Data Processing Addendum

Introduction

This Data Processing Addendum ("DPA") supplements the Terms of Service between InQ Tax Inc., a Missouri corporation ("InQ," "we," "us," or "our"), and the individual or business entity subscribing to or using InQ's software products ("Customer" or "Subscriber").

This DPA establishes the responsibilities of InQ and its Customers concerning the processing, protection, retention, and disclosure of personal information handled through InQ's Services.

This DPA applies to InQ Check-In, InQ Portal, InQ Notices, and other InQ products or services made subject to the Terms of Service.

Where InQ processes Personal Data on behalf of a Customer, this DPA forms part of the agreement between the parties and applies to the extent required by applicable data protection laws or otherwise agreed by the parties.

If a provision of this DPA conflicts with the Terms of Service concerning the processing or protection of Customer Personal Data, this DPA will control with respect to that subject matter, unless a separately executed agreement expressly provides otherwise.

1. Definitions

For purposes of this DPA:

"Applicable Data Protection Laws" means federal, state, and other privacy or data protection laws applicable to the processing of Personal Data under the agreement, including, where applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act, other applicable state privacy laws, the European Union General Data Protection Regulation, and the United Kingdom General Data Protection Regulation.

"Customer" means the subscribing tax preparation business, accounting firm, or other organization that determines the purposes for which its clients' information is collected and used.

"Personal Data" means information relating to an identified or identifiable individual that InQ processes on behalf of a Customer and that is protected under Applicable Data Protection Laws.

"Customer Data" means information, documents, communications, financial records, tax records, and other content submitted to or processed through InQ's Services by or on behalf of a Customer or its authorized users.

"Controller" means the entity that determines the purposes and means of processing Personal Data, as defined under applicable law.

"Processor" means the entity that processes Personal Data on behalf of a Controller, as defined under applicable law.

"Service Provider" means an entity processing personal information for a business under an agreement that meets the requirements of applicable privacy law.

"Processing" means an operation performed on Personal Data, including collecting, receiving, accessing, recording, storing, transmitting, organizing, modifying, retrieving, disclosing, deleting, or otherwise using the information.

"Subprocessor" means a third-party provider engaged by InQ to process Personal Data on InQ's behalf in providing the Services.

"Security Incident" means a confirmed breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to Personal Data processed by InQ on behalf of a Customer.

"Services" means the software applications and related services provided by InQ and covered by the Terms of Service.

2. Roles and Responsibilities

2.1 Customer as Controller

The Customer generally acts as the Controller or business responsible for determining the purposes and means of processing its clients' Personal Data.

The Customer is responsible for:

1. Determining what Personal Data is collected.
2. Establishing lawful purposes for processing the information.
3. Providing required privacy notices.
4. Obtaining and maintaining required authorizations and consents.
5. Establishing and managing user permissions.
6. Responding to applicable requests concerning its clients' information.
7. Complying with laws governing tax preparation, confidentiality, and professional services.

2.2 InQ as Processor

InQ generally acts as a Processor or Service Provider when processing Customer Personal Data for the purpose of delivering the Services.

InQ will process such data only as permitted under this DPA, the Terms of Service, applicable Customer instructions, and applicable law.

2.3 Independent Processing

InQ may separately act as a Controller or business for information collected for its own legitimate operations, including subscription management, billing, customer support, website administration, business communications, and security.

Such processing is governed by InQ's Privacy Policy and applicable law.

3. Authorized Processing of Personal Data

InQ will process Customer Personal Data only for the following purposes:

• Providing and operating the Services purchased or authorized by the Customer.
• Maintaining and securing the Services.
• Performing authorized document storage and transmission.
• Supporting client communications and administrative workflows.
• Facilitating electronic signatures and identity verification.
• Supporting invoicing and payment functionality.
• Responding to authorized technical support requests.
• Maintaining required operational records.
• Complying with applicable legal obligations.
• Carrying out other processing expressly authorized by the Customer and permitted by law.

InQ will not process Customer Personal Data for purposes materially inconsistent with these instructions unless authorized by the Customer or otherwise permitted or required by applicable law.

If InQ reasonably believes that an instruction violates applicable data protection law, InQ may notify the Customer and suspend the affected processing until the issue is resolved.

4. Restrictions on Use and Disclosure

InQ agrees that it will not:

1. Sell Customer Personal Data.
2. Share Customer Personal Data for cross-context behavioral advertising.
3. Use confidential taxpayer information for advertising or unrelated marketing.
4. Use identifiable Customer Personal Data to train third-party general-purpose artificial intelligence models.
5. Disclose Customer Personal Data to unauthorized parties.
6. Retain, use, or disclose Customer Personal Data outside the business relationship except as authorized by law or the agreement.
7. Combine Customer Personal Data with information from other customers or independent sources for prohibited purposes.

These restrictions are subject to exceptions expressly permitted under applicable law, including permitted security, fraud prevention, service operations, and other authorized processing.

InQ may use aggregated or appropriately de-identified operational information for legitimate service analysis and improvement, provided that the information is processed in accordance with applicable laws and cannot reasonably be used to identify a taxpayer or reconstruct confidential taxpayer information.

InQ will not attempt to reidentify information that has been de-identified for purposes governed by statutory restrictions, except as legally permitted for verification of de-identification processes.

5. Customer Authorization and Consent

The Customer represents that it has the legal authority to provide Personal Data to InQ and to authorize the processing required to deliver the Services.

The Customer is responsible for determining whether consent or other authorization is required under:

• Internal Revenue Code Section 7216 and its implementing regulations.
• Applicable federal and state taxpayer confidentiality laws.
• Applicable privacy and data protection laws.
• Professional confidentiality requirements.
• Laws governing electronic communications and signatures.

Where consent is required, the Customer must obtain and maintain legally sufficient consent before the relevant disclosure or processing occurs.

The Customer must notify InQ when a valid withdrawal of consent or other restriction requires a change to InQ's processing activities.

InQ remains responsible for compliance with legal requirements directly applicable to InQ in its role as a Processor, Service Provider, or person otherwise subject to taxpayer confidentiality laws.

Nothing in this DPA authorizes a use or disclosure prohibited by law.

6. Confidentiality

InQ will treat Customer Personal Data as confidential information.

Access to Customer Personal Data will be limited to personnel and authorized service providers who reasonably require access to perform their responsibilities.

Personnel permitted to access Customer Personal Data will be subject to appropriate confidentiality obligations.

InQ will not disclose Customer Personal Data except:

• As necessary to perform the Services.
• As authorized by the Customer.
• To authorized Subprocessors or service providers.
• As required or permitted by applicable law.
• As otherwise expressly permitted by the agreement.

Confidentiality obligations will continue following termination for as long as the information remains protected by applicable confidentiality requirements.

7. Information Security

InQ will implement and maintain reasonable administrative, technical, and organizational security measures designed to protect Customer Personal Data.

Such measures will be appropriate to the nature and sensitivity of the information processed and applicable legal requirements.

Security controls may include:

• Encryption for data transmitted through the Services.
• Authentication and session management controls.
• User access permissions.
• Restrictions on administrative access.
• Application and server security controls.
• Security updates and vulnerability remediation.
• Backup and recovery measures.
• Monitoring and investigation of suspicious activity.
• Protection against unauthorized disclosure, alteration, or deletion.

InQ will periodically evaluate and improve its security practices as appropriate.

The Customer acknowledges that no electronic system or internet transmission can be guaranteed completely secure.

InQ's obligations under this section do not relieve the Customer of responsibility for securing its own devices, networks, credentials, personnel, and access permissions.

8. Subprocessors and Third-Party Providers

8.1 Authorization

The Customer authorizes InQ to engage Subprocessors reasonably necessary to provide and maintain the Services, subject to applicable legal and contractual requirements.

InQ will take appropriate steps to ensure that Subprocessors processing Customer Personal Data on InQ's behalf are subject to confidentiality, security, and data protection obligations appropriate to their activities.

8.2 Current Service Providers

InQ uses the following identified providers for specified functions:

Stripe — Payment Processing

Stripe processes subscription payments and facilitates payment transactions between subscribing firms and their clients.

Stripe may receive payment details, billing information, transaction information, and other information necessary to process authorized payments.

The allocation of responsibility between InQ, Stripe, the Customer, and any connected payment accounts is governed by the applicable Stripe agreements and legal requirements.

BoldSign — Electronic Signatures and Identity Verification

BoldSign provides knowledge-based authentication functionality for electronic signatures associated with IRS Form 8879.

BoldSign and its authorized verification providers may process identifying information, authentication data, verification results, and related transaction records.

Infrastructure and Supporting Providers

InQ may also engage providers for application hosting, infrastructure, email delivery, security, and other essential operations.

A current list of material Subprocessors may be maintained separately and made available to Customers.

8.3 Changes to Subprocessors

InQ may add, replace, or discontinue Subprocessors as its operations develop.

Where required by applicable law or contract, InQ will provide notice of material changes and any legally required opportunity to object.

An objection must be based on reasonable data protection concerns. The parties will attempt in good faith to resolve such concerns.

8.4 Responsibility

InQ remains responsible for fulfilling its applicable obligations under this DPA when engaging Subprocessors.

Independent processing activities undertaken by payment processors or other third parties acting as separate Controllers are governed by the applicable agreements and laws.

9. U.S. Data Hosting and International Transfers

InQ Tax Inc. is headquartered and operated in the United States.

InQ's primary hosted application infrastructure and servers are located within the United States.

Certain third-party service providers may process information in additional jurisdictions according to their service arrangements.

InQ will not intentionally transfer Customer Personal Data internationally in a manner that violates applicable law or the Customer's documented, legally binding restrictions.

Where the processing of Personal Data involves a transfer requiring specific legal safeguards, the parties will implement an appropriate lawful transfer mechanism.

If required, such safeguards may include applicable Standard Contractual Clauses or other legally recognized transfer arrangements.

No particular international data transfer mechanism is incorporated by this DPA unless it is applicable and appropriately completed or executed.

10. Data Subject Rights and Requests

The Customer is generally responsible for responding to requests from individuals concerning Personal Data that the Customer controls.

These requests may include access, correction, deletion, portability, restriction, or other rights provided by applicable law.

If InQ receives a request involving Personal Data processed on behalf of a Customer, InQ may refer the request to the Customer or notify the Customer, subject to applicable law.

InQ will provide reasonable assistance, taking into account the nature of the processing and the functionality of the Services, to help the Customer fulfill legally required requests.

InQ may verify the identity or authority of a requester before disclosing information.

InQ is not required to disclose Customer-controlled information directly to an individual where doing so would violate the Customer's lawful instructions or applicable confidentiality obligations.

Requests concerning information independently controlled by InQ will be handled under InQ's Privacy Policy and applicable law.

11. Security Incident Management

11.1 Investigation and Containment

InQ will investigate suspected Security Incidents involving Customer Personal Data and take reasonable steps to contain, assess, and remediate confirmed incidents.

11.2 Customer Notification

InQ will notify affected Customers without undue delay after becoming aware of a confirmed Security Incident involving Personal Data processed on their behalf.

Where required by applicable law, notification will occur within the legally mandated timeframe.

Subject to the availability of relevant information, InQ will endeavor to provide initial notice within 72 hours of confirming a Security Incident and will supply additional information as it becomes available.

11.3 Information Provided

Where reasonably available and appropriate, incident notifications may describe:

• The general nature of the incident.
• Categories of information potentially affected.
• Relevant dates and circumstances.
• Known or reasonably anticipated consequences.
• Measures taken to contain or remediate the incident.
• Recommended protective actions, if applicable.
• Available contact information for follow-up inquiries.

An initial notification may be incomplete while an investigation remains ongoing.

11.4 Cooperation

InQ and the Customer will reasonably cooperate to investigate Security Incidents, assess legal obligations, and determine appropriate remedial actions.

Each party remains responsible for notifications to individuals, regulators, or other authorities required by law in connection with its respective role.

Except where legally required or otherwise authorized, InQ will coordinate with the affected Customer before making disclosures identifying that Customer or its affected clients.

12. Customer Security Responsibilities

Customers are responsible for maintaining reasonable safeguards within their own organizations.

These responsibilities include:

• Protecting login credentials.
• Managing user accounts and permissions.
• Removing access when employees or contractors leave.
• Maintaining secure devices and networks.
• Training personnel on appropriate data handling.
• Protecting downloaded or exported information.
• Preventing unauthorized disclosures.
• Reviewing their configurations and automated communications.
• Reporting suspected unauthorized account activity.

InQ is not responsible for security failures caused solely by a Customer's systems or activities, except to the extent InQ is independently responsible under applicable law or the agreement.

13. Data Accuracy and Integrity

Customers are responsible for the accuracy, completeness, and legality of Personal Data submitted to the Services.

InQ will process information according to the Services' functionality and the Customer's authorized instructions.

InQ does not independently verify the accuracy of taxpayer information, tax returns, documents, or professional records supplied by Customers or their clients.

InQ will take reasonable measures appropriate to its role to protect Customer Personal Data against unauthorized alteration or corruption.

14. Data Retention and Deletion

14.1 Retention During Service

InQ will retain Customer Personal Data as reasonably necessary to deliver the Services, subject to applicable retention policies, legal requirements, and contractual obligations.

14.2 Historical Communications

Certain InQ Portal communication records may be retained for periods of up to ten years under applicable system functionality and retention practices.

This does not necessarily establish a uniform retention period for every category of Customer Personal Data.

14.3 Termination

Following termination or expiration of the Customer's Subscription, InQ may restrict access to the Services and Customer Data.

Where reasonably available and legally permissible, InQ may provide an opportunity for the Customer to retrieve or export information before permanent deletion.

14.4 Deletion

InQ will delete, return, or appropriately de-identify Customer Personal Data in accordance with applicable law, documented retention practices, and the parties' agreements.

Information may be retained where reasonably necessary to satisfy legal obligations, resolve disputes, maintain security records, or comply with valid preservation requirements.

14.5 Backups

Personal Data deleted from active systems may remain in backup or archived systems for a limited period according to applicable backup retention and recovery procedures.

Any retained information remains subject to the confidentiality and security obligations of this DPA.

15. Assistance with Compliance

To the extent required by applicable law and reasonably feasible in light of the Services, InQ will assist Customers in meeting their data protection obligations.

Assistance may relate to:

• Responding to applicable privacy requests.
• Investigating Security Incidents.
• Providing relevant security information.
• Supporting legally required data protection assessments.
• Explaining the nature and purposes of InQ's processing activities.
• Identifying relevant Subprocessors.
• Facilitating authorized deletion or return of data.

Requests requiring substantial custom development, extraordinary technical work, or extensive administrative assistance may be subject to reasonable fees where permitted by applicable law and agreed upon by the parties.

16. Compliance Information and Audits

InQ will maintain information reasonably necessary to demonstrate compliance with its applicable data protection obligations.

Upon reasonable written request, and subject to appropriate confidentiality and security restrictions, InQ may provide available documentation concerning its security practices, processing activities, or applicable independent assessments.

InQ may satisfy certain requests through written security questionnaires, policy summaries, available audit reports, or other appropriate documentation.

Nothing in this DPA requires InQ to disclose proprietary source code, credentials, confidential information belonging to other customers, or information that would compromise system security.

Any inspection or audit right mandated by applicable law will be honored subject to reasonable safeguards concerning scope, confidentiality, security, timing, and operational disruption.

This DPA does not independently establish a commitment to annual third-party security audits or a particular certification.

17. Government and Legal Requests

If InQ receives a legally enforceable request for Customer Personal Data, it may disclose information to the extent legally required.

Where permitted by law and reasonably appropriate, InQ will notify the affected Customer before disclosure so that the Customer may seek available legal protections.

InQ may challenge or seek clarification of requests that appear facially invalid, excessive, or inconsistent with applicable law.

Nothing in this DPA requires InQ to violate a lawful order or disclose information prohibited by law.

18. Artificial Intelligence

InQ does not currently integrate artificial intelligence services or large language models into its production customer-facing software.

InQ may use AI-assisted tools internally for software development, programming, and testing.

Such internal development activity is separate from the processing of Customer Personal Data through the production Services.

InQ will not submit identifiable Customer tax returns, taxpayer identification numbers, or other confidential Customer records to third-party general-purpose AI systems for model training as part of the current Services.

Any future AI functionality involving Customer Personal Data will be evaluated under applicable legal requirements, and this DPA will be updated where necessary before implementing materially different processing activities.

19. Liability and Indemnification

The liability of each party under this DPA will be governed by the applicable limitations and remedies established in the Terms of Service, except where applicable law or a separately executed agreement requires otherwise.

Each party remains responsible for its own violations of Applicable Data Protection Laws.

The Customer is responsible for consequences arising from unlawful instructions, unauthorized disclosures it directs, or failure to obtain legally required consents, to the extent permitted by applicable law.

InQ remains responsible for its own processing activities, security obligations, and compliance requirements to the extent imposed by applicable law and the agreement.

Nothing in this DPA excludes liability that cannot legally be excluded or limited.

20. Duration and Termination

This DPA becomes effective when incorporated into the agreement between InQ and the Customer.

It remains in effect for as long as InQ processes Customer Personal Data under the agreement.

Termination of the Services does not eliminate confidentiality, data protection, or other obligations that continue to apply to retained Personal Data.

Provisions concerning confidentiality, data retention, deletion, legal compliance, liability, and other obligations intended to survive termination will remain effective to the extent applicable.

21. Changes to This DPA

InQ may update this DPA to reflect changes in Applicable Data Protection Laws, processing activities, service providers, security practices, or the Services.

Material changes affecting Customer rights or obligations will be communicated through reasonable means, such as email, account notifications, or website announcements.

Where applicable law requires additional authorization, agreement, or advance notice, InQ will comply with those requirements.

The current version will be available through the InQ website.

22. General Provisions

Governing Law. Except where mandatory data protection law requires otherwise, this DPA will be governed by the governing-law provisions of the Terms of Service.

Severability. If a provision is held unenforceable, the remainder will continue in effect to the extent permitted by law.

Order of Precedence. Mandatory applicable law controls where it conflicts with this DPA. Subject to that rule, this DPA controls over conflicting general Terms of Service provisions concerning Customer Personal Data processing.

Entire Agreement. This DPA, the Terms of Service, any applicable subscription agreement, and any additional written data protection terms constitute the relevant agreement between the parties regarding Customer Personal Data processing.

23. Contact Information

Questions regarding this DPA may be directed to:

Schedule A — Details of Personal Data Processing

This Schedule describes the processing activities performed by InQ on behalf of its Customers.

A.1 Subject Matter

Provision of hosted software for tax and accounting professionals, including client intake, workflow management, communications, document exchange, electronic signatures, payments, and tax notice management.

A.2 Duration

Processing continues during the applicable Subscription and any additional retention period permitted or required under the agreement or applicable law.

A.3 Nature of Processing

Activities may include collection, receipt, storage, organization, retrieval, transmission, display, modification, deletion, and other operations necessary to provide the Services.

A.4 Purposes

The purposes are to provide and maintain the Services, support authorized Customer workflows, protect system security, facilitate requested transactions, and fulfill applicable contractual and legal obligations.

A.5 Categories of Data Subjects

• Individual taxpayers.
• Spouses and dependents.
• Business owners and representatives.
• Employees of subscribing firms.
• Contractors and other authorized users.
• Clients and prospective clients of subscribing firms.
• Other individuals whose information is lawfully submitted through the Services.

A.6 Categories of Personal Data

• Identification and contact information.
• Social Security numbers and taxpayer identification numbers.
• Dates of birth.
• Tax return information.
• Employment and income information.
• Business and financial records.
• Banking and payment-related information.
• Tax notices and government correspondence.
• Uploaded documents and communications.
• Electronic signature and identity verification information.
• Account, authentication, and technical activity information.

A.7 Processing Location

Primary InQ application hosting is located within the United States.

Other processing locations may apply to individual authorized third-party service providers, subject to their contractual arrangements and applicable legal requirements.

A.8 Controller Responsibilities

The Customer determines lawful processing purposes, manages authorized access, provides required notices, obtains applicable consents, and fulfills its professional and legal obligations.

A.9 Processor Responsibilities

InQ processes Customer Personal Data for authorized purposes, maintains appropriate safeguards, assists with applicable compliance requirements, and manages its processing activities in accordance with this DPA.

Schedule B — Technical and Organizational Security Measures

The following describes the categories of safeguards applicable to InQ's processing of Customer Personal Data.

Specific technical implementations may vary as systems and security practices evolve.

B.1 Access Control

Measures designed to limit access to authorized users and personnel, including authentication, account permissions, and administrative access restrictions.

B.2 Transmission Security

Use of encrypted connections for communications between supported applications and their users.

B.3 Application and Infrastructure Security

Maintenance of application and hosting controls, security updates, vulnerability remediation practices, and protective configurations.

B.4 Operational Monitoring

Monitoring and review of relevant technical and security information to identify operational issues or potentially unauthorized activity.

B.5 Backup and Recovery

Backup and recovery practices intended to support business continuity and restoration of information following certain failures.

B.6 Confidentiality

Restrictions on personnel and service-provider access to Customer Personal Data, together with applicable confidentiality requirements.

B.7 Incident Response

Procedures to identify, investigate, contain, remediate, and provide legally required notifications concerning Security Incidents.

B.8 Security Maintenance

Periodic review and improvement of safeguards appropriate to the sensitivity of the information handled and the risks associated with the Services.

Schedule C — Identified Service Providers

The following providers are known to support specified InQ functions.

This schedule does not establish that every provider acts as a Subprocessor for every processing activity. The applicable role depends on the service, data involved, and contractual arrangement.

InQ will update this schedule when it adds or replaces a provider that processes Customer Personal Data.