Data Processing Addendum

This addendum forms part of the agreement between Common Ridge LLC ("Processor") and the fund manager ("Controller") for Common Ridge. It applies to personal data that the Processor processes on the Controller's behalf.

1. Subject matter and duration

The Processor processes personal data to provide the service for as long as the agreement lasts, and for the period needed to return or delete it.

2. Nature and purpose

Hosting, storing, displaying, transmitting, calculating, generating documents from and delivering personal data of the Controller's investors, prospects, staff and their representatives, in order to provide the service.

3. Categories of data and of data subjects

Data subjects: the Controller's investors and their beneficial owners, signatories and delegates, and the Controller's staff. Data: identity and contact information, tax identification numbers, bank details, accreditation and verification information, financial positions and transactions, documents, signatures and activity records.

4. Instructions

The Processor will process personal data only on the Controller's documented instructions, which are this addendum, the agreement and the Controller's use of the service. If the Processor believes an instruction breaches the law, it will tell the Controller.

5. Confidentiality

People who process personal data for the Processor are bound by confidentiality obligations.

6. Security

The Processor maintains the measures described on its trust page, including encryption in transit and at rest, field-level encryption of sensitive data, tenant isolation, access controls, multi-factor authentication for staff, audit logging, malware scanning of uploads, backups and a tested recovery process.

7. Subprocessors

The Controller gives general authorization for the subprocessors listed on the Subprocessors page. The Processor will give notice of additions or replacements before they take effect so that the Controller may object on reasonable grounds. The Processor remains responsible for its subprocessors and binds them to terms no less protective than these. [Counsel to confirm: notice period.]

8. Assistance

The Processor will, taking into account the nature of the processing, help the Controller respond to requests from data subjects, and with security, breach notification, impact assessments and consultations, where the information is available to the Processor.

9. Personal data breach

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and provide information the Controller reasonably needs. [Counsel to confirm: a fixed notice period.]

10. Return and deletion

At the Controller's choice, the Processor will return the personal data by export or delete it when the agreement ends. Deletion occurs after 30 days. The Processor keeps financial and audit records for seven years where required, with personal information made unreadable by destroying the encryption key.

11. Audit

The Processor will make available information reasonably needed to show compliance with this addendum, including its security documentation, and will allow reasonable audits on notice. [Counsel to confirm: frequency, scope and cost.]

12. Data location

Customer data is stored in the United States. [Counsel to confirm: international transfer mechanism, where any apply.]

13. Order of precedence

If this addendum conflicts with the agreement on the processing of personal data, this addendum applies.