Data Processing Addendum

(v. 11.10.26)

THIS DATA PROCESSING ADDENDUM ("DPA") is incorporated into and forms part of the TOS and applies to each Order Form under which World Labs Processes Personal Data as a processor on behalf of Customer. Unless otherwise expressly provided within the TOS, or mutually agreed to between the Parties in writing, this DPA is effective on the earlier of the applicable Order Start Date or the date World Labs first Processes Personal Data on Customer's behalf, and will remain until expiration or termination of the Order Form or TOS, whichever is earlier.

1. PROCESSING OF PERSONAL DATA

1.1. Data Processing. The subject matter, duration, purpose of the Processing, and types of Personal Data and categories of Data Subjects under this DPA are set forth in Appendix A.

1.2. Instructions. Customer hereby instructs World Labs to process Personal Data as reasonably necessary to provide the Services as described in the TOS and this DPA. Subject to the applicable Order Form, and subject in all cases to any more restrictive Customer Content use limitations in the applicable Order Form, nothing in this DPA shall limit World Labs' rights under the TOS to use data that is either not Personal Data, or has been properly anonymized or aggregated.

1.3. Lawfulness of Instructions. Customer shall ensure that World Labs' processing of Personal Data in accordance with Customer's instructions will not cause World Labs to violate Data Protection Law. World Labs shall notify (where legally permissible) Customer without undue delay if it is unable to comply with its obligations under this DPA or Data Protection Law, or if it considers that an instruction from Customer is in breach of Data Protection Law.

1.4. Lawful Basis. Customer represents that it has established an appropriate lawful basis under Data Protection Law for World Labs' processing of Personal Data as specified in this DPA, including legitimate interests, consent, or contract performance, as applicable. Where Customer acts as a Processor, Customer represents that the relevant controller(s) have established an appropriate lawful basis, and that Customer has obtained all necessary authorizations from such controller(s) to engage World Labs as a Subprocessor and to transfer Personal Data to World Labs in accordance with this DPA.

1.5. Customer’s Obligations.

a. Customer represents and warrants that (i) it has complied, and will continue to comply, with all Applicable Laws, including Data Protection Law, concerning its Processing of Personal Data; (ii) its instructions to World Labs concerning such Processing will not cause World Labs to violate any Data Protection Law; and (iii) it has provided, and will continue to provide, all required notice and has obtained, and will continue to obtain, all consents and rights necessary under Data Protection Law for World Labs to Process Personal Data for the purposes described in the TOS. Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data. Without prejudice to the generality of the foregoing, Customer agrees that it shall be responsible for complying with all laws (including Data Protection Law) applicable to any content created, sent or managed through the Service.

b. Additionally, in its use of the Services, where Customer acts as a Processor on behalf of a third-party controller, Customer represents and warrants that: (a) it has the authority under its agreement with the relevant controller(s) to engage World Labs as a Subprocessor; (b) if applicable, it has provided or will provide any required notice to the relevant controller(s) regarding World Labs' engagement as a Subprocessor; and (c) it has flowed down to World Labs only instructions that are consistent with the instructions Customer has received from the relevant controller(s).

1.6. World Labs’ Obligations. World Labs shall adhere to applicable Data Protection Law in Processing Personal Data on behalf of Customer. World Labs shall Process Personal Data only in accordance with this DPA, the TOS, applicable Order Form. The Parties agree that this DPA, subject to the Order Form, sets out the Parties’ agreement with respect to the Processing of Personal Data.

1.7. Data Retention and Deletion. Subject to the TOS:

a. World Labs shall retain Personal Data for the greater of: (a) as long as necessary to provide the Services; or (b) where permitted, authorized, or required by Contract or Applicable Law.

b. Upon termination or expiration of the applicable Order Form or the TOS or at Customer's request, World Labs shall delete or return, as instructed by Customer, Personal Data, except: (i) Personal Data that has been aggregated or anonymized such that it no longer constitutes Personal Data; (ii) Personal Data incorporated into trained AI/ML models prior to the effective date of any applicable opt-out or restriction where extraction is not technically feasible without compromising model integrity; (iii) Personal Data required to be retained by contract or under Applicable Law; and (iv) Personal Data in system backups that will be deleted in the ordinary course of backup rotation.

1.8. Other Provisions around Processing Personal Data.

a. Customer acknowledges that the Services are not designed to enable World Labs to review or inspect Customer Content for the presence of Personal Data, and World Labs is not obligated to review or inspect Customer Content for Personal Data, whether in Inputs submitted to or Outputs generated by the Services;

b. If Customer does not intend for the Services to Process Personal Data in Customer Content, Customer is solely responsible for reviewing, inspecting, and excising such Personal Data from Customer submitted Inputs, and using the Services in such a way as to not generate Outputs, that contain Personal Data.

c. Should Customer nonetheless Process such Personal Data through the Services, Customer is solely responsible for deleting related Customer Content from the Services, or requesting deletion thereof. World Labs will not provide Customer-specific automatic deletion routines for such files or content. World Labs will not be liable for failure to identify, segregate, or delete Personal Data where Customer has not provided information sufficient to identify the relevant data or deletion is not technically feasible, subject in each case to Data Protection Law.

2. SENSITIVE DATA

2.1. Sensitive Data Prohibitions. Unless otherwise agreed in writing or covered by appropriate supplemental agreements (such as a Business Associate Agreement for HIPAA data), Customer shall not submit, and World Labs will not process, Sensitive Data, including:

(a) Health Data: Protected Health Information subject to HIPAA, medical records, health insurance information, genetic data, biometric identifiers used for health purposes, mental health records, or any other health-related personal information;

(b) Financial Data: Except as provided in the TOS, payment card information subject to PCI-DSS, bank account details, financial account numbers, credit reports, tax records, or other financial personal information regulated under applicable financial privacy laws;

(c) Educational Records: Student educational records subject to FERPA, academic transcripts, disciplinary records, or other educational information protected under applicable student privacy laws;

(d) Government Identifiers: Social Security numbers, passport numbers, driver's license numbers, government-issued identification numbers, or other official identification documents;

(e) Special Category Data: Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or data concerning sex life or sexual orientation, as defined under applicable Data Protection Law;

(f) Children's Data: Personal information of individuals under 13 years of age (or applicable age of digital consent in relevant jurisdiction) subject to COPPA or similar child protection laws;

(g) Regulated Industry Data: Data subject to sector-specific regulations including but not limited to telecommunications records (CPNI), energy sector data, or other industry-specific protected information.

2.2. Monitoring. World Labs reserves the right to implement automated detection and blocking mechanisms for Sensitive Data categories and may immediately suspend Services upon detection of prohibited data with Customer Content.

3. DATA PROTECTION

3.1. Security. World Labs shall implement and maintain security measures, including those specified in Appendix C, appropriate to the nature of Personal Data processed, leveraging cloud infrastructure security controls and implementing additional organizational measures as commercially reasonable (collectively, “Security Measures”). Examples of such Security Measures include: (i) encryption in transit; (ii) access controls and authentication; (iii) regular security monitoring; and (iv) incident detection capabilities, all subject to World Labs' current technical and operational capabilities.

3.2. Maintenance. World Labs shall regularly assess, test, and monitor its security systems, policies, and controls for effectiveness in protecting Personal Data, including security relating to datasets, models, and analytics systems. World Labs must have procedures for Security Incident detection and prompt notification as required by this DPA.

3.3. Personnel. World Labs shall ensure all personnel with access to Personal Data are subject to binding confidentiality and privacy obligations, and are trained on related security, privacy, and restrictions concerning Personal Data processing as part of the Services.

3.4. Automation. Customer acknowledges that the Services are not designed or intended for automated decision-making with legal or similarly significant effects on individuals as defined under applicable Data Protection Law. Customer agrees not to use the Services for: (i) automated employment decisions, credit determinations, or benefit eligibility assessments; (ii) automated law enforcement or judicial decisions; (iii) automated healthcare diagnosis or treatment decisions; (iv) automated educational assessments with significant consequences; or (v) any other automated processing that produces legal effects or similarly significant effects on individuals as defined under applicable law. If Customer uses the Services for such purposes despite this limitation: (i) Customer assumes full responsibility for compliance with automated decision-making requirements; (ii) Customer must implement appropriate human oversight and review mechanisms; (iii) Customer must provide required transparency and opt-out rights to affected individuals; and (iv) World Labs disclaims all liability for Customer's non-compliance with automated decision-making regulations.

3.5. Updates to Security Measures. Customer acknowledges that the Security Measures are subject to technical progress and development and that World Labs may update or modify the Security Measures from time to time, provided that such updates and modifications do not result in the degradation of the overall security of the Services provided to the Customer.

3.6. Customer's Obligations. Customer is responsible for ensuring its Security Measures adequately meet its obligations under applicable Data Protection Law. Customer is further responsible for its secure use of the Services, including protecting the security of Personal Data in transit to and from the Services (including securely backing up or encrypting any such Personal Data).

4. INCIDENT REPORTING

4.1. Notification. World Labs shall notify Customer as soon as reasonably practicable, but no later than seventy-two (72) hours, after becoming aware of any actual Security Incident, provided that World Labs has sufficient information at the time to determine that Personal Data was involved. The notification obligations in this Section do not apply to incidents that are caused by Customer or their customers, Authorized Users, or personnel, or to unsuccessful attempts or activities that do not compromise the security of Personal Data. It is Customer’s sole responsibility to ensure that it maintains accurate contact information with World Labs at all times.

4.2. Notification Content. If submitted, initial incident notifications will minimally include to the extent such information is available at the time: (i) number of affected Data Subjects; (ii) categories of Personal Data potentially affected; (iii) preliminary investigation results on cause and mitigation actions taken; and (iv) designated incident response contact.

4.3. Low-risk acknowledgement. The Parties acknowledge that World Labs may, from time to time, experience trivial and "Unsuccessful Security Incidents", which will mean generic unsuccessful security events, including enumeration or mapping, pings, port scans, unsuccessful log-on attempts, denials of service, any combination of the above, where regardless of the means used no unauthorized access, use, or disclosure of Personal Data occurs. This DPA will be sufficient notice of such trivial and Unsuccessful Security Incidents, and no further notice of the same will be required.

4.4. Remediation. World Labs shall make commercially reasonable efforts to identify the cause of the Security Incident and take those steps that World Labs deems necessary and reasonable to remediate the cause of such Security Incident to the extent that remediation is within World Labs’ reasonable control.

5. JURISDICTIONAL REQUIREMENTS

5.1. US State Privacy. To the extent World Labs Processes Personal Data subject to the CCPA, CPRA, or other applicable U.S. state privacy law, the provisions of Appendix B (hereby incorporated) will apply to such Processing in addition to this DPA. In the event of a conflict between this DPA and Appendix B with respect to Personal Data regulated under such laws, Appendix B will prevail.

5.2. Other Jurisdictions:

a. Canada. For Personal Data subject to PIPEDA or provincial privacy legislation, World Labs commits to processing in accordance with applicable Canadian privacy requirements and will implement appropriate safeguards for cross-border transfers.

c. Asia-Pacific. For Personal Data subject to Australian Privacy Act, Singapore PDPA, or similar APAC privacy laws, transfers will be governed by applicable adequacy decisions or appropriate safeguards as required by local law.

d. Central and South America. For Personal Data subject to Brazil's LGPD or other Central and South American privacy laws, World Labs will implement appropriate transfer mechanisms as required by applicable law.

5.5. Data Localization.

a. World Labs currently processes Personal Data using cloud infrastructure providers located in the United States. World Labs does not currently offer data residency or other localization outside of the United States.

b. World Labs does not currently offer guaranteed data localization, in-country processing, or on-premises deployment options. Enterprise customers with mandatory data localization requirements should contact World Labs, including at support@worldlabs.ai, to discuss options and requirements.

c. Where data localization is legally required, World Labs will work with customers to identify compliant processing arrangements, which may include service limitations or alternative technical implementations. However, if World Labs lacks the existing capacity to accommodate the requirements and does not agree to take on the obligation, Customer may not process Personal Data that requires such data localization.

6. SUBPROCESSORS AND AUDITS

6.1. Subprocessors. For Personal Data processed subject to Section 5.1 and 5.2, this Section 6.1 applies:

a. Authorized Subprocessors. Customer authorizes World Labs to engage those Subprocessors listed on the Subprocessors page (accessible at https://www.worldlabs.ai/subprocessors) ("Subprocessor List") to process Personal Data submitted by Customer as part of the Services, under the TOS.

b. New Subprocessors. World Labs shall provide Customer with at least thirty (30) days advance written notice before engaging any new Subprocessor to process Personal Data. Posting of new Subprocessors in the locations noted in Section 6.1(a) constitutes sufficient notice under this Section.

c. Subprocessor Objections. Customer may object to World Labs' engagement of a new Subprocessor by providing written notice to World Labs within fifteen (15) days of receiving notification under Section 6.1(b). Upon receipt of a valid objection, World Labs shall work in good faith with Customer to find an alternative to the Subprocessor or ways to provide Services without the use of the Subprocessor.

d. Communication. Customer shall not directly communicate with World Labs' Subprocessors about the Services, unless agreed to in writing by World Labs.

e. Contract. World Labs shall obtain sufficient guarantees from all Subprocessors that they will implement appropriate technical and organizational measures in such a manner that the Processing will meet the requirements of the Data Protection Law and this DPA. World Labs must enter into a written agreement with all relevant Subprocessors that imposes data-protection obligations providing at least an equivalent level of protection for Personal Data.

6.2. Audits. For Personal Data processed subject to Section 5.1 and 5.2, this Section 6.2 applies:

a. Rights. If permitted or required under Applicable Law, Customer may exercise the following audit rights to demonstrate World Labs' compliance with this DPA

(i) Standard Audit Rights. Customer may request written responses to reasonable security questionnaires (not more than annually) and summaries of relevant third-party audit reports where available and not subject to confidentiality restrictions.

(ii) Enhanced Audit Rights. For customers with annual commitments exceeding $100,000, Customer may conduct on-site audits of World Labs' compliance with its obligations under this DPA up to once per year and on such other occasions as may be required by applicable Data Protection Law, including where mandated by Customer’s Supervisory Authority. Any audit must be conducted during regular business hours, subject to the agreed final audit plan as set forth in Section 6.2(d) and subject to World Labs' reasonable safety, security, or other relevant policies, and may not unreasonably interfere with World Labs' business activities.

b. Third-Party Auditors. If a third party is to conduct an audit under Section 6.2(a), World Labs may object to the auditor if the auditor is, in World Labs' reasonable opinion, a competitor of World Labs. Such objection by World Labs will require Customer to appoint another auditor or conduct the audit itself. Customer will be responsible for all fees charged by any auditor appointed by Customer to execute any audit under this Section 6.2.

c. Audit Scope and Limitations. Audits conducted under Section 6.2(a)(ii) may cover data processing procedures, security controls implementation, and compliance documentation directly related to Customer's Personal Data processing. Audits may not unreasonably interfere with World Labs' business operations, but may exclude access to other customers' data, proprietary algorithms, trade secrets, or information that would result in a breach of any duty of confidentiality.

d. Audit Plan Requirements. Except for Supervisory Authority audits, Customer must submit a detailed proposed audit plan to World Labs at least ninety (90) days in advance of the proposed audit date. Any third-party auditor must sign a customary non-disclosure agreement mutually acceptable to the Parties providing for the confidential treatment of all information exchanged in connection with the audit and any reports regarding the results or findings thereof. The proposed audit plan must describe the scope, duration, and start date of the audit. World Labs shall review the proposed audit plan and provide Customer with any concerns or questions. World Labs shall work cooperatively with Customer to agree on a final audit plan.

e. Third-Party Audit Report Acceptance. If the controls or measures to be assessed in the requested audit are addressed in an SOC 2 Type II, ISO 27001, NIST, or similar audit report performed by a qualified third-party auditor within twelve (12) months of Customer's audit request and World Labs has confirmed there are no known material changes in the controls audited, Customer agrees to accept such report in lieu of requesting an audit of such controls or measures.

f. Subprocessor Information. Nothing in this Section 6.2 shall be construed to require World Labs to furnish more information about its Subprocessors in connection with such audits than such Subprocessors make available to World Labs without restriction on further disclosure.

g. Audit Reports and Remediation. Customer shall promptly notify World Labs of any non-compliance discovered during the course of an audit and provide World Labs any audit reports generated in connection with any audit under this Section 6.2 unless prohibited by applicable Data Protection Law or otherwise instructed by a Supervisory Authority. Customer may use the audit reports only for the purposes of meeting Customer's regulatory audit requirements and confirming compliance with the requirements of this DPA. If any audit reveals that World Labs is not in compliance with the provisions of this DPA or applicable Data Protection Law, World Labs shall take commercially reasonable corrective actions including temporary work-arounds reasonably necessary to comply with the provisions of this DPA and applicable Data Protection Law.

7. ASSISTANCE

7.1. Assistance. To the extent necessary under Data Protection Law, World Labs shall provide reasonable assistance to Customer to fulfill Customer's own obligations under Data Protection Law with respect to their use of the Services, within a reasonable timeframe or as otherwise set forth in this DPA or the TOS, including:

• Complying with requests from individuals to exercise rights accorded to them under Data Protection Law;
• Replying to inquiries or complaints relating to the Processing of Personal Data under the TOS, including from individuals or relevant regulators;
• Conducting data protection impact assessments; and
• Supporting investigations or audits by Supervisory Authorities or other regulators relevant to the Services.

7.2. Notification.

a. Subject to the TOS, unless prohibited by applicable Data Protection Law, World Labs shall inform Customer without undue delay, but no later than five (5) business days, if World Labs:

• Receives a request, complaint or other inquiry regarding the Processing of Personal Data, including from individuals or relevant regulators; or
• Receives a binding or non-binding request to disclose Personal Data to law enforcement, courts or any government body. World Labs shall not disclose any Personal Data in response to such an order or request unless required by Applicable Law, and shall (where legally permitted) provide Customer with an opportunity to oppose or seek limitations on such disclosure.

b. In the event that a Data Subject Request is made to World Labs, World Labs shall direct the Data Subject to contact Customer directly or as required by Data Protection Law. If World Labs is required by Data Protection Law to respond to the Data Subject Request, it shall notify (if legally permissible to do so) Customer in writing without undue delay. For the avoidance of doubt, nothing in the TOS or the DPA shall restrict or prevent World Labs from responding to any Data Subject Request or request or inquiry from a Supervisory Authority in relation to Personal Data for which World Labs is a Controller.

7.3. Scope of Request Assistance. Where Personal Data cannot be directly identified by World Labs' systems, Customer must provide sufficient identifying information to enable World Labs to locate and process relevant data. World Labs' assistance obligations are subject to the technical architecture of the Services but do not excuse compliance with Data Protection Law requirements. Customer agrees that World Labs' assistance obligations under this Section 7 are limited to, where applicable and technically feasible: (i) notifying Customer of requests as they come, as provided; (ii) providing available technical information about data processing; (iii) facilitating data export; and (iv) implementing deletion instructions for identifiable data sets provided by Customer.

8. LIABILITY

8.1. To the extent permitted by applicable Data Protection Law, each Party's (and all of that Party's Affiliates') liability taken together in the aggregate arising out of or related to this DPA shall be subject to the exclusions and limitations of liability set forth in the TOS.

8.2. Any claims made against World Labs under or in connection with this DPA shall be brought solely by the Customer.

9. GENERAL

9.1. Effect of DPA. This DPA is a part of and subject to the terms and conditions of the Order Form and TOS. This DPA, the applicable Order Form, and the TOS (including the exhibits, amendments, SOWs, and schedules thereto) constitute the complete agreement between the Parties relating to the matters specified in this DPA, and supersedes all prior representations or agreements, whether oral or written, with respect to such matters. This DPA is for the benefit of, and will be binding upon the Parties, their Affiliates and respective successors and assigns. Unless herein provided, all General provisions from the TOS apply to this DPA.

9.2. Order of Precedence. Subject to the applicable Order Form, if there is a conflict between the TOS and this DPA, the TOS shall control with respect to World Labs' ownership of and rights to use data, and this DPA shall control with respect to data protection compliance obligations. If the Parties have executed a Business Associate Agreement ("BAA"), subject to the Health Insurance Portability and Accountability Act of 1996 (as amended, the "HIPAA Act"), in case of conflict between this DPA and the BAA, the BAA will prevail concerning the Processing of Protected Health Information.

10. DEFINITIONS

Unless otherwise defined herein, capitalized terms have the meanings assigned in the TOS. The following terms have the specific meanings set forth below:

10.1. "Affiliate" means, with respect to any Party, any entity that directly or indirectly controls, is controlled by, or is under common control with such Party, where "control" means the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of such entity, whether through the ownership of voting securities, by contract, or otherwise.

10.2. "Applicable Law" means all applicable laws, rules, regulations, decrees, judgments, injunctions, orders and rulings of any government, regulatory, judicial or administrative agency or authority.

10.3. "CCPA" means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020, and as it may be further amended from time to time.

10.4. "CPRA" means the California Privacy Rights Act of 2020, and as it may be further amended from time to time.

10.5. "Data Protection Law" means all applicable laws relating to the processing, privacy, and use of Personal Data applicable to either Party in their respective roles in the processing of Personal Data under the TOS.

10.6. "Data Subject" means the natural person to whom Personal Data relates.

10.7. “Data Subject Request” means a request from a Data Subject to exercise any rights accorded to them under applicable Data Protection Law.

10.8.

10.9. "Personal Data" means any information relating to an identified or identifiable natural person where such information is contained in Customer Content and is subject to applicable Data Protection Law.

10.10. "Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

10.11. "Security Incident" means any actual unauthorized or unlawful breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

10.12. "Subprocessor" means any entity (including any third party and any World Labs Affiliate, but excluding employees of World Labs or its Affiliates) appointed by or on behalf of World Labs to Process Personal Data in connection with the TOS.

10.13. "Supervisory Authority" means an independent public authority responsible for monitoring the application of Data Protection Law.

10.14. "Customer Content" has the meaning set forth in the TOS.

10.15. “Sensitive Data” means any information that is subject to heightened regulatory protection or poses elevated privacy and security risks, including Protected Health Information subject to HIPAA, educational records subject to FERPA, financial information regulated under applicable financial privacy laws, government identification numbers, special category personal data as defined under applicable Data Protection Law, children's information subject to COPPA or similar laws, biometric data used for identification purposes, and other information subject to sector-specific regulatory restrictions.

APPENDIX A: DETAILS OF PROCESSING

Annex I.A.: List of Parties

Customer

Name	See Order Form
Address	See Order Form
Contact persons	See Order Form
Activities relevant to the data transferred under these Clauses	Customer’s use of World Labs’ services, including submission of Customer Content containing Personal Data for processing in connection with Customer’s authorized business purposes under the Order Form, TOS, and DPA.
Role	Data Exporter: Controller or Processor (as applicable per Section 5.1(a))

World Labs

Name	See Order Form
Address	See Order Form
Contact persons	See Order Form
Activities relevant to the data transferred under these Clauses	Provision of the Services under the Order Form, TOS, and DPA, including processing Personal Data contained in Customer Content on behalf of Customer.
Role	Data Importer: Processor or Subprocessor (as applicable per Section 5.1(a))

Annex I.B.: Description of Transfer and Processing

Subject Matter and Purpose of Processing	Processing of Personal Data contained in Customer Content in connection with Customer's use of World Labs' spatial intelligence AI services.
Categories of data subjects	Individuals appearing in Customer Content; Customer personnel, users, or contractors to the extent their Personal Data is included in Customer Content; End users of Customer’s applications or services; Any other individuals whose Personal Data is contained in Customer Content submitted to the Services
Categories of personal data transferred	Visual data, including photographs, images, and videos containing identifiable individuals; Location data and geospatial information; Device identifiers and technical data associated with use of the Services; Account-related identifiers and metadata included in Customer Content; Any other Personal Data contained in Customer Content submitted by Customer
Sensitive data transferred (if applicable) and safeguards	The Parties do not intend for Customer to submit, or for World Labs to process, Sensitive Data except as expressly authorized in writing by the Parties. Processing Sensitive Data requires the Parties' prior written authorization and agreed supplemental safeguards.
Frequency of transfer	Continuous, on a recurring basis, for the duration of the Order Form, as initiated by Customer through its use of the Services.
Nature of the processing	Collection, receipt, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, analysis, disclosure by transmission, alignment, combination, restriction, deletion, and destruction, in each case solely as necessary to provide the Services and perform World Labs’ obligations under the Order Form, TOS, and DPA.
Retention period	As specified in the applicable Order Form and subject to Section 1.8 of this DPA, including retention as necessary to provide the Services, comply with Customer’s documented instructions, satisfy the deletion or return requirements of this DPA, or comply with Applicable Law.
Subprocessors: subject matter, nature, and duration of the processing	See DPA Section 6.1

APPENDIX B: ADDITIONAL TERMS FOR U.S. STATE PRIVACY LAWS

1. Definitions. Terms used in this Appendix B have the meanings set forth in applicable U.S. State Privacy Laws, including the CCPA, CPRA, Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, and other similar state privacy legislation (collectively, "U.S. State Privacy Laws").

2. Service Provider. Where applicable, Customer is a Business/Controller and World Labs is a Service Provider or Processor under U.S. State Privacy Laws.

3. Processing Restrictions. Unless otherwise permitted or provided under the DPA, TOS, or U.S. State Privacy Laws, World Labs shall not: (i) sell, share, or use Personal Information for targeted advertising; (ii) retain, use, or disclose Personal Information outside the business purpose of providing the Services; or (iii) combine Personal Information with information from other sources.

4. Assistance. World Labs shall provide reasonable assistance with Customer’s compliance with U.S. State Privacy Laws, with respect to their use of the Services, to the extent technically feasible and subject to the same limitations described in DPA Section 7.3.

5. Certifications. World Labs certifies that it understands and will comply with applicable restrictions under U.S. State Privacy Laws, including prohibitions on sale, sharing, and use outside the business purpose.

6. Subcontractors. World Labs may engage Subprocessors for processing Personal Information under this Appendix subject to DPA Section 6.1(e).

APPENDIX C: SECURITY MEASURES

World Labs shall implement and maintain commercially reasonable technical, physical, and organizational security measures appropriate to the nature, scope, and purposes of the Personal Data processed under this DPA, consistent with industry standards for cloud-based AI services. Such measures will include, at a minimum: (i) encryption of Personal Data in transit; (ii) access controls and authentication mechanisms; (iii) regular security monitoring and logging; and (iv) incident detection and response capabilities.

World Labs leverages security controls provided by its cloud infrastructure providers, which maintain industry-standard certifications such as SOC 2, ISO 27001, and other relevant security frameworks.

The Security Measures described in this Appendix C apply during the term of each applicable Order Form. Nothing in this Appendix C limits World Labs' obligations under Section 3 of this DPA or applicable Data Protection Law.