Master Service Agreement

Suite Enrich Co

Last Updated: June 2026 | Version 3.2

This Master Service Agreement ("MSA" or "Agreement") is entered into by and between Suite Enrich Co, a Colorado S-Corporation doing business as "Suite Enrich" ("Suite Enrich," "we," "us," or "our"), with its principal place of business at 6153 S Logan Pl, Centennial, CO 80121, and the entity or individual accessing or using the Service ("Customer," "you," or "your").

This Agreement governs Customer's access to and use of the Suite Enrich AI platform and all related services, features, and documentation (collectively, the "Service"). This Agreement does not govern general use of Suite Enrich's website, which is governed by the Website Terms and Conditions.

Contract Formation. For Free/Beta and SMB Plan Customers, this Agreement becomes binding upon the earliest of: (a) clicking "I Accept" or similar; (b) installing or enabling the Service; (c) first use of or access to the Service; or (d) creating an account. For Enterprise Plan Customers, this Agreement becomes binding upon execution of this Agreement or an applicable Order Form. By accepting, Customer represents it has legal authority to bind the entity on whose behalf the Service is accessed.

Record of Acceptance. Suite Enrich maintains electronic records of Customer's acceptance, including date and time, version of this Agreement, and method of acceptance. Records are maintained for the duration of the Agreement plus seven (7) years and constitute prima facie evidence of acceptance under Colorado UETA (C.R.S. §24-71.3-101) and the federal E-SIGN Act.

Incorporated Documents. This Agreement incorporates by reference: (a) the Data Processing Agreement ("DPA"); (b) the Data Quality & Limitations Addendum; and (c) the Privacy Policy. In the event of conflict, this Agreement controls except where the DPA addresses data protection matters.

Geographic Availability. Suite Enrich AI is currently available only to users located in the United States or Australia. By accessing or using the Service, you represent that your organization is located in the United States or Australia and does not conduct business in the European Union, European Economic Area, or United Kingdom. We may expand availability to additional regions in the future.

Article 1: Definitions

"Authorized User" means an individual authorized by Customer to access and use the Service on Customer's behalf.

"Confidential Information" means all proprietary, non-public information disclosed by either party, including trade secrets, source code, algorithms, business plans, financial data, customer lists, and any information marked or reasonably understood to be confidential.

"Credits" means units of Service usage consumed when enrichment requests are submitted.

"Customer Data" means all data, records, and information submitted to the Service by or on behalf of Customer for enrichment processing. Customer Data does not include Enriched Data or data independently collected by Third-Party Data Providers.

"Data Processing Agreement" or "DPA" means the Data Processing Agreement governing the processing of Personal Data, incorporated by reference into this Agreement and published below on this page.

"Documentation" means all user guides, help materials, API documentation, technical specifications, and other materials provided by Suite Enrich describing the Service.

"Enriched Data" means data returned by the Service as a result of enrichment processing, including information retrieved from Third-Party Data Providers and AI-generated insights. Enriched Data is derived from third-party sources and automated processing and may be inaccurate, incomplete, or outdated.

"ERP" means Enterprise Resource Planning, referring to integrated software systems including but not limited to Oracle NetSuite.

"Foreign Adversary Country" means any country designated under the Protecting Americans' Data From Foreign Adversaries Act (P.L. 118-50, Div. H), currently including China, Russia, Iran, and North Korea.

"Free/Beta Plan" means any no-cost access tier, including beta, trial, evaluation, or free-tier access.

"Order Form" means a written document executed by both parties specifying Plan, pricing, term, Credits, and additional terms.

"Personal Data" means any information relating to an identified or identifiable natural person, as defined under Applicable Data Protection Laws.

"Plan" means the subscription tier selected by Customer, including Free/Beta, SMB (Starter, Growth, or Pro), Enterprise, Enterprise 10, Enterprise 20, or other plans as Suite Enrich may offer.

"Service" means the Suite Enrich AI platform and all related features, functionality, tools, APIs, integrations, and documentation, delivered as a SuiteApp, Bundle, or through any other delivery mechanism.

"Third-Party Data Provider" means any third-party entity from which Suite Enrich sources data used in enrichment. A current list of Third-Party Data Providers is available upon written request to support@suiteenrich.com.

Article 2: Service Grant and License

2.1 License Grant

Subject to the terms of this Agreement, Suite Enrich grants Customer a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Service during the Term solely for Customer's internal business purposes in accordance with Customer's applicable Plan and this Agreement.

2.2 Authorized Users

Customer may permit Authorized Users to access the Service on Customer's behalf. Customer is responsible for ensuring all Authorized Users comply with this Agreement. Any act or omission of an Authorized User constituting a breach of this Agreement shall be deemed a breach by Customer.

2.3 Scope of License and Restrictions

Customer shall not, and shall not permit any third party to: (a) copy, modify, or create derivative works of the Service; (b) reverse engineer, decompile, or attempt to discover source code, algorithms, data sources, or matching logic; (c) access the Service to build a competitive product; (d) sublicense, lease, sell, resell, transfer, assign, or distribute the Service to any third party; (e) remove or alter any proprietary notices; (f) use the Service in any manner that violates applicable law or exceeds the license scope; (g) attempt to circumvent any security features or usage controls.

2.4 Service Modifications

Suite Enrich reserves the right to modify, update, enhance, or discontinue any aspect of the Service at any time. For modifications that materially and adversely reduce core functionality for paid Plan Customers, Suite Enrich will use commercially reasonable efforts to provide at least 30 days' advance notice.

2.5 Free/Beta Plans

Access under a Free/Beta Plan is provided "as is" and "as available" without any warranties, service level commitments, support obligations, or performance guarantees. Suite Enrich may modify, suspend, limit, restrict, or terminate Free/Beta Plan access at any time, for any reason, without notice, liability, or obligation. Suite Enrich's maximum aggregate liability to Free/Beta Customers is $100.00.

Article 3: Customer Obligations

3.1 Account Responsibility

Customer is responsible for: (a) all activity under its account; (b) maintaining the confidentiality and security of account credentials and API keys; (c) ensuring account information is accurate and current; (d) restricting access to Authorized Users only; (e) notifying Suite Enrich at support@suiteenrich.com within 48 hours of any unauthorized access or security breach.

3.2 Lawful Use and Regulatory Compliance

Customer shall comply with all applicable laws, regulations, and industry standards, including:

Data protection and privacy laws (GDPR, UK GDPR, CCPA/CPRA, Colorado Privacy Act, and other applicable regulations);
Anti-spam and electronic communications laws (CAN-SPAM, CASL, GDPR for electronic marketing);
Export control regulations and economic sanctions (OFAC, BIS). Customer shall not transfer Enriched Data to any entity in a Foreign Adversary Country;
Anti-corruption and anti-bribery laws (FCPA, UK Bribery Act);
Fair Credit Reporting Act (15 U.S.C. §1681 et seq.) — Customer expressly acknowledges that Enriched Data is not a consumer report and Suite Enrich is not a consumer reporting agency. Customer shall not use Enriched Data for any FCRA-regulated purpose, including credit eligibility, employment screening, insurance underwriting, tenant screening, or government benefits eligibility, regardless of whether Customer believes the FCRA applies to its specific use case;
California Delete Act (SB 362, AB 1824) — Customer acknowledges Suite Enrich is a registered California data broker and processes consumer deletion requests through the DROP platform. Customer shall honor deletion and opt-out requests communicated by Suite Enrich for individuals whose data Customer received through the Service, within 45 days of notification;
All other applicable federal, state, local, and international laws.

3.3 Data Accuracy, Validation, and Reliance

Customer acknowledges that Enriched Data may be inaccurate, incomplete, outdated, or incorrect. Customer is solely responsible for independently validating and verifying Enriched Data before any use. See the Data Quality & Limitations Addendum for detailed accuracy information and Customer's mandatory validation obligations. Suite Enrich disclaims all responsibility for actions taken or decisions made based on Enriched Data.

3.4 ERP and System Responsibility

Customer is solely responsible for its ERP environment, including system configuration, user permissions, data backups, customizations, integrations, and third-party applications. Suite Enrich is not liable for any data loss, corruption, or system issues arising from Customer's ERP configuration or failure to maintain adequate backups.

3.5 Security Obligations

Customer shall: (a) implement and maintain reasonable technical, administrative, and organizational security safeguards; (b) restrict access to Authorized Users and revoke access promptly when authorization ends; (c) prevent unauthorized use or disclosure of Enriched Data; (d) obtain all required consents and provide all required notices; (e) notify Suite Enrich within 48 hours of any actual or suspected security breach involving Enriched Data.

3.6 HIPAA Exclusion

The Service is not designed for Protected Health Information ("PHI") as defined under HIPAA. Suite Enrich will not enter into a Business Associate Agreement. Customer's submission of PHI constitutes a material breach of this Agreement and grounds for immediate termination. Suite Enrich disclaims all liability for Customer's submission of PHI.

Article 4: Acceptable Use Policy

4.1 Prohibited Uses

Customer shall not use the Service or Enriched Data to:

Conduct bulk email campaigns, spam, or unsolicited communications in violation of CAN-SPAM, GDPR, CASL, or other applicable laws;
Redistribute, resell, sublicense, rent, lease, publish, or make available Enriched Data or any substantial part thereof to any third party;
Extract, compile, or use Enriched Data to build, train, or operate any competing data enrichment, lead generation, data intelligence, or data brokerage product or service;
Reverse engineer or attempt to identify data sources, matching logic, or enrichment methodologies;
Publicly disclose the logic, structure, methodology, sources, or architecture of the Service or Enriched Data;
Compile Enriched Data into standalone databases or data products for sale, license, or public access;
Use the Service or Enriched Data for any unlawful, deceptive, fraudulent, defamatory, harassing, or unethical purpose;
Attempt to gain unauthorized access to any part of the Service or other customer accounts;
Use automated scripts, bots, or scrapers not expressly authorized by Suite Enrich in writing;
Circumvent, disable, or interfere with any security features or access controls;
Introduce viruses, malware, or harmful code into the Service;
Use Enriched Data as a sole or primary factor in making decisions regarding employment, credit, insurance, housing, education, or other determinations producing legal effects on individuals without independent verification and human review;
Process, store, or transmit data in violation of any applicable export control laws, economic sanctions, or trade embargoes, including any transfer to a Foreign Adversary Country;
Use the Service to stalk, harass, threaten, or intimidate any individual.

4.2 Permitted Derivative Works

Notwithstanding the restrictions above, Customer may integrate individual data points from Enriched Data into Customer's own internal systems and workflows (e.g., enriching ERP contact records) for Customer's own internal business use, provided such integration complies with all other terms of this Agreement and applicable Third-Party Data Provider restrictions. Integration of Enriched Data into Customer's internal records for Customer's own business use is the intended and permitted use case.

4.3 Monitoring and Enforcement

Suite Enrich reserves the right to monitor Customer's use for compliance, investigate suspected violations, and take any action it deems appropriate, including: (a) issuing warnings; (b) suspending or restricting access; (c) immediately terminating access without notice or refund; (d) reporting violations to law enforcement; (e) pursuing legal remedies including injunctive relief, damages, and attorneys' fees.

Article 5: Plans, Credits, and Usage

5.1 Subscription Plans

(a) Free/Beta: No-cost access with limited Credits. No service commitments. Suite Enrich may modify, limit, or discontinue at any time without notice or liability. (b) SMB Plans (Starter, Growth, Pro): Paid self-service plans with defined Credit allocations and standard contractual protections. (c) Enterprise Plans: Custom or tiered plans with enhanced Credits, features, and support, subject to individual Order Forms.

5.2 Credit System

(a) Credits are consumed when an enrichment request is submitted. One request consumes one Credit. (b) Credits are consumed regardless of whether results are returned, except for failures caused solely by Suite Enrich system errors. (c) Credits reset on a monthly basis. Unused Credits do not roll over. (d) Customer is solely responsible for monitoring Credit usage.

5.3 Credit Exhaustion

When Credits are exhausted, enrichment functionality will be suspended until Credits reset, additional Credits are purchased, or the Plan is upgraded. Suite Enrich is not liable for any business impact resulting from Credit exhaustion.

5.4 Rate Limiting

Suite Enrich reserves the right to implement rate limiting or other usage controls to maintain Service performance, security, and fairness.

Article 6: Fees and Payment

6.1 Fees

Customer shall pay all fees associated with its selected Plan as published on Suite Enrich's website or as specified in an applicable Order Form. All fees are quoted and payable in United States Dollars.

6.2 Billing Cycle

Paid Plans are billed in advance on a monthly or annual basis, as selected by Customer at subscription.

6.3 Auto-Renewal

All paid subscriptions automatically renew at the end of each billing cycle for successive periods of the same duration, unless Customer cancels prior to the renewal date or Suite Enrich provides notice of non-renewal at least 30 days prior to the renewal date.

6.4 No Refunds

All fees are non-refundable, including fees for partially used billing periods, unused Credits, downgraded Plans, and early termination. The sole exception is where a refund is expressly required by applicable law that cannot be waived by contract.

6.5 Taxes

All fees are exclusive of applicable Taxes. Customer is solely responsible for all Taxes, except for taxes based on Suite Enrich's net income.

6.6 Late Payment

Any payment not received within 15 days after the due date shall accrue interest at 1.5% per month, or the maximum rate permitted by applicable law, whichever is less. Customer shall reimburse Suite Enrich for all costs of collection, including reasonable attorneys' fees.

6.7 Suspension for Non-Payment

Suite Enrich may suspend Customer's access upon 15 days' written notice of overdue payment. If payment remains outstanding for more than 60 days, Suite Enrich may terminate this Agreement immediately upon written notice.

Article 7: Data Accuracy, Third-Party Data Providers, and AI Processing

7.1 Third-Party Data Sources and Suite Enrich's Role

Enriched Data is derived from Third-Party Data Providers that independently collect and maintain professional, business, and company-related information. Suite Enrich acts as an intermediary that transmits enrichment requests, receives results, applies AI-based processing, and returns Enriched Data to Customer. Suite Enrich does not independently verify the accuracy, completeness, or timeliness of data maintained by Third-Party Data Providers.

7.2 No Accuracy Guarantee

ENRICHED DATA IS PROVIDED "AS IS" AND "AS AVAILABLE." SUITE ENRICH MAKES NO REPRESENTATIONS OR WARRANTIES REGARDING: (A) THE ACCURACY OF ENRICHED DATA; (B) THE COMPLETENESS OF ENRICHED PROFILES; (C) THE CURRENCY OF EMPLOYMENT, CONTACT, OR COMPANY INFORMATION; (D) THE AVAILABILITY OF ENRICHMENT DATA FOR ALL SUBMITTED RECORDS; OR (E) THE CONSISTENCY OF RESULTS ACROSS ENRICHMENT OPERATIONS.

7.3 AI-Generated Content and Automated Processing

The Service uses artificial intelligence, machine learning, natural language processing, and statistical inference. AI-based processing may: normalize data formats; infer missing attributes; generate professional summaries, persona descriptions, and strategic insights; score and rank records; resolve ambiguities in record matching; generate reports, dashboards, analytics, and data visualizations; and perform other AI-assisted processing. AI-based processing is inherently probabilistic and may produce incorrect inferences, false positives, false negatives, misattributions, or incorrect matches. Suite Enrich does not warrant the accuracy, reliability, or suitability of AI-generated output for any particular purpose.

7.4 Matching and Identification Risks

Despite safeguards, enrichment operations may: (a) associate data with the wrong individual; (b) match records to incorrect companies; (c) attribute outdated roles, titles, or employment status; (d) fail to detect recent changes; or (e) return no results for valid records. Customer acknowledges that no matching system is error-free and agrees to review enriched records before relying on them for any purpose.

7.5 Reporting Data Quality Issues

Customer may report suspected inaccuracies to support@suiteenrich.com. Suite Enrich will use commercially reasonable efforts to investigate and, where appropriate, relay corrections to applicable Third-Party Data Providers. Suite Enrich does not guarantee correction of reported issues.

Article 8: Intellectual Property

8.1 Suite Enrich IP

Suite Enrich retains all right, title, and interest in and to the Service, including all software, source code, object code, algorithms, orchestration architecture, AI models, training data, matching logic, scoring methodologies, workflows, user interfaces, APIs, Documentation, and all related intellectual property rights. Nothing in this Agreement transfers any ownership interest in Suite Enrich's intellectual property to Customer.

8.2 Customer Data Ownership

Customer retains all right, title, and interest in and to Customer Data. Customer grants Suite Enrich a limited, non-exclusive, non-transferable license to use, process, transmit, and temporarily store Customer Data solely for the purpose of providing the Service. Suite Enrich may use anonymized, aggregated, de-identified data derived from Service usage for service improvement, AI model improvement, developing benchmarks, and internal analytics, provided such data cannot reasonably identify Customer or any individual.

8.3 Enriched Data License and Restrictions

Enriched Data is licensed, not sold, to Customer for internal business use only. Customer shall not: (a) resell, redistribute, sublicense, rent, lease, publish, or make available Enriched Data in its original or substantially similar form; (b) use Enriched Data to build, train, or operate any competing data enrichment, lead generation, or data brokerage product; (c) publicly disclose Enriched Data in bulk or the logic, structure, or sources of the Enriched Data; (d) compile Enriched Data into standalone databases for sale, license, or public access; (e) reverse engineer Enriched Data to identify data sources, matching methodologies, or enrichment logic. These restrictions survive termination of this Agreement.

8.4 Third-Party Data Provider IP

Third-Party Data Providers retain all ownership rights in their source data and databases. Customer's rights to Enriched Data are limited to the license granted in this Agreement. Customer acknowledges that Third-Party Data Providers are intended third-party beneficiaries of the data use restrictions in this Agreement.

8.5 Third-Party Data Provider Flow-Down Restrictions

Customer agrees to comply with all Third-Party Data Provider restrictions applicable to Enriched Data, including: (a) Non-reutilization: Customer shall not redistribute or make available the data to the public in any form; (b) No public display: Customer shall not publicly disclose the data, data structure, or logic; (c) Anti-spam: Customer shall not use the data for bulk mail or unsolicited commercial communications; (d) No competitive use: Customer shall not use the data to build competing products; (e) Security: Customer shall implement and maintain reasonable security measures. These restrictions survive termination indefinitely.

8.6 Feedback

If Customer provides Suite Enrich with suggestions, enhancement requests, feedback, or other input regarding the Service ("Feedback"), Customer grants Suite Enrich a perpetual, irrevocable, royalty-free, sublicensable, worldwide license to use, modify, and incorporate such Feedback without restriction or obligation.

Article 9: Confidentiality

9.1 Confidentiality Obligations

Each party (the "Receiving Party") agrees to: (a) hold the other party's (the "Disclosing Party's") Confidential Information in strict confidence; (b) not disclose Confidential Information to any third party without prior written consent, except to employees, contractors, and advisors who need to know and are bound by obligations at least as protective; (c) use Confidential Information solely for performing obligations under this Agreement; (d) protect Confidential Information with at least the same care used for its own confidential information of similar nature, but in no event less than reasonable care.

9.2 Compelled Disclosure

If required by law, regulation, legal process, or governmental order to disclose Confidential Information, the Receiving Party shall: (a) provide prompt written notice to the Disclosing Party; (b) reasonably cooperate with efforts to seek a protective order; (c) disclose only the minimum amount necessary.

9.3 Return or Destruction

Upon termination or written request, the Receiving Party shall promptly return or destroy all Confidential Information and certify compliance upon written request.

9.4 Equitable Relief

Each party acknowledges that a breach of this Article 9 may cause irreparable harm for which monetary damages would be inadequate. Accordingly, the Disclosing Party shall be entitled to seek injunctive or other equitable relief without the necessity of posting a bond.

9.5 Survival

Confidentiality obligations survive termination for three (3) years, except that obligations with respect to trade secrets survive for as long as such information qualifies as a trade secret under applicable law.

Article 10: Data Protection and Privacy

10.1 Data Processing Agreement

Where Suite Enrich processes Personal Data on behalf of Customer, such processing is governed by the Data Processing Agreement (DPA), incorporated by reference into this Agreement and published below on this page.

10.2 Roles of the Parties

With respect to Customer-submitted Personal Data processed at Customer's direction: (a) Customer is the Data Controller; (b) Suite Enrich is the Data Processor/Service Provider. For Enrichment Data obtained from Third-Party Data Providers, Suite Enrich acts as an independent Data Controller. See the DPA for full role architecture details.

10.3 Customer's Data Protection Obligations

Customer is solely responsible for: (a) ensuring a lawful basis for processing Personal Data submitted to the Service; (b) providing required privacy notices to data subjects; (c) obtaining necessary consents; (d) not submitting unlawful or special categories of Personal Data without express written authorization.

10.4 Security Measures

Suite Enrich implements and maintains appropriate technical and organizational security measures including: (a) access controls and role-based authentication; (b) encryption of data in transit (TLS 1.2+) and at rest (AES-256); (c) tenant isolation in multi-tenant environments; (d) audit logging and monitoring. Details are set forth in the DPA and at suiteenrich.com/security.

10.5 Personal Data Breach

Suite Enrich will notify Customer within 72 hours after becoming aware of a Personal Data Breach affecting Customer's Personal Data, as further described in the DPA. Customer is responsible for breach notifications to regulators or data subjects as required by applicable law.

Article 11: Term and Termination

11.1 Term

This Agreement commences upon the earliest date of contract formation and continues for the duration of Customer's subscription.

11.2 Termination by Customer

Customer may terminate: (a) Free/Beta Plans at any time by ceasing use; (b) paid Plans by canceling the subscription prior to the next renewal date. Termination takes effect at the end of the then-current billing cycle with no refund of pre-paid fees.

11.3 Termination by Suite Enrich

Suite Enrich may suspend or terminate Customer's access: (a) Immediately without notice for: material breach of the Acceptable Use Policy; PHI submission in violation of Section 3.6; threats to platform integrity; or imminent risk of harm; (b) Upon 15 days' written notice for: non-payment after the cure period; legal or regulatory concerns; (c) Upon 30 days' written notice for: any other material breach not cured within 30 days after written notice.

11.4 Effect of Termination

Upon termination: (a) Customer's license and right to access the Service shall immediately cease; (b) Customer may retain Enriched Data already integrated into Customer's ERP records, subject to the continuing restrictions of this Agreement; (c) Customer shall promptly delete or destroy any Enriched Data not already integrated into ERP records; (d) all outstanding fees shall become immediately due and payable; (e) each party shall return or destroy the other party's Confidential Information.

11.5 Data Retention and Deletion Post-Termination

Suite Enrich will retain Customer Data for 90 days post-termination ("Retention Period"). During the Retention Period, Customer may request return or export of Customer Data. After the Retention Period, Suite Enrich will delete Customer Data from active systems. Suite Enrich shall provide written certification of deletion upon Customer's written request. Suite Enrich cannot guarantee deletion of data held by Third-Party Data Providers.

Article 12: Warranties and Disclaimers

12.1 Suite Enrich Warranties

Suite Enrich represents and warrants that: (a) it has the legal authority to enter into this Agreement and provide the Service; (b) the Service, when used in accordance with this Agreement and Documentation, will perform materially in accordance with the Documentation for paid Plan Customers during the Term; (c) it will implement commercially reasonable security measures as described in this Agreement and the DPA; (d) it will not knowingly introduce viruses, malware, or other harmful code into the Service; (e) to its knowledge, the Service (exclusive of Third-Party Data Provider data) does not infringe any third-party intellectual property rights existing as of the Effective Date.

Sole Remedy: Customer's sole and exclusive remedy for breach of the Performance Warranty is for Suite Enrich to use commercially reasonable efforts to correct the non-conformity within a reasonable period. If Suite Enrich is unable to correct within 60 days, Customer may terminate and receive a pro-rata refund of pre-paid fees for the unused portion of the then-current billing period.

12.2 Customer Warranties

Customer represents and warrants that: (a) it has the legal authority to enter into this Agreement; (b) it will use the Service in compliance with this Agreement and all applicable laws; (c) it has obtained all necessary consents and legal bases related to data submitted to the Service; (d) Customer Data does not violate any applicable law or infringe any third-party right; (e) it will not submit PHI or other prohibited data categories to the Service; (f) the individual accepting this Agreement has legal authority to bind Customer.

12.3 Free/Beta Disclaimer

THE SERVICE PROVIDED UNDER A FREE/BETA PLAN IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT ANY WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. THE PERFORMANCE WARRANTY IN SECTION 12.1(B) DOES NOT APPLY TO FREE/BETA PLANS.

12.4 General Disclaimer

EXCEPT AS EXPRESSLY SET FORTH IN SECTION 12.1, THE SERVICE AND ENRICHED DATA ARE PROVIDED "AS IS" AND "AS AVAILABLE." SUITE ENRICH DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, COMPLETENESS, TIMELINESS, AND RELIABILITY OF ENRICHED DATA. SUITE ENRICH DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, COMPLETELY SECURE, OR FREE OF HARMFUL COMPONENTS. NO ADVICE OR INFORMATION OBTAINED FROM SUITE ENRICH SHALL CREATE ANY WARRANTY NOT EXPRESSLY STATED IN THIS AGREEMENT.

12.5 Data Quality Disclaimer

SUITE ENRICH MAKES NO GUARANTEE REGARDING THE ACCURACY, COMPLETENESS, CURRENCY, RELIABILITY, OR SUITABILITY OF ENRICHED DATA FOR ANY PARTICULAR PURPOSE. ENRICHED DATA IS DERIVED FROM THIRD-PARTY SOURCES AND AI PROCESSING BEYOND SUITE ENRICH'S CONTROL. AI-GENERATED OUTPUT IS PROBABILISTIC AND MAY CONTAIN ERRORS, MISATTRIBUTIONS, FALSE POSITIVES, OR INCORRECT INFERENCES. CUSTOMER ASSUMES ALL RISK ASSOCIATED WITH RELIANCE ON ENRICHED DATA AND AI-GENERATED OUTPUT.

Article 13: Limitation of Liability

13.1 Exclusion of Consequential Damages

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY SHALL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES, INCLUDING BUT NOT LIMITED TO DAMAGES FOR LOST PROFITS, LOST REVENUE, LOSS OF DATA, LOSS OF BUSINESS OPPORTUNITY, BUSINESS INTERRUPTION, LOSS OF GOODWILL, REPUTATIONAL HARM, OR COST OF SUBSTITUTE SERVICES, REGARDLESS OF THE CAUSE OF ACTION OR THEORY OF LIABILITY, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

13.2 Liability Cap

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE TOTAL AGGREGATE LIABILITY OF SUITE ENRICH TO CUSTOMER FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THIS AGREEMENT SHALL NOT EXCEED THE TOTAL FEES ACTUALLY PAID BY CUSTOMER TO SUITE ENRICH DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE FIRST EVENT GIVING RISE TO THE CLAIM. FOR FREE/BETA PLAN CUSTOMERS, SUITE ENRICH'S TOTAL AGGREGATE LIABILITY SHALL NOT EXCEED ONE HUNDRED DOLLARS ($100.00).

13.3 Super Cap for Carve-Out Claims

FOR CLAIMS ARISING OUT OF: (A) EITHER PARTY'S BREACH OF CONFIDENTIALITY OBLIGATIONS; (B) EITHER PARTY'S INDEMNIFICATION OBLIGATIONS; (C) CUSTOMER'S BREACH OF THE ACCEPTABLE USE POLICY OR INTELLECTUAL PROPERTY PROVISIONS; (D) EITHER PARTY'S FRAUD, WILLFUL MISCONDUCT, OR GROSS NEGLIGENCE; OR (E) EITHER PARTY'S DATA SECURITY BREACH CAUSED BY FAILURE TO MAINTAIN REASONABLE SECURITY MEASURES — THE TOTAL AGGREGATE LIABILITY SHALL NOT EXCEED TWO TIMES (2X) THE GENERAL CAP DESCRIBED IN SECTION 13.2. THE SUPER CAP DOES NOT APPLY TO FREE/BETA PLAN CUSTOMERS.

13.4 Uncapped Liability

Nothing in this Agreement shall limit: (a) either party's liability for death or personal injury caused by negligence; (b) either party's liability for fraud or fraudulent misrepresentation; (c) Customer's obligation to pay fees due under this Agreement; or (d) any other liability that cannot be limited or excluded under applicable law.

13.5 Enriched Data Risk Allocation

SUITE ENRICH IS NOT LIABLE FOR ANY DAMAGES, CLAIMS, LOSSES, OR EXPENSES ARISING FROM: (A) DECISIONS MADE BY CUSTOMER OR ANY THIRD PARTY BASED ON ENRICHED DATA OR AI-GENERATED OUTPUT; (B) INACCURACIES, ERRORS, OR OMISSIONS IN ENRICHED DATA ORIGINATING FROM THIRD-PARTY DATA PROVIDERS; (C) AI-GENERATED OUTPUT THAT IS INCORRECT, INCOMPLETE, MISLEADING, OR UNSUITABLE; (D) CUSTOMER'S FAILURE TO VALIDATE ENRICHED DATA OR AI-GENERATED OUTPUT BEFORE USE; OR (E) CUSTOMER'S USE OF ENRICHED DATA IN VIOLATION OF APPLICABLE LAW.

13.6 Essential Basis of the Bargain

Customer acknowledges that Suite Enrich has set its fees and entered into this Agreement in reliance upon the limitations of liability and disclaimers set forth herein, and that the same form an essential basis of the bargain between the parties.

Article 14: Indemnification

14.1 Indemnification by Customer

Customer shall indemnify, defend, and hold harmless Suite Enrich and its officers, directors, shareholders, employees, agents, and affiliates from and against any and all third-party claims, demands, actions, damages, losses, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to: (a) Customer's breach of this Agreement; (b) Customer's misuse of the Service or Enriched Data; (c) Customer's violation of any applicable law or regulation; (d) Customer Data or any third-party claim that Customer Data infringes or violates any right; (e) any unauthorized, unlawful, or unsolicited communications sent by Customer using Enriched Data; (f) Customer's use of Enriched Data as a factor in employment, credit, insurance, housing, or other eligibility determinations; (g) Customer's submission of PHI or other prohibited data categories; (h) Customer's transfer of Enriched Data to any Foreign Adversary Country.

14.2 Indemnification by Suite Enrich

Suite Enrich shall indemnify, defend, and hold harmless Customer and its officers, directors, employees, and agents from and against any third-party claim that the Service itself (exclusive of Enriched Data sourced from Third-Party Data Providers, Customer Data, and any third-party components) infringes upon the intellectual property rights of such third party, provided that Customer promptly notifies Suite Enrich of the claim and provides reasonable cooperation.

14.3 Indemnification Procedures

The Indemnified Party shall: (a) promptly notify the Indemnifying Party in writing; (b) provide the Indemnifying Party with sole control over the defense and settlement; (c) provide reasonable cooperation. The Indemnifying Party shall not settle any claim that imposes liability or restrictions on the Indemnified Party without the Indemnified Party's prior written consent.

Article 15: Export Controls, Sanctions, and Anti-Corruption

15.1 Export Compliance

Customer shall comply with all applicable export control laws, sanctions, and regulations, including those administered by OFAC and BIS. Customer shall not export, re-export, or otherwise transfer the Service, Enriched Data, or any technical data to any prohibited destination, entity, or individual.

15.2 Sanctions Representations

Customer represents and warrants that: (a) it is not located in, organized under the laws of, or ordinarily resident in any country or territory subject to comprehensive U.S. sanctions; (b) it is not designated on any U.S. government list of prohibited or restricted parties; (c) it will not provide access to the Service to any person or entity described in (a) or (b).

15.3 Anti-Corruption

Each party represents and warrants that it has not and will not, in connection with this Agreement, violate any applicable anti-corruption or anti-bribery law, including the FCPA and the UK Bribery Act 2010.

15.4 Suite Enrich PADFAA Representation

Suite Enrich represents that it does not transfer Customer Data, Personal Data, or Enriched Data to any entity in or owned or controlled by a Foreign Adversary Country as designated under the Protecting Americans' Data From Foreign Adversaries Act (P.L. 118-50, Div. H), and will maintain this restriction for the term of this Agreement.

Article 16: Force Majeure

Neither party shall be liable for any failure or delay in performing its obligations (other than payment obligations) to the extent that such failure or delay results from circumstances beyond such party's reasonable control, including acts of God, natural disasters, pandemics, government actions, wars, terrorism, power failures, internet or telecommunications outages, failures of third-party hosting or infrastructure providers, cyberattacks, or distributed denial-of-service attacks. The affected party shall provide prompt written notice and use commercially reasonable efforts to resume performance. If a Force Majeure Event continues for more than 60 consecutive days, either party may terminate this Agreement upon written notice without liability, and Suite Enrich shall provide a pro-rata refund of pre-paid fees for the period of non-performance.

Article 17: Governing Law and Dispute Resolution

17.1 Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of Colorado, without regard to its conflict of laws principles.

17.2 Informal Resolution

Before initiating any formal dispute resolution proceeding, the parties shall attempt to resolve any dispute through good-faith negotiation. Either party may initiate informal dispute resolution by providing written notice describing the dispute. The parties shall use commercially reasonable efforts to resolve the dispute within 30 days after such notice.

17.3 Binding Arbitration

Any dispute, controversy, or claim arising out of or relating to this Agreement that is not resolved through informal negotiation shall be resolved by binding arbitration administered by the American Arbitration Association (AAA) in accordance with its Commercial Arbitration Rules. Arbitration shall take place in Denver, Colorado before a single arbitrator. The arbitrator's decision shall be final and binding and may be entered as a judgment in any court of competent jurisdiction. All aspects of the arbitration shall be confidential.

17.4 Class Action Waiver

ALL DISPUTES SHALL BE RESOLVED ON AN INDIVIDUAL BASIS. CUSTOMER AND SUITE ENRICH EACH WAIVE ANY RIGHT TO PARTICIPATE IN A CLASS ACTION, CLASS-WIDE ARBITRATION, PRIVATE ATTORNEY GENERAL ACTION, OR ANY OTHER REPRESENTATIVE PROCEEDING. THIS CLASS ACTION WAIVER IS AN ESSENTIAL PART OF THIS ARBITRATION AGREEMENT AND MAY NOT BE SEVERED.

17.5 Equitable Relief

Notwithstanding the foregoing, either party may seek injunctive or other equitable relief in any court of competent jurisdiction to prevent irreparable harm without first pursuing arbitration.

17.6 Attorneys' Fees

In any action, arbitration, or proceeding to enforce this Agreement, the prevailing party shall be entitled to recover its reasonable attorneys' fees, costs, and expenses from the non-prevailing party.

17.7 Statute of Limitations

Any claim arising out of or relating to this Agreement must be brought within one (1) year after the cause of action accrues, or the claim shall be permanently barred. This limitation does not apply to claims for breach of confidentiality, intellectual property infringement, or indemnification obligations.

Article 18: Audit and Compliance Verification

Customer may verify Suite Enrich's compliance with data protection and security obligations through: (a) written questionnaires (Suite Enrich shall respond within 30 business days); (b) review of third-party audit reports or certifications; (c) written responses to reasonable compliance inquiries. Compliance verification requests are limited to once annually with 30 days' written notice. All verification activities and results are confidential.

Article 19: General Provisions

19.1 Entire Agreement

This Agreement, together with the DPA, Data Quality & Limitations Addendum, Privacy Policy, and any applicable Order Forms, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior agreements, understandings, representations, and warranties.

19.2 Amendments and Modifications

Suite Enrich may update or modify this Agreement from time to time. For self-serve Customers: Suite Enrich will provide at least 30 days' notice of material changes. Continued use of the Service after the effective date constitutes acceptance. For Enterprise Customers with executed Order Forms: material changes require mutual written consent, except that Suite Enrich may update the DPA and Privacy Policy to reflect changes in applicable law without mutual consent.

19.3 Assignment

Neither party may assign, transfer, or delegate its rights or obligations without the prior written consent of the other party, except in connection with a merger, acquisition, reorganization, or sale of all or substantially all of its assets, provided the assignee agrees in writing to be bound by the terms of this Agreement.

19.4 Severability

If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

19.5 Waiver

No waiver by either party of any breach shall be deemed a waiver of any subsequent or prior breach. No waiver shall be effective unless made in writing and signed by an authorized representative.

19.6 Notices

All formal legal notices under this Agreement shall be in writing and delivered to: Suite Enrich Co, Attn: Legal, 6153 S Logan Pl, Centennial, CO 80121, or support@suiteenrich.com; and to Customer at the address or email on file with Suite Enrich.

19.7 No Third-Party Beneficiaries

Except as expressly provided in Article 8 regarding Third-Party Data Provider IP rights, this Agreement is made solely for the benefit of the parties and their permitted successors and assigns.

19.8 Independent Contractors

The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, employment relationship, agency, franchise, or fiduciary relationship between the parties.

19.9 Survival

The following provisions survive termination or expiration: Article 1 (Definitions), Article 4 (Acceptable Use Policy), Article 7 (Data Accuracy, Third-Party Data Providers, and AI Processing), Article 8 (Intellectual Property), Article 9 (Confidentiality), Article 10 (Data Protection), Article 12 (Warranties and Disclaimers), Article 13 (Limitation of Liability), Article 14 (Indemnification), Article 15 (Export Controls, Sanctions, and Anti-Corruption), Article 17 (Governing Law and Dispute Resolution), Article 18 (Audit and Compliance Verification), Article 19 (General Provisions), Article 20 (Artificial Intelligence Governance), and any payment obligations accrued prior to termination.

19.10 Order of Precedence

In the event of conflict: (1) any applicable Order Form; (2) the Data Processing Agreement (on data protection matters); (3) this Master Service Agreement; (4) the Data Quality & Limitations Addendum; (5) the Privacy Policy.

19.11 Contact Information

General & Legal: support@suiteenrich.com

Sales: sales@suiteenrich.com

Suite Enrich Co
6153 S Logan Pl
Centennial, CO 80121

Article 20: Artificial Intelligence Governance

20.1 Colorado Artificial Intelligence Act Compliance

Suite Enrich operates in compliance with the Colorado Artificial Intelligence Act (SB 24-205, C.R.S. §6-1-1701 et seq.), effective June 30, 2026. Suite Enrich has adopted the NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0) as its AI governance standard, which constitutes an affirmative defense under C.R.S. §6-1-1702 and §6-1-1703. Suite Enrich publishes its AI governance statement at suiteenrich.com/ai-governance.

20.2 Developer Documentation

Upon written request, Suite Enrich will provide Customer with documentation required under C.R.S. §6-1-1702(2)(b) as a developer of AI systems, including: (a) types of data used to train AI components of the Service; (b) known limitations and foreseeable risks of the AI system; (c) Suite Enrich's known or reasonably foreseeable risk of algorithmic discrimination; and (d) measures implemented to mitigate the risk of algorithmic discrimination. AI Model Cards are available upon written request to support@suiteenrich.com.

20.3 Human Oversight Requirement

Customer shall not use the Service or Enriched Data as the sole basis for any "consequential decision" as defined under C.R.S. §6-1-1701(3), including decisions with material legal or similarly significant effects on employment, financial services, insurance, housing, healthcare, legal services, or government services. Customer shall ensure meaningful human review of AI-assisted output before making consequential decisions affecting individuals. Customer is independently responsible for its obligations as a "deployer" under C.R.S. §6-1-1703 when using the Service in connection with consequential decisions.

20.4 Algorithmic Discrimination Reporting

If Suite Enrich discovers that the Service has caused algorithmic discrimination as defined under C.R.S. §6-1-1701(4), Suite Enrich shall report such discovery to the Colorado Attorney General within 90 days as required by §6-1-1702(2)(c)(IV). Suite Enrich shall notify affected Customers of relevant mitigation measures taken.

20.5 AI Act Compliance Updates

Suite Enrich will use commercially reasonable efforts to monitor developments regarding the Colorado AI Act, including any amendments or federal preemption, and will update its AI governance practices accordingly. Suite Enrich will provide Customer with reasonable notice of any material changes to its AI compliance posture that affect Customer's use of the Service.

Data Processing Agreement

Suite Enrich Co

Last Updated: April 2026 | Version 3.0

This Data Processing Agreement ("DPA") forms part of the Master Service Agreement ("MSA") between Suite Enrich Co, a Colorado S-Corporation doing business as "Suite Enrich" ("Suite Enrich," "we"), and the entity using the Service ("Customer," "you"). References to "Suite Enrich" include all associated trade names including "Suite Enrich AI."

This DPA applies where Suite Enrich processes Personal Data in connection with the Service. Capitalized terms not defined herein have the meanings set forth in the MSA. In the event of conflict between this DPA and the MSA, this DPA controls on data protection matters.

1. Definitions

"Applicable Data Protection Laws" means all applicable laws relating to data protection and privacy, including the GDPR (EU 2016/679), UK GDPR, CCPA/CPRA, the Colorado Privacy Act, and any other applicable data protection law.

"California Data Broker Laws" means Cal. Civ. Code §1798.99.80 (data broker registration), SB 362 (Delete Act), AB 1824 (M&A obligations), and all implementing regulations.

"DROP Platform" means the California Privacy Protection Agency's Data Rights Opt-out Platform established under SB 362.

"Enrichment Data" means data obtained by Suite Enrich from Third-Party Data Providers (list available upon written request to support@suiteenrich.com) used to enrich Customer-submitted records.

"Personal Data" means any information relating to an identified or identifiable natural person, as defined under Applicable Data Protection Laws.

"Personal Data Breach" means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

"Processing" means any operation performed on Personal Data, whether or not by automated means.

"Sub-processor" means any third party engaged by Suite Enrich to process Personal Data on behalf of Customer. A current list is available upon written request to support@suiteenrich.com.

2. Role Architecture

Suite Enrich's data enrichment service requires three distinct data processing roles. This DPA addresses each role in a separate section. The applicable section is determined by the specific data flow and processing activity.

Section A — Suite Enrich as Processor / Service Provider (Customer-Submitted Data)

Scope: Section A applies when Suite Enrich processes Personal Data that Customer submits to the Service for enrichment — i.e., Customer-submitted CRM records, contact lists, and ERP data provided by Customer at Customer's direction.

Role: In this capacity, Suite Enrich is a Data Processor (under GDPR) and Service Provider (under CCPA) acting solely on Customer's documented instructions.

CCPA Certification: With respect to Customer-submitted Personal Data of California residents processed under Section A, Suite Enrich certifies that it: (a) will not sell or share this data as defined under Cal. Civ. Code §1798.140(ad) and §1798.140(ah); (b) will not retain, use, or disclose this data outside the direct business relationship with Customer; (c) will not use this data for any commercial purpose other than providing the Service; (d) will not combine this data with data from other customers or sources except as permitted under §1798.140(ag)(1)(C); (e) will notify Customer if Suite Enrich determines it can no longer meet these service provider obligations.

Transition Moment: Suite Enrich ceases to act as a Processor/Service Provider at the moment Customer-submitted Personal Data is matched against or integrated with Enrichment Data from a Third-Party Data Provider. From that moment, Section B governs the enriched output.

Section B — Suite Enrich as Independent Controller (Enrichment Data)

Scope: Section B applies when Suite Enrich processes Enrichment Data — data obtained from Third-Party Data Providers and used to produce enriched outputs. It also applies to Suite Enrich's independent decisions about which Third-Party Data Providers to use, which matching algorithms to apply, and how to structure enriched outputs.

Role: In this capacity, Suite Enrich and Customer are each independent Data Controllers. Neither party acts as processor for the other with respect to Enrichment Data. The parties are not joint controllers under GDPR Article 26.

Customer's Section B responsibilities: Customer is independently responsible for: (a) ensuring it has a lawful basis to receive and use Enrichment Data; (b) providing any required notices to its contacts about receiving third-party enrichment data; (c) honoring opt-out and deletion requests for Enrichment Data in Customer's possession; (d) complying with all applicable laws governing Customer's use of Enrichment Data.

Suite Enrich's Section B responsibilities: Suite Enrich is responsible for (a) selecting Third-Party Data Providers that maintain reasonable data protection practices; (b) entering appropriate contractual arrangements with Third-Party Data Providers; (c) maintaining its California data broker registration and DROP platform compliance per California Data Broker Laws; (d) honoring opt-out and deletion requests from individuals whose data Suite Enrich processes as an independent controller.

Suite Enrich is NOT responsible for: (a) the accuracy, completeness, or timeliness of data maintained by Third-Party Data Providers; (b) Third-Party Data Providers' independent collection, retention, or use of data in their own controller capacity; (c) data breaches or security incidents at Third-Party Data Providers' own systems.

Section C — Data Contribution Terms

Scope: Section C applies if and when Customer submits data that Suite Enrich uses to improve, validate, or enhance its enrichment database or AI models beyond the specific enrichment request.

Current status: As of the date of this DPA, Suite Enrich does not use Customer-submitted Personal Data to train AI models or enhance its enrichment database without Customer's express written consent. Section C terms are dormant unless Suite Enrich notifies Customer in writing that this function has been activated and Customer consents. Suite Enrich will provide at least 30 days' advance notice before activating Section C functionality.

3. Details of Processing (GDPR Article 28)

3.1 Subject Matter

Processing of Personal Data for ERP-native data enrichment services through the Suite Enrich AI platform.

3.2 Duration

For the term of the MSA, plus the ninety (90) day post-termination Retention Period, after which Customer-submitted Personal Data is deleted.

3.3 Nature and Purpose

Personal Data is processed for: (a) record matching and enrichment; (b) data normalization and validation; (c) AI-assisted inference, analysis, reporting, and other automated processing; (d) audit logging and usage tracking; (e) credit consumption tracking and billing; (f) service performance monitoring and improvement. The accuracy, completeness, and currency of Enriched Data are governed by MSA Article 7 and the Data Quality & Limitations Addendum. Suite Enrich's processor obligations under Section A do not constitute any guarantee of data quality or accuracy.

3.4 Categories of Data Subjects

Data subjects may include Customer's customers, prospects, employees, contractors, business contacts, and other individuals whose data is submitted to the Service.

3.5 Categories of Personal Data

Personal Data processed may include: names, business email addresses, job titles, company affiliations, professional metadata (employment history, skills, education), business contact information, and IP addresses/technical identifiers.

3.6 Special Categories

Special categories of Personal Data (GDPR Article 9) are not intentionally processed. Customer shall not submit special category data or PHI without prior written agreement.

4. Customer Obligations

Customer shall: (a) ensure a lawful basis for Processing; (b) provide required privacy notices and obtain necessary consents; (c) ensure instructions to Suite Enrich comply with Applicable Data Protection Laws; (d) not submit prohibited data categories without prior written agreement; (e) not submit PHI as described in the MSA; (f) not use Enriched Data for any FCRA-regulated purpose; (g) implement appropriate security measures to protect Enriched Data in Customer's possession; (h) honor opt-out and deletion requests received from individuals whose data Customer received through the Service.

5. Suite Enrich Obligations

Suite Enrich shall: (a) process Customer-submitted Personal Data (Section A) only on Customer's documented instructions; (b) ensure authorized personnel have confidentiality obligations; (c) implement appropriate technical and organizational security measures per Section 8; (d) comply with Sub-processor requirements per Section 6; (e) assist Customer with data subject rights requests per Section 9; (f) assist with breach notification, DPIAs, and supervisory authority consultations; (g) delete or return Customer-submitted Personal Data upon MSA termination; (h) make available information to demonstrate DPA compliance; (i) maintain California data broker registration and comply with DROP platform obligations as an independent controller.

6. Sub-Processors and Third-Party Data Providers

6.1 General Authorization

Customer provides general authorization for Suite Enrich to engage Sub-processors for: (a) cloud hosting and infrastructure (currently Oracle Cloud Infrastructure); (b) security and monitoring; (c) data enrichment services (list available upon written request); (d) payment processing and billing (Stripe); (e) artificial intelligence and machine learning processing services.

6.2 Sub-processor List and Change Notification

Suite Enrich maintains a current list of all Sub-processors, including Sub-processor name, role, data categories processed, and location. This list is available to Customer upon written request at support@suiteenrich.com. Suite Enrich shall notify Customer at least thirty (30) days in advance of any intended changes to Sub-processors (additions or replacements) via email to the Customer email address on file. The notification shall identify the new Sub-processor, its role, and the nature of processing.

6.3 Customer Objection Process

If Customer has reasonable, documented data protection grounds for objecting to a new Sub-processor, Customer shall notify Suite Enrich in writing within 15 days of receiving the change notification. Upon receipt: (a) Suite Enrich will use commercially reasonable efforts to address Customer's concerns; (b) if concerns cannot be resolved within 30 days, Customer may terminate this DPA and the MSA with a pro-rata refund of pre-paid fees for the unused portion of the billing period. If Customer does not object within 15 days, Customer is deemed to have accepted the new Sub-processor.

6.4 Sub-processor Obligations

Suite Enrich shall: (a) enter into written agreements with each Sub-processor imposing data protection obligations materially consistent with this DPA; (b) conduct reasonable due diligence on each Sub-processor's data protection practices before engagement; (c) remain liable for Sub-processor acts and omissions as if Suite Enrich had performed the processing itself.

6.5 Third-Party Data Provider Dual Roles

Customer acknowledges that Third-Party Data Providers operate in a dual capacity: (a) As Data Processors (responding to enrichment queries under contractual obligations); (b) As Independent Controllers (independently determining how their source data is collected, compiled, maintained, and used). In their independent controller capacity, Third-Party Data Providers may retain copies of queries, retain retrieved data records, and use retained data for their own legitimate business purposes. Suite Enrich does not control Third-Party Data Providers' independent controller activities.

6.6 Customer Acknowledgments

Customer acknowledges: (a) Third-Party Data Providers may retain Personal Data and queries; (b) provider privacy policies govern independently retained data; (c) Suite Enrich cannot guarantee deletion by Third-Party Data Providers; (d) some data subject rights may be limited regarding data held by Third-Party Data Providers.

6.7 Deletion routing

For data sourced from Third-Party Data Providers, Suite Enrich will route verified deletion requests to the applicable provider upon written request to support@suiteenrich.com.

7. International Data Transfers

7.1 Transfer Mechanisms

Personal Data may be transferred outside the EEA, UK, or Customer's jurisdiction, including to the United States (Oracle Cloud Infrastructure). Third-Party Data Providers may also process data on servers located in the European Union, including Germany and Finland. All such providers maintain appropriate legal mechanisms for cross-border data transfers in compliance with applicable law. Where required, Suite Enrich shall implement: (a) Module 1 SCCs (Controller-to-Controller) per EU Commission Decision 2021/914 for Enrichment Data processed under Section B; (b) Module 2 SCCs (Controller-to-Processor) for Customer-submitted Personal Data processed under Section A; (c) UK International Data Transfer Addendum; (d) additional supplementary measures as necessary. Customer authorizes such transfers.

7.2 PADFAA Restriction

Suite Enrich shall not transfer Customer Personal Data or Enrichment Data to any entity in a Foreign Adversary Country without Customer's express written consent. This restriction applies regardless of other authorizations in this DPA.

8. Security Measures

Suite Enrich implements and maintains: (a) access controls, role-based authentication, and least-privilege access; (b) encryption of Personal Data in transit (TLS 1.2+); (c) encryption of Personal Data at rest (AES-256 or equivalent); (d) tenant isolation in multi-tenant environments; (e) audit logging and monitoring; (f) regular security assessments; (g) employee and contractor confidentiality obligations; (h) incident response procedures; (i) secure API key handling — no plaintext credential storage; (j) network security controls (NSGs, private endpoints). Current security posture documentation is available at suiteenrich.com/security.

9. Data Subject Rights

Suite Enrich shall assist Customer with responding to data subject requests for: (a) access; (b) rectification; (c) erasure; (d) restriction; (e) portability; (f) objection; (g) California opt-out of sale/sharing; (h) DROP deletion requests. Suite Enrich shall respond to Customer's assistance requests within 10 business days. For California DELETE Act requests received through the DROP platform, Suite Enrich will process as an independent controller per its California data broker obligations.

10. Audit and Compliance Verification

Customer may verify Suite Enrich's compliance through: (a) written questionnaires (Suite Enrich shall respond within 30 business days); (b) review of third-party audit reports or certifications when available; (c) written responses to reasonable compliance inquiries. Requests are limited to once annually with 30 days' notice. All activities and results are confidential. When available, Suite Enrich will satisfy audit requests by providing applicable third-party certifications.

11. Personal Data Breach

11.1 Notification

Suite Enrich shall notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach. For breaches affecting Colorado residents, Customer shall have 30 days from Suite Enrich's notification to make required notifications under C.R.S. §6-1-716. For breaches affecting 500+ Colorado residents, Customer is responsible for notifying the Colorado Attorney General. The notification shall include: (a) nature of the breach and affected data categories and approximate number of records; (b) Suite Enrich point of contact; (c) likely consequences; (d) measures taken or proposed.

11.2 Cooperation

Suite Enrich shall: (a) take immediate steps to contain the breach; (b) preserve evidence and logs; (c) cooperate with Customer's investigation; (d) provide reasonable assistance with Customer's regulatory and individual notifications. Customer is responsible for determining notification obligations and making required notifications under all applicable laws.

12. Data Return and Deletion

Upon MSA termination: (a) Customer may request return of Customer-submitted Personal Data within the 90-day Retention Period; (b) Suite Enrich will provide data in a standard machine-readable format; (c) after the Retention Period, Suite Enrich shall delete Customer-submitted Personal Data from active systems, except where required by law; (d) residual copies in automated backups will be deleted in the ordinary course of backup rotation (within 6 months); (e) Enriched Data already applied to Customer's ERP records remains Customer's responsibility; (f) Suite Enrich cannot guarantee deletion of data held by Third-Party Data Providers. Suite Enrich shall provide written certification of deletion upon Customer's written request.

13. California Data Broker Compliance

Suite Enrich acknowledges its status as a registered California data broker under Cal. Civ. Code §1798.99.80. As an independent controller (Section B), Suite Enrich independently manages: (a) California data broker registration (annual renewal by January 31 each year); (b) DROP platform access at least once every 45 days beginning August 1, 2026; (c) processing of consumer deletion requests received via DROP within 45 days of retrieval; (d) consumer opt-out management for sale/sharing of business contact data. Customers who receive notification of a deletion request affecting their customer/contact records should honor that deletion request within their own systems and notify Suite Enrich.

14. Liability

Each party's liability under this DPA is subject to the limitations in the MSA. Nothing herein limits either party's liability to data subjects under Applicable Data Protection Laws to the extent such limitation is prohibited by law. Suite Enrich's liability for Section B (independent controller) activities is separate from its liability for Section A (processor) activities.

15. Governing Law

This DPA is governed by the same law and dispute resolution as the MSA (Colorado law; Denver arbitration), except where Applicable Data Protection Laws require otherwise.

16. Colorado AI Act Compliance

16.1 AI Processing Disclosure

Suite Enrich processes Personal Data using artificial intelligence and machine learning as described in Section 3.3. Suite Enrich has adopted the NIST AI Risk Management Framework (AI RMF 1.0) as its AI governance standard, which constitutes an affirmative defense under C.R.S. §6-1-1702 and §6-1-1703 of the Colorado AI Act (SB 24-205), effective June 30, 2026.

16.2 Developer Documentation

Upon written request, Suite Enrich will provide deployer documentation per C.R.S. §6-1-1702(2)(b), including: (a) types of data used to train AI components; (b) known limitations and foreseeable risks; (c) known or reasonably foreseeable risk of algorithmic discrimination; (d) measures implemented to mitigate discrimination risk. AI Model Cards for each AI system are available upon written request to support@suiteenrich.com.

16.3 Consequential Decision Prohibition

Customer shall not use AI-generated output from the Service as the sole basis for any "consequential decision" under C.R.S. §6-1-1701(3), including decisions affecting employment, financial services, insurance, housing, healthcare, legal services, or government services. Customer shall ensure meaningful human review of AI-assisted output before making consequential decisions affecting individuals.

16.4 Discrimination Reporting

If Suite Enrich discovers that the Service has caused algorithmic discrimination under C.R.S. §6-1-1701(4), Suite Enrich shall report such discovery to the Colorado Attorney General within 90 days per §6-1-1702(2)(c)(IV) and notify affected Customers of relevant mitigation measures.

17. Contact

For privacy and data protection inquiries, data subject requests, California data broker questions, or DROP deletion requests:

Email: support@suiteenrich.com

Sub-processor List: Available upon written request at support@suiteenrich.com

Security Overview: suiteenrich.com/security

Suite Enrich Co
6153 S Logan Pl
Centennial, CO 80121

Appendix A: Australian Customer Privacy Addendum

Suite Enrich Co

Version 1.0 | April 2026

Scope. This Appendix applies only to Customers located in Australia or using the Service to process personal information about individuals located in Australia. Customers outside Australia may disregard this Appendix.

This Australian Customer Privacy Addendum ("Addendum") supplements the Master Service Agreement ("MSA") and Data Processing Agreement ("DPA") above. Where this Addendum is inconsistent with those documents on matters of Australian privacy law, this Addendum prevails.

By clicking "I Accept," installing the Service, or creating an account, Australian Customers agree to this Addendum as a condition of using the Service to process personal information about Australian individuals.

A1. APP Entity Acknowledgement

Suite Enrich acknowledges that it is an "APP entity" bound by the Privacy Act 1988 (Cth) ("Privacy Act") and the 13 Australian Privacy Principles ("APPs") set out in Schedule 1 to the Privacy Act, by reason of carrying on business in Australia under section 5B(3) of the Privacy Act. Suite Enrich accepts direct APP obligations to Australian individuals in relation to personal information it handles in connection with the Service.

A2. Order of Precedence

This Addendum prevails over the MSA and DPA on matters of Australian privacy law compliance. Nothing in this Addendum or the MSA excludes, restricts, or modifies any right or remedy available to Customer or any individual under the Privacy Act 1988 (Cth), the Australian Consumer Law (Schedule 2 to the Competition and Consumer Act 2010 (Cth)), or any other non-excludable Australian law. Any provision that would otherwise operate as an unfair contract term under Part 2-3 of the Australian Consumer Law is of no force and effect to that extent.

A3. Permitted Use and Purpose Limitation

Suite Enrich processes Australian personal information solely to provide data enrichment services to Customer as described in the MSA. Suite Enrich will not use Australian personal information to train AI models without Customer's prior written consent, aggregate enrichment data across Customer tenants, or retain raw enrichment response payloads beyond the time required to process and return results to Customer.

Customer warrants that all enrichment requests submitted to the Service are for B2B business development purposes only and comply with applicable Australian law, including the APPs.

A4. Sensitive Information Exclusion (APP 3.3)

The Service is designed for B2B professional data enrichment only and does not intentionally retrieve or process sensitive information as defined in the Privacy Act 1988 (Cth), including racial or ethnic origin, health information, political opinions, religious beliefs, union membership, sexual orientation, criminal record, biometric information, or genetic information. Customer warrants that it will not submit enrichment requests designed or likely to return sensitive information about any individual.

A5. Cross-Border Disclosure — APP 8 Reasonable Steps

In providing the Service, Suite Enrich discloses personal information to overseas recipients as described in Schedule A to this Addendum. Before each disclosure, Suite Enrich takes reasonable steps to ensure that overseas recipients do not breach the APPs (other than APP 1) in accordance with APP 8.1 of the Privacy Act.

Contractual safeguards applied by Suite Enrich include: contractual data protection obligations imposed on each overseas recipient materially equivalent to the APPs; contractual obligations binding all downstream service providers engaged by Suite Enrich's data providers; restrictions on use, retention, and onward transfer of personal information; breach notification obligations; and security obligations consistent with Section A6 of this Addendum.

Customer acknowledges that section 16C of the Privacy Act may deem acts of overseas recipients that breach the APPs to be acts of the relevant Australian entity. This Addendum is designed to support Customer's ability to demonstrate "reasonable steps" under APP 8.1.

Suite Enrich will notify Customer prior to engaging any new overseas recipient category not described in Schedule A who will process Australian personal information. Customer may object within 14 days. If the objection cannot be accommodated, either party may terminate this Addendum on 30 days' written notice.

A6. Security Measures (APP 11 and APP 11.3)

Suite Enrich implements and maintains technical and organisational measures ("TOMs") to protect Australian personal information against misuse, interference, loss, and unauthorised access, modification, or disclosure, as required by APP 11 and APP 11.3 of the Privacy Act (APP 11.3 in force from 11 December 2024). Current TOMs include: encryption in transit (TLS 1.2+) and at rest (AES-256); role-based access controls and multi-factor authentication; tenant isolation in multi-tenant cloud environments; network security groups and private endpoints; audit logging and monitoring; API key hashing with no plaintext credential storage; and no long-term retention of raw enrichment response payloads. Suite Enrich's security posture is described at suiteenrich.com/security.

A7. Notifiable Data Breaches — NDB Cooperation

Suite Enrich will notify Customer within 24 to 48 hours of becoming aware of any actual or suspected security incident that may constitute an eligible data breach within the meaning of section 26WE of the Privacy Act affecting Australian personal information processed in connection with the Service. Notification will include, to the extent then known: Suite Enrich's identity and contact details; a description of the actual or suspected incident; the kinds of personal information involved; the actual or potential number of individuals affected; recommendations for steps individuals should take; and Suite Enrich's assessment of whether the incident may constitute an eligible data breach.

Suite Enrich will assist Customer with Customer's assessment under section 26WH of the Privacy Act within the 30-day assessment period; provide draft notification language for use in notifying the OAIC and affected individuals under sections 26WK and 26WL; cooperate with any OAIC inquiry or compliance assessment; and take reasonable steps to contain and remediate the incident. Where an eligible data breach is caused by Suite Enrich's breach of its security obligations, Suite Enrich will bear the reasonable costs of breach notification and remediation attributable to Suite Enrich's breach.

A8. Access and Correction Support (APPs 12 and 13)

Suite Enrich will cooperate with Customer to support access requests (APP 12) and correction requests (APP 13) made by individuals. When Customer notifies Suite Enrich of such a request, Suite Enrich will provide relevant information within 10 business days and make corrections within a reasonable period. Suite Enrich does not retain raw enrichment response payloads in its systems — access requests regarding enriched field values should be directed to Customer's own ERP environment. For personal information held by external data providers as independent data controllers, Suite Enrich will facilitate the request and provide relevant provider contact details within 5 business days.

A9. Source Disclosure Workflow (APP 7.6)

Where an individual requests that Customer disclose the source of personal information held about them that was obtained through the Service, Customer may contact support@suiteenrich.com. Suite Enrich will respond within 5 business days confirming the applicable data provider category and, where relevant, providing contact details for the applicable provider so Customer may direct individuals accordingly.

A10. Direct Marketing Covenants (APP 7 / Spam Act 2003)

Customer warrants that its use of enriched data for direct marketing will comply with: the Spam Act 2003 (Cth), including requirements for express or inferred consent, sender identification, and a functional unsubscribe mechanism; the Do Not Call Register Act 2006 (Cth); and APP 7 of the Privacy Act, including the requirement to allow individuals to opt out of direct marketing and to give effect to opt-out requests within a reasonable period. Customer is responsible for maintaining records of consent and opt-outs required under these laws. Customer indemnifies Suite Enrich against any claims, penalties, or costs arising from Customer's non-compliance.

A11. Deletion and Return on Termination (APP 11.2)

Upon termination or expiry of the MSA or this Addendum, Suite Enrich will delete Australian personal information from Suite Enrich's active systems within 90 days and provide written certification of deletion upon Customer's written request within 30 days. Suite Enrich cannot guarantee deletion of personal information held by external data providers in their capacity as independent data controllers. Individuals wishing to submit deletion requests to Suite Enrich's data providers may contact support@suiteenrich.com and Suite Enrich will provide the relevant provider contact details within 5 business days. Enriched field values written to Customer's own ERP environment are under Customer's control and responsibility following termination.

A12. Australian Law Carve-Out

Notwithstanding the governing law and dispute resolution provisions in Article 17 of the MSA: this Addendum and all matters of Australian privacy law compliance are governed by the laws of the Commonwealth of Australia; nothing in this Addendum or the MSA excludes or limits any right under the Privacy Act 1988 (Cth) or the Australian Consumer Law; any unfair contract term under Part 2-3 of the Australian Consumer Law is of no force and effect; and the arbitration clause in Section 17.3 of the MSA does not apply to Privacy Act or Australian Consumer Law complaints where those laws provide an alternative dispute resolution mechanism. The $100.00 Free/Beta liability cap does not limit Suite Enrich's liability under the Privacy Act 1988 (Cth) to the extent that liability cannot be capped under Australian law.

A13. Acceptance Record

Acceptance of this Addendum by click-through, installation, account creation, or continued use constitutes binding agreement with the same force and effect as a manual signature. Suite Enrich maintains electronic records of Customer's acceptance, including date and time of acceptance, version of this Addendum accepted, and method of acceptance. These records are maintained for the duration of the agreement plus seven years.

A14. OAIC Complaint Pathway

Suite Enrich's privacy contact for Australian customers: support@suiteenrich.com. Suite Enrich will acknowledge privacy complaints within 5 business days and respond within 30 days. If an individual is not satisfied with Suite Enrich's response, they may lodge a complaint with the Office of the Australian Information Commissioner (OAIC): oaic.gov.au | 1300 363 992 | oaic.gov.au/privacy/privacy-complaints. The complaint process is set out in section 36 of the Privacy Act 1988 (Cth).

A15. Statutory Privacy Tort Risk Allocation

A statutory tort for serious invasions of privacy came into force in Australia on 10 June 2025 under the Privacy and Other Legislation Amendment Act 2024 (Cth). Where a claim under this tort arises from Suite Enrich's breach of its obligations under this Addendum or the Privacy Act, Suite Enrich accepts liability to the extent of its breach. Where a claim arises from Customer's use of enriched data in a manner that constitutes a serious invasion of privacy, Customer is solely responsible and shall indemnify Suite Enrich against any related costs, penalties, or damages.

A16. Automated Decision-Making Transparency (from December 2026)

From 10 December 2026, the Privacy Act will require APP entities to include disclosures about automated decision-making ("ADM") processes with significant effects on individuals in their privacy policies. Suite Enrich will, upon Customer's written request from October 2026, provide information reasonably necessary for Customer to assess whether its use of enriched data in automated processes constitutes ADM with significant effects and to update Customer's privacy policy accordingly. Customer is responsible for assessing its own ADM disclosure obligations.

Schedule A: Overseas Recipients and Contractual Safeguards

Suite Enrich discloses personal information to overseas recipients in the following categories and countries. Suite Enrich has contractual data protection obligations in place with each recipient. A full list of overseas recipients and sub-processors, including entity names and specific contractual safeguards, is available upon written request to support@suiteenrich.com. Suite Enrich will respond within 10 business days.

Category	Countries / Regions	Purpose	Contractual Safeguard
Cloud infrastructure and platform services	United States	Core platform processing, API validation, credit management, database, vault secrets	Contractual data protection obligations materially equivalent to the APPs
B2B professional data providers	United States; servers also located in Germany, Finland, Georgia, and Lithuania	Professional and company data enrichment	Executed Data Processing Agreement with obligations equivalent to the APPs; EU-located processing subject to GDPR
AI processing services	United States	AI language model processing for enrichment insight fields	Contractual data protection obligations; no training on Customer data
Payment processing	United States	Subscription billing and payment management	Contractual data protection obligations; PCI-DSS compliant; processes billing data only
Workflow automation	United States	Account creation notifications and customer communications	Contractual data protection obligations; processes notification event data only

Suite Enrich does not transfer Australian personal information to entities in Foreign Adversary Countries as designated under the Protecting Americans’ Data From Foreign Adversaries Act (PADFAA). Personal information transferred to overseas recipients is limited to business-context professional information. Sensitive information is excluded by design. The current sub-processor list is available at any time by emailing support@suiteenrich.com.