternative within thirty (30) days of the objection, Customer may terminate the affected Services or close its account in accordance with the Agreement, and receive any refund of prepaid fees for which the Agreement provides.

4.4 No objection. If Customer does not object within the period in Section 4.3, the new Sub-Processor is deemed authorised.

4.5 Flow-down and liability. Lightbringer shall impose on each Sub-Processor, by written contract, the same data protection obligations as are set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. A Sub-Processor's technical and organisational measures may differ from those in Exhibit C provided they ensure a level of protection appropriate to the risk of the processing entrusted to it. Lightbringer may satisfy this Section through the Sub-Processor's own standard data processing terms where those terms impose obligations of at least the same substance. Where a Sub-Processor fails to fulfil its data protection obligations, Lightbringer remains fully liable to Customer for the performance of the Sub-Processor's obligations.

4.6 Affiliates. Any Affiliate of Lightbringer that processes Customer Personal Data on Lightbringer's behalf is a Sub-Processor and shall appear on the List. Lightbringer USA Inc. is not deemed a Sub-Processor solely because it is an Affiliate; it shall be listed before it actually processes Customer Personal Data for Lightbringer AB. An Attorney Partner acting as an independent controller is governed by Section 2.5, not by this Section 4.

4.7 Personnel. Personnel engaged by Lightbringer, whether employed directly or through a third-party employment or payroll provider, act under Lightbringer's authority and instructions and are subject to Lightbringer's confidentiality obligations, training and access controls. A provider without access to Customer Personal Data is not a Sub-Processor; a provider given such access shall be engaged as a Sub-Processor under this Section 4.

4.8 SCC consents. Where the EU SCCs apply, the authorisations in this Section 4 constitute Customer's prior general written authorisation under Clause 9(a) Option 2, and copies of Sub-Processor agreements provided under Clause 9(c) may have commercial terms redacted.

5.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks to the rights and freedoms of natural persons, Lightbringer shall implement and maintain the technical and organisational measures described in Exhibit C. Lightbringer may update those measures provided the overall level of protection of Customer Personal Data is not materially reduced.

6.1 Processing location. Lightbringer is established in Sweden. Customer Personal Data is stored and processed on infrastructure located in the European Union, at the locations set out on the List, except where the List states otherwise, in which case any transfer is subject to Section 6.2. A transfer of Customer Personal Data from Customer to Lightbringer from within the EEA, from the UK (the EEA being covered by UK adequacy regulations), or from Switzerland, is not a Restricted Transfer.

6.2 Onward transfers by Lightbringer. Lightbringer shall not make a Restricted Transfer of Customer Personal Data to a Sub-Processor unless (i) the recipient is covered by an adequacy decision or the EU–US Data Privacy Framework (or its UK or Swiss extensions) for the relevant data; or (ii) Lightbringer has entered into the EU SCCs (Module Three) and, where applicable, the UK Addendum with the Sub-Processor, supported by a documented transfer impact assessment and any supplementary measures it identifies; or (iii) the transfer is made under another appropriate safeguard under Article 46 GDPR (or its UK or Swiss equivalent). Customer authorises such transfers on those conditions. Lightbringer will identify the mechanism relied on for any Sub-Processor on request. If a mechanism relied on ceases to be valid, Lightbringer shall put in place an alternative lawful mechanism or suspend the relevant transfer, and the parties shall cooperate to review whether additional measures are necessary.

6.3 Restricted Transfers to Lightbringer. Where an actual transfer to Lightbringer is a Restricted Transfer requiring the EU SCCs, the SCCs are incorporated and completed as stated below. Module Two applies when Customer is a controller and Lightbringer a processor. Where Customer is itself a processor, the parties must agree the appropriate Module Three terms, parties and Annexes before the relevant transfer occurs; this clause does not represent that every Customer is necessarily a controller. Transfers that do not require an Article 46 safeguard are not made subject to SCCs solely by use of the Services.

• (a) Module Two (controller to processor) applies.
• (b) Clause 7 (docking clause) does not apply.
• (c) Clause 9(a): Option 2 applies, with the notice period and mechanism in Section 4.2.
• (d) Clause 11(a): the optional language does not apply.
• (e) Clause 13: the option applicable to the data exporter's establishment applies; where the exporter is not established in the EEA, the supervisory authority of the Member State in which its Art. 27 representative is established applies.
• (f) Clause 17: Option 1, the law of Sweden. Clause 18(b): the courts of Sweden.
• (g) Annex I and Annex III are set out in Exhibit B; Annex II is set out in Exhibit C.
• (h) The parties are deemed to have signed the EU SCCs, including the Annexes, by entering into this DPA.

6.4 United Kingdom. To the extent a transfer to Lightbringer constitutes an ex-UK Transfer, the EU SCCs as completed under Section 6.3 apply as amended by the UK Addendum in Exhibit D.

6.5 Switzerland. To the extent a transfer to Lightbringer is a Restricted Transfer under the FADP, the EU SCCs apply with these adaptations: references to the GDPR are read as references to the FADP; the Federal Data Protection and Information Commissioner is the competent authority under Clause 13; Data Subjects in Switzerland may exercise their rights under Clause 18(c) in Switzerland; and the EU SCCs protect the data of legal persons to the extent the FADP so requires.

6.6 Government access requests. Lightbringer maintains a record of legally binding requests from public authorities for access to Customer Personal Data ("Government Requests") and will make the current position available to Customer on request. If Lightbringer receives a Government Request concerning Customer Personal Data it shall, unless legally prohibited, promptly notify Customer and, where the request concerns Customer Content held for the purposes of Attorney Partner Services, the Attorney Partner, before any disclosure, so that any claim of legal privilege may be asserted; provide only the minimum information required, challenge the request where there are reasonable grounds to consider it unlawful, and seek to redirect the authority to Customer. Where notice is legally prohibited, Lightbringer shall use reasonable efforts to obtain a waiver of the prohibition and shall give notice as soon as the prohibition lapses. To the extent permitted by law, Lightbringer shall not disclose Customer Content in respect of which a claim of legal privilege has been notified to it until that claim has been determined. Lightbringer shall not voluntarily disclose Customer Personal Data to any public authority.

6.7 Access by personnel outside the EEA. Lightbringer personnel located outside the EEA may access Customer Personal Data to provide and support the Services only under the measures in Exhibit C and, where such access constitutes a Restricted Transfer, subject to appropriate safeguards under Chapter V of the GDPR.

6.8 Restricted Transfers to Customer. To the extent that Lightbringer's return or disclosure of Customer Personal Data to Customer, including by making it available to Customer through the Services, constitutes a Restricted Transfer under the EU GDPR, the EU SCCs are incorporated into this DPA with Module Four (processor to controller) applying, Lightbringer as data exporter and Customer as data importer, completed as set out in Section 6.3(b), (d), (g) and (h). Clause 17: the law of Sweden. Clause 18: the courts of Sweden.

7.1 Customer may enable access to the Services through a Connected AI Agent. Where Customer or an Authorised User does so, Customer instructs Lightbringer to disclose Customer Content, including Customer Personal Data, to that Connected AI Agent within the scope of the access granted.

7.2 A Connected AI Agent is a recipient designated by Customer and is not a Sub-Processor. Lightbringer does not control, and is not responsible for, the processing, retention or onward disclosure of Customer Personal Data by the provider of a Connected AI Agent once disclosed at Customer's instruction. Customer is responsible for its own lawful basis, any transfer mechanism, and any notification obligations towards that provider.

7.3 Customer controls whether a Connected AI Agent is enabled and may disable it at any time.

8.1 Lightbringer shall, to the extent permitted by law, promptly notify Customer if it receives a request from a Data Subject to exercise rights under Data Protection Laws in respect of Customer Personal Data, shall not respond other than to direct the Data Subject to Customer, and shall assist Customer as set out in Section 8.2.

8.2 Taking into account the nature of the processing, Lightbringer shall assist Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling Customer's obligation to respond. Customer shall first use the self-service functionality of the Services. Lightbringer may charge reasonable costs for assistance beyond what the Services provide where the need arises from Customer's own instructions or configuration.

9.1 DPIA and consultation. Lightbringer shall provide reasonable assistance to Customer in ensuring compliance with Article 32 GDPR, and with data protection impact assessments and prior consultation with supervisory authorities under Articles 35 and 36 GDPR, taking into account the nature of the processing and the information available to it.

9.2 Records. Lightbringer shall maintain the records required by Article 30(2) GDPR and records sufficient to demonstrate compliance with this DPA, for as long as required by applicable law.

9.3 Information. Lightbringer shall make available to Customer all information necessary to demonstrate its compliance with Article 28 GDPR. This may include relevant descriptions of controls, records under Section 9.2, appropriate independent assurance summaries or test reports where available, subject to reasonable confidentiality and security protections. Where the available materials are insufficient, the audit right in Section 9.4 applies. This provision does not represent that any specific certification or independent report currently exists.

9.4 Audit. Where the information provided under Section 9.3 is insufficient for Customer to verify Lightbringer's compliance with this DPA, Lightbringer shall allow for and contribute to audits, including inspections, conducted by Customer or an independent auditor appointed by Customer and bound by confidentiality. Customer shall ordinarily provide at least thirty (30) days' written notice of an audit. Audits shall normally be limited to once in any twelve-month period and conducted during normal business hours, with reasonable measures to minimise disruption and protect the security and confidentiality of other customers' information. These limitations shall not prevent additional audits or shorter notice where reasonably necessary following a Personal Data Breach, where there are indications of non-compliance, where required by a supervisory authority, or where necessary to exercise mandatory rights under Data Protection Laws. The parties shall reasonably coordinate the scope, timing and duration of audits. Each party shall bear its own audit costs, unless otherwise agreed in writing. Nothing in this Section limits Customer's mandatory audit rights under applicable Data Protection Laws or, where applicable, Clause 8.9 of the EU SCCs.

9.5 Infringing instructions. Lightbringer shall immediately inform Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the affected processing until the instruction is confirmed or withdrawn.

9.6 Personal Data Breach. Lightbringer shall notify Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification shall, so far as known, describe the nature of the breach including the categories and approximate numbers of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information may be provided in phases without undue further delay.

9.7 Assistance. Lightbringer shall provide reasonable cooperation and assistance to enable Customer to meet its obligations under Articles 33 and 34 GDPR, and shall take reasonable steps to contain and remediate the breach to the extent within its control.

9.8 No admission; cost allocation. Notification of or response to a Personal Data Breach is not an acknowledgement of fault or liability. Where a Personal Data Breach results from the acts or omissions of Customer, Lightbringer remains obliged to notify under Section 9.6 and Customer bears the reasonable costs of Lightbringer's assistance under Section 9.7.

10.1 Lightbringer is an independent controller of Usage Data and, insofar as it determines the purposes and means of processing, Account Data described in the Privacy Policy. It uses those data for account administration, billing, security, fraud prevention, service operation and lawful improvement, subject to applicable law. Any prompts, invention text or other Customer Content appearing in logs remains Customer Personal Data when processed on Customer's behalf. A separately engaged Attorney Partner is an independent controller of its professional matter processing under Section 2.5 and its own privacy notice; that professional activity is not brought within Lightbringer's controller role by this Section.

10.2 Information about Lightbringer's processing as controller is set out in its privacy policy at https://lightbringer.com/about/legal/privacy-policy. The privacy policy is a notice and does not form part of this DPA.

11.1 Precedence. In the event of conflict: (1) the Standard Contractual Clauses, where they apply; (2) any provision of a Master Service Agreement or Order Form that expressly states that it amends this DPA, as regards that Customer; (3) this DPA; (4) the Agreement.

11.2 Execution. This DPA is entered into (a) by Customer's execution of a Master Service Agreement or order form, or (b) by Customer's acceptance of the Terms of Service, which incorporate this DPA, including by first use of the Services where the Terms of Service so provide. No separate signature is required. The person accepting on Customer's behalf represents that they are authorised to do so.

11.3 Data Subject rights and forum. Nothing in the Agreement, including any provision requiring disputes to be referred to arbitration, limits or excludes the rights of a Data Subject as third-party beneficiary under the Standard Contractual Clauses, including the right under Clause 18 of the EU SCCs to bring proceedings before the courts of a Member State. Any dispute between the parties arising from the Standard Contractual Clauses shall be resolved by the courts of Sweden (Section 6.3(f)). To that extent the Standard Contractual Clauses prevail over the dispute resolution provisions of the Agreement.

11.4 Liability. Subject to this Section 11.4, each party's liability under this DPA is subject to the exclusions and limitations in the Agreement. Nothing in the Agreement limits or excludes Lightbringer's liability to a Data Subject under Clause 12 of the Standard Contractual Clauses or any liability that cannot be limited under Data Protection Laws.

11.5 Amendment.

(a) Changes to the List (which remain subject to Section 4), the Data Security page, and the privacy policy are not amendments of this DPA.

(b) Lightbringer may amend this DPA with effect on publication where the amendment does not reduce the protection of Customer Personal Data or Customer's rights under this DPA, including to correct errors, update references, clarify wording or add protections. This paragraph does not apply to a change of the Lightbringer entity that is party to this DPA.

(c) Any other amendment takes effect on the date stated in the notice. Where the amendment materially reduces Customer's protection or rights and is not required by Data Protection Laws, a supervisory authority or the Standard Contractual Clauses, that date is not earlier than fourteen (14) days after notice, and Customer may, before it takes effect, terminate the affected Services or close its account in accordance with the Agreement.

(d) Each amendment is published at https://lightbringer.com/privacy/dpa with a "Last updated" date. Lightbringer retains copies of prior applicable versions and will provide the version applicable to Customer on request. Notices under paragraph (c) are emailed to Customer's account owner at the address recorded in the account.

(e) If Customer reasonably considers that an amendment made under paragraph (b) reduces its protection or rights, it may object within thirty (30) days of publication, and the amendment then does not apply to Customer unless Lightbringer gives notice of it under paragraph (c), in which case it is treated as materially reducing Customer's protection or rights.

(f) An amendment made in accordance with this Section binds Customer from its effective date without further action or signature. No provision of the Agreement on amendment applies to this DPA.

11.6 Governing law. This DPA is governed by the law of Sweden, without prejudice to Section 11.3, Clauses 17 and 18 of the EU SCCs and Data Subjects' rights under Data Protection Laws.

11.7 Term. This DPA remains in force for as long as Lightbringer processes Customer Personal Data.

12.1 Customer may contact Lightbringer's Data Protection Officer at privacy@lightbringer.com. The Data Protection Officer's contact details and, where appointed, Lightbringer's representative under Article 27 UK GDPR are published in the privacy policy.

12.2 References in this DPA to pages on Lightbringer's website include any replacement address to which the page redirects. Lightbringer maintains those pages and may update them in accordance with Section 11.5(a).

Subject matter

Provision of the Services: an AI-assisted intellectual-property platform for preparing, drafting, analysing and managing inventions, patent applications, trade secret records and other IP assets and portfolios, including prior-art searches, product-support assistance at Customer's request, service-unit and paid-plan administration, operational portfolio workflows and collaboration with an Attorney Partner only when separately engaged. Where Customer elects to use them, workflows may include invention-mining notes, transferred portfolio and docketing records, strategy and review materials, contracts and board-pack documents. Professional representation and the Attorney Partner's independent-controller processing remain governed by Section 2.5, not by the pricing or availability of an MSA.

Nature of processing

• receiving data, including collection, access, retrieval and recording, whether submitted through the Lightbringer application or through a Connected AI Agent;
• holding data, including storage, organisation and structuring; protecting data, including restriction, encryption, access control and security testing;
• submitting Customer Content to third-party pre-trained AI models for the generation of draft text, patentability assessment, review feedback and prior-art searching, in each case under contractual terms prohibiting use of that content for model training;
• submitting Customer Content, or search queries derived from it, to prior-art search Sub-Processors;
• organising and transmitting Customer-provided invention-mining notes, portfolio and patent-family records, office-action materials and associated IP advisory or service-menu documents through the Services where Customer enables or instructs those workflows;
• recording and transcribing voice input submitted through the Services, such as dictated invention disclosures or recorded inventor interviews, through recording and speech-to-text Sub-Processors solely to produce the transcript;
• making Customer Content available to the Attorney Partner on Customer's instruction (Section 2.5);
• Lightbringer personnel accessing, reviewing or editing Customer Content at Customer's request to assist Customer in using the Services, and qualified personnel acting for the Attorney Partner on duly instructed professional matters under Section 2.5(d); in each case access is subject to the controls in Exhibit C;
• disclosing Customer Content to Connected AI Agents at Customer's instruction (Section 7) and to Sub-Processors as permitted by Section 4;
• logging, monitoring and backup; erasing data, including destruction and deletion.

Purpose

Performance of the Services under the Agreement in accordance with Customer's instructions. Lightbringer does not process Customer Personal Data for any other purpose (Section 2.2).

Categories of Data Subjects

• Customer's employees, and the consultants and contractors engaged by Customer, who are Authorised Users;
• named inventors and co-inventors identified in invention disclosures and patent applications, whether or not Customer personnel;
• applicants, assignees and other individuals identified in material submitted to the Services, including supporting technical documentation and prior-art;
• individuals who provide Attorney Partner Services and whose names, communications and actions appear in Customer Content, acting for the Attorney Partner (Section 2.5);
• Lightbringer personnel whose names, communications and actions appear in Customer Content when assisting Customer;
• any other individuals whose Personal Data Customer or its Authorised Users include in Customer Content.

Categories of Personal Data

• identification and contact data of inventors, applicants and other individuals named in Customer Content: name, employer, job title, and, where required by a patent office, postal address, nationality and residence;
• attribution data within Customer Content: the names and account identifiers of Authorised Users, Attorney Partner personnel and Lightbringer personnel as authors, reviewers editors or approvers of content and comments;
• voice and audio data: voice recordings submitted through the voice input features of the Services and the transcripts produced from them; recordings are processed solely to produce the transcript and are not processed to create voiceprints or to identify individuals by their voice; retention follows Section 2.4;
• invention disclosure content and any Personal Data contained in it, including inventor identity and attribution;
• where submitted by Customer, correspondence, invention-mining notes, portfolio-management and prosecution records, contracts and documents used in strategy reviews or board IP evidence packs, insofar as those materials contain Personal Data;
• patent application, filing and prosecution records, including inventor and applicant details required by the relevant patent office;
• correspondence and collaboration data: comments, review threads, Attorney Partner feedback and approvals within the Services;
• special category data (Article 9) only where contained in an invention disclosure and necessary to describe the invention, such as health or genetic data in a life-sciences disclosure; not solicited and not processed as a distinct category.

Special categories and criminal offence data

Customer shall not submit special categories of Personal Data (Article 9 GDPR) or data relating to criminal convictions and offences (Article 10 GDPR) to the Services, except where such data is contained in an invention disclosure and is necessary to describe the invention. Where such data is submitted, Customer confirms that it holds an applicable condition under Article 9(2) or, for criminal offence data, is authorised to process it in accordance with Article 10, and Lightbringer processes it only as part of Customer Content on Customer's instruction and applies the measures in Exhibit C without distinction as to category.

Duration and retention

Lightbringer processes Customer Personal Data for as long as Customer's account exists and thereafter only: (i) for the period necessary to complete return or deletion under Section 2.4; and (ii) where retention is otherwise required by applicable law. Professional records of the Attorney Partner are retained under Section 2.5(c) and the LSA. Account Data and Usage Data are retained as set out in the privacy policy.

1. List of parties

For transfers under Section 6.8 (Module Four), the roles in Part 1 are reversed: Lightbringer is the data exporter (processor) and Customer is the data importer (controller). Part 2 applies to those transfers. Parts 3 and 4 do not apply to them.

2. Description of the transfer

3. Competent supervisory authority

For the EU SCCs, the supervisory authority determined in accordance with Clause 13 and Section 6.3(e). Lightbringer's lead supervisory authority is Integritetsskyddsmyndigheten (IMY). For the UK Addendum, the Information Commissioner's Office.

4. Annex III — List of Sub-Processors

The List at https://lightbringer.com/privacy/subprocessors, as updated in accordance with Section 4, constitutes Annex III.

Lightbringer implements and maintains the measures below. Each row states a commitment. How a measure is currently implemented (protocols, tools, vendors, frequencies) is described on Lightbringer's Data Security page at https://lightbringer.com/security, which is provided for information and does not form part of this DPA. Lightbringer may update its measures and the Data Security page from time to time, provided the overall level of protection of Customer Personal Data is not materially reduced.

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the ICO and laid before Parliament on 2 February 2022 under s.119A of the Data Protection Act 2018 (version B1.0, in force 21 March 2022). This Exhibit applies only to the extent a transfer to Lightbringer constitutes an ex-UK Transfer (Section 6.4).

Part 1: Tables

Part 2: Mandatory Clauses

Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.