Cortex

Cortex / Legal

Data Processing Addendum

The addendum governing the privacy, confidentiality, and security of Personal Information associated with Services rendered by Chaos Labs.

DATA PROCESSING ADDENDUM

Last Updated: October 9, 2026

This Data Processing Addendum (“Addendum”) is incorporated into the Agreement(s) (as defined below) between Chaos Labs and Client. This Addendum sets forth the terms and conditions relating to the privacy, confidentiality and security of Personal Information (as defined below) associated with Services to be rendered by Chaos Labs to Client pursuant to the Agreement.

  1. Definitions
    1. “Agreement” means the contract under which Chaos Labs has agreed to provide the applicable Services to Client.
    2. “Authorized User” means an employee or contractor of Client who is authorized by Client to access and use the Services on behalf of and for the benefit of Client.
    3. “Client Data” means information provided or made available by Client to Chaos Labs for Processing on Client’s behalf to perform the Services. Client Data does not include Service Data.
    4. “Data Subject” means the identified or identifiable natural person to whom Personal Information pertains.
    5. “Personal Information” means Client Data that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, that is Processed by Chaos Labs in connection with the performance of the Agreement.
    6. “Privacy Laws” means all applicable laws, rules, regulations, and governmental requirements relating to the privacy, confidentiality or security of Personal Information, including without limitation and where applicable, the California Consumer Privacy Act of 2018 and California Privacy Rights Act of 2020, Cal. Civ. Code § 1798.100 et seq. (collectively, “CCPA”) and similar U.S. state privacy laws.
    7. “Service Data” means any data relating to the use, support and/or operation of the Services, which is collected by Chaos Labs from and/or about Authorized Users of the Services and/or Client’s use of the Services for use for Chaos Labs’ own purposes. Service Data may include personal information of Client’s business representatives.
    8. “Subprocessor” means a third party that Chaos Labs engages to Process Personal Information in relation to the Services.
    9. “Aggregate,” “Business Purpose,” “Deidentify,” “Process,” “Processor,” “Sell,” and “Service Provider” have the meaning ascribed to each such term under Privacy Laws.

    All capitalized terms used but not defined herein have the meaning ascribed to them in the Agreement.

  2. Chaos Labs Processing Obligations
    1. The parties acknowledge and agree that Chaos Labs is acting as a Service Provider and Processor to Client with respect to Personal Information.
    2. Subject to applicable Privacy Laws, Chaos Labs will Process Personal Information in accordance with Client’s instructions. Unless otherwise agreed to in writing by Chaos Labs, the Agreement (including this Addendum) sets out the exclusive and final instructions to Chaos Labs for all Processing of Personal Information. The parties acknowledge and agree that the (i) the details of Chaos Labs’ Processing of Personal Information are as described in Schedule 1 to this Addendum; and (ii) Personal Information is provided to Chaos Labs only for limited and specified Business Purposes.
    3. Chaos Labs will ensure that any Chaos Labs personnel who Process Personal Information are subject to a duty of confidentiality with respect to the Personal Information.
    4. To the extent the CCPA is applicable to Chaos Labs’ Processing of Personal Information, except as described in Section II(F) below or where permitted by applicable law, Chaos Labs will not (i) Sell Personal Information or share Personal Information for cross-contextual behavioral advertising purposes; (ii) retain, use or disclose Personal Information (1) for any purpose other than for the Business Purposes specified in Schedule 1 of this Addendum, or (2) outside of the direct business relationship between Client and Chaos Labs; or (iii) combine Personal Information received pursuant to the Agreement with Personal Information received from or on behalf of another person(s), or collected from Chaos Labs’ own interaction with individuals. Chaos Labs certifies that it understands and will comply with the restrictions set forth in clauses (i)-(iii) above. Client may take reasonable and appropriate steps to ensure that Chaos Labs uses Personal Information in a manner consistent with Client’s obligations under the CCPA. Client may, upon reasonable notice to Chaos Labs and where permitted by the CCPA, take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Information.
    5. To the extent required by applicable Privacy Laws, Chaos Labs will, taking into account the nature of the Processing of Personal Information and the information available to Chaos Labs, reasonably assist Client in fulfilling Client’s obligations under applicable Privacy Laws, including by assisting Client, where appropriate, in responding to Data Subject rights requests pursuant to Privacy Laws and conducting privacy impact assessments related to Chaos Labs’ Processing of Personal Information.
    6. To the extent permitted by applicable Privacy Laws, Chaos Labs may use, retain and otherwise Process Personal Information obtained in the course of providing the Services: (i) for internal use by Chaos Labs to build or improve the quality of its services, provided that Chaos Labs does not use the Personal Information to perform services on behalf of another person; (ii) to prevent, detect, or investigate data security incidents or protect against malicious, deceptive, fraudulent or illegal activity; (iii) to comply with applicable laws; (iv) to comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by government authorities; (v) to cooperate with law enforcement agencies concerning conduct or activity that Chaos Labs reasonably and in good faith believes may violate federal, state, or local law; and (vi) to exercise or defend legal claims.
    7. Chaos Labs may, as part of providing the Services, Deidentify or Aggregate Personal Information in accordance with the standards for such activity set forth in applicable Privacy Laws. For the avoidance of doubt, such Deidentified or Aggregated data, whichever the case may be, will not be subject to the requirements and restrictions set forth in this Addendum. If Chaos Labs Deidentifies Personal Information, or receives Deidentified data from Client, Chaos Labs must (i) take reasonable measures to ensure that such Deidentified data cannot be associated with an individual or household; (ii) publicly commit to maintain and use the data in Deidentified form and to not attempt to re-identify the data; and (iii) contractually obligate any recipients of the Deidentified data to comply with the terms of this Section II(G) and applicable Privacy Laws.
    8. Upon termination of the Services, and at Client’s written direction, Chaos Labs will, to the extent technically possible in the circumstances, either return to Client or delete (or Deidentify) Personal Information within Chaos Labs’ possession. If Client has not provided written direction regarding the return or deletion of Personal Information within sixty (60) days following the termination or expiration of the Services, Chaos Labs will, following this sixty (60)-day period, delete (or Deidentify) Personal Information in its possession in accordance with Chaos Labs’ standard data retention and deletion practices, unless retention is required or permitted by the Agreement or applicable law. Notwithstanding the above, Chaos Labs may retain Personal Information where required or permitted by the Agreement (including this Addendum) or applicable law, provided that Chaos Labs will continue to protect the privacy, confidentiality and security of such Personal Information in accordance with the terms of this Addendum.
  3. Client Processing Obligations
    1. Client will ensure (and is solely responsible for ensuring) that it has given such notices to and obtained such consents and permissions from third parties (including, without limitation, Data Subjects), and has all rights, in each case, as may be required under applicable law or otherwise for Chaos Labs to Process Personal Information as contemplated by the Agreement.
  4. Compliance with Privacy Laws
    1. Each party will comply with relevant obligations applicable to each party under Privacy Laws and provide the level of privacy protection for Personal Information as is required by applicable Privacy Laws.
    2. To the extent required by applicable Privacy Laws, Chaos Labs will notify Client if Chaos Labs makes a determination that it can no longer meet its obligations under Privacy Laws.
  5. Subprocessors
    1. Where Chaos Labs engages a Subprocessor, Chaos Labs will enter into a written agreement with the Subprocessor that requires the Subprocessor to comply with obligations that are similar in all material respects to those imposed on Chaos Labs under this Addendum.
    2. Information about Subprocessors is available at https://app.vanta.com/chaoslabs.xyz/trust/fovzmjzfw9mobdf20n8ut (“Subprocessor Site”). When Chaos Labs engages any new Subprocessor after the effective date of the Agreement, Chaos Labs will notify Client of the engagement by updating the Subprocessor Site. If Client objects to such engagement in a written notice to Chaos Labs within 15 days after being informed of the engagement on reasonable grounds relating to the protection of Personal Information, Client and Chaos Labs will work together in good faith to find a mutually acceptable resolution to address such objection. If the parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, Client may, as its sole and exclusive remedy, terminate the Agreement and cancel the Services by providing written notice to Chaos Labs and pay Chaos Labs for all amounts due and owing under the Agreement as of the date of such termination.
  6. Security
    1. Chaos Labs will implement and maintain technical, physical and organizational measures that are appropriate to the risk of the Processing and that are designed to protect the confidentiality, integrity and accessibility of Personal Information, including those measures described in Schedule 2 (the “Security Measures”). Chaos Labs may update the Security Measures from time to time, so long as the updated measures do not materially decrease the overall protection of Personal Information.
    2. Client agrees that Client is solely responsible for its use of the Services, including (1) making appropriate use of the Services to ensure a level of security appropriate to the risk with respect to Personal Information; (2) securing account authentication credentials, systems and devices Client uses to access the Services; (3) securing Client’s systems and devices that Chaos Labs uses to provide the Services; and (4) backing up Personal Information. Client has determined that the Services, the Security Measures and Chaos Labs’ commitments under this Addendum are adequate to meet Client’s needs, including with respect to any security obligations of Client under Privacy Laws, and provide a level of security appropriate to the risk with respect to the Processing of Personal Information.
    3. Chaos Labs will notify Client without undue delay upon becoming aware of unauthorized access to, or acquisition or disclosure of, Personal Information in Chaos Labs’ possession that compromises the security, confidentiality or integrity of such Personal Information.
  7. Assessments
    1. Upon Client’s request, Chaos Labs will make available to Client information in its possession necessary to demonstrate Chaos Labs’ compliance with its obligations under applicable Privacy Laws and this Addendum.
    2. Chaos Labs will arrange for an annual assessment by a qualified independent assessor of Chaos Labs’ choosing of Chaos Labs’ policies and technical and organizational measures in support of relevant obligations under applicable Privacy Laws using an appropriate and accepted control standard or framework and assessment procedure for such assessment, and provide a report of such assessment to Client upon request.
  8. Service Data
    1. Client acknowledges that Chaos Labs may Process Service Data for its own purposes, as permitted by applicable law, and that Chaos Labs independently determines the purposes and means of such Processing. Chaos Labs will Process Service Data (i) in compliance with Privacy Laws (if and as applicable in the context); and (ii) as described in Chaos Labs’ relevant privacy statements, as updated from time to time.
  9. Miscellaneous.
    1. Chaos Labs reserves the right to update this Addendum from time to time to comply with Privacy Laws or applicable contractual obligations, effective upon written notice to Client; provided, however, that no such update will materially diminish the privacy or security of Personal Information.
    2. This Addendum supersedes any prior oral or written agreement, including the Agreement, between the Parties concerning the Processing of Personal Information by Chaos Labs as contemplated under this Addendum; in case of any conflict between this Addendum and the Agreement regarding the Processing by Personal Information by Chaos Labs, this Addendum will prevail.
    3. Any notices required or permitted to be given by Chaos Labs to Client under this Addendum may be given (i) in accordance with any notice clause of the Agreement; (ii) to Chaos Labs’ primary points of contact with Client; or (iii) to any email provided by Client for the purpose of providing it with Services-related communications or alerts. Client is solely responsible for ensuring that such email addresses are valid.
  10. Limitation of Liability.
    1. THE TOTAL AGGREGATE LIABILITY OF EITHER PARTY TOWARDS THE OTHER PARTY, HOWSOEVER ARISING, UNDER OR IN CONNECTION WITH THIS ADDENDUM WILL UNDER NO CIRCUMSTANCES EXCEED ANY LIMITATIONS OR CAPS ON, AND WILL BE SUBJECT TO ANY EXCLUSIONS OF, LIABILITY AND LOSS AGREED BY THE PARTIES IN THE AGREEMENT.

Schedule 1: Details of the Personal Information Processing

This Schedule 1 forms part of the Addendum between Client and Chaos Labs.

Nature, purpose and duration of the Processing of Personal Information:

Chaos Labs Processes Personal Information on behalf of Client for the purpose of providing the Services under the Agreement, which includes the purposes described in Section II(F) of this Addendum.

For purposes of the CCPA, Chaos Labs will Process Personal Information for the following Business Purposes: (i) performing the Services on behalf of Client, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying information, providing analytic services, providing storage, or providing similar services on behalf of Client; (ii) helping to ensure security and integrity; (iii) debugging to identify and repair errors that impair existing intended functionality; (iv) short-term, transient use; and (v) undertaking internal research for technological development and demonstration; and (vi) undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by Client, and to improve, upgrade, or enhance such service or device.

The duration of the Processing is equal to the duration of the Agreement plus the period necessary to fulfill the purposes of the Processing and to comply with applicable legal requirements.

The Processing concerns the following categories of Personal Information:

Personal information that is transmitted through or generated by systems, applications and tools that Client integrates with the Services.

List of subcontractors:

Chaos Labs has engaged the Subprocessors listed in the Subprocessor Site, available at https://app.vanta.com/chaoslabs.xyz/trust/fovzmjzfw9mobdf20n8ut.

Schedule 2: Security Measures

  1. Organizational management and dedicated staff responsible for the development, implementation and maintenance of Chaos Labs’ information security program.
  2. Audit and risk assessment procedures for the purposes of periodic review and assessment of risks to Chaos Labs’ organization, and monitoring and maintaining compliance with Chaos Labs’ policies and procedures.
  3. Data security controls which include logical segregation of Personal Information and utilization of commercially available industry standard encryption technologies for Personal Information at rest or in transmission over public networks (i.e., the Internet) or wirelessly.
  4. Logical access controls designed to manage electronic access to Personal Information based on least privilege.
  5. Authentication controls, including measures designed to manage and control password strength, expiration and usage.
  6. System audit or event logging and related monitoring procedures to record activity of systems that Process Personal Information.
  7. Personnel security measures, including background checks for relevant personnel (where permitted by applicable law) and periodic security awareness training.
  8. Vendor management procedures, including due diligence processes, for assessing the security practices of Subprocessors and other relevant vendors.
  9. Operational procedures and controls to provide for configuration, monitoring and maintenance of systems that Process Personal Information.
  10. Change management procedures and tracking mechanisms designed to test, approve and monitor material changes to Chaos Labs’ systems that Process Personal Information.
  11. Incident management and business continuity procedures designed to enable Chaos Labs to investigate, respond to, mitigate and recover from relevant security events.
  12. Network security controls that provide for network segmentation and threat detection, including the use of enterprise firewalls and intrusion detection systems.
  13. Vulnerability assessment, patch management and threat protection measures designed to identify, assess, mitigate and protect against identified security threats, including penetration testing, code reviews, and vulnerability scanning.