Taxscribe Data Processing Addendum

Last updated September 16, 2026

Preamble

This Data Processing Addendum (the "DPA") is entered into between Reason Consulting Corporation, a North Carolina corporation with its principal office at 2820 Selwyn Ave, STE 856, Charlotte, NC 28209, United States ("Reason," referred to in the Terms as "Company," and acting under this DPA as "Service Provider"), and the Customer that holds a Taxscribe account or has subscribed to the Taxscribe Services made available at https://www.taxscribe.com, whether a government entity using Taxscribe Gov or a business or professional firm using Taxscribe Pro ("Customer," acting under this DPA as the entity that controls Customer Data and, where Customer is a government entity, as its record custodian). Reason and Customer are each a "party" and together the "parties" to this DPA.

This DPA forms part of the Taxscribe Terms and Conditions (the "Terms") and of any Ordering Document between Customer and Reason, and it governs Reason's processing of Customer Data in connection with the Services. Capitalized terms used but not defined in this DPA have the meanings given to them in the Terms.

This DPA applies to all Customer Data submitted to the Services under any Taxscribe account, subscription, or Ordering Document from the moment it is submitted, whether this DPA is executed as part of that Ordering Document or is incorporated by reference through the Terms as a posted policy. Trial and evaluation users must not submit Confidential Tax Information unless a signed evaluation agreement or Ordering Document provides for it, and Section 8 of the Terms alone governs data submitted during trial or evaluation access. This DPA supplements, and does not replace, Section 8 of the Terms.

Order of precedence. In the event of a conflict among the documents governing the Services, the following order of precedence applies: (1) a signed written agreement or accepted Ordering Document between Customer and Reason, including any Data Processing Addendum executed as part of it; (2) the Terms and Conditions; (3) the End User License Agreement; and (4) the Acceptable Use Policy, the Data Processing Addendum where not executed as part of an Ordering Document, and Reason's other posted policies, including the Privacy Policy, Cookie Policy, Disclaimer, Security Overview, and Accessibility Statement. Where this DPA is executed as part of an Ordering Document, it ranks with the Ordering Document at the first level of that ladder. Where this DPA is not so executed, it ranks with the posted policies at the fourth level, except that the specific data-protection terms of this DPA control over general provisions of the other posted policies on the same subject.

1. Definitions

1.1 "Customer Data" has the meaning given in Section 8 of the Terms.

1.2 "Personal Information" means any information within Customer Data that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, including names, addresses, taxpayer and business owner identifiers, contact details, account and property identifiers, and information about an individual's income, property, business activity, or tax status.

1.3 "Confidential Tax Information" means tax returns, return information, tax listings, filings, schedules, assessment records, and related taxpayer and business information within Customer Data that is confidential under the revenue, property tax, or assessment statutes of Customer's state or of a jurisdiction to which Customer directs filings, or under other law applicable to Customer and, where applicable, federal tax information subject to 26 U.S.C. 6103 and the safeguarding requirements that accompany it.

1.4 "Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to Customer Data in Reason's possession or control or in the possession or control of a Subprocessor. A Security Incident does not include an unsuccessful attempt or activity that does not compromise the security of Customer Data, such as a blocked intrusion attempt, a port scan, a denial-of-service attack that does not result in unauthorized access, or an unsuccessful log-in attempt.

1.5 "Subprocessor" means any third party engaged by Reason, or by another Subprocessor, to process Customer Data on Reason's behalf in connection with the Services, including infrastructure hosting providers and other service providers described in Section 8 of the Terms. Reason's own employees and individual contractors acting under Reason's direct supervision are not Subprocessors.

1.6 "Applicable Data Protection Law" means all laws and regulations that apply to a party's processing of Customer Data under this DPA, including the public records, records retention, data security, breach notification, and tax confidentiality statutes of Customer's state and any political subdivision whose law applies to Customer, and federal law to the extent it applies to the Customer Data processed, including 26 U.S.C. 6103 where Customer Data includes federal tax information.

1.7 "Processing" and "process" mean any operation performed on Customer Data, whether or not by automated means, including collection, receipt, storage, organization, adaptation, retrieval, analysis, use, transmission, display, backup, restriction, return, and deletion.

1.8 "Documented Instructions" has the meaning given in Section 2.2 of this DPA.

2. Roles and Scope

2.1 Customer is the entity that controls Customer Data under Applicable Data Protection Law and, where Customer is a government entity, the record custodian for it. Customer determines the purposes and means of processing Customer Data, is responsible for the accuracy and lawfulness of the Customer Data it submits, and is responsible for having the authority under its law to submit Customer Data to the Services, including Confidential Tax Information, and to direct Reason's processing of it. Where Customer is a Pro Customer that files on behalf of clients, each client remains the owner of its own information, and Customer is responsible for having the authority from that client, or under law, to submit the client's information to the Services, to direct its transmission to a jurisdiction, and to receive the jurisdiction's communications about it, as Section 3 of the Terms provides.

2.2 Reason is a service provider acting on behalf of Customer. Reason will process Customer Data only on Customer's documented instructions, which consist of (a) the Terms, to the extent consistent with this DPA and the Ordering Document, (b) any Ordering Document between the parties, (c) this DPA, (d) Customer's and its Authorized Users' configuration and use of the features and functions of the Services, including the submission of a filing to a jurisdiction, and (e) any other written instruction Customer gives that is consistent with the foregoing and that Reason agrees in writing to follow (together, the "Documented Instructions").

2.3 Reason will not process Customer Data for its own purposes other than as the Reserved right to review and the legal-claims exception in Section 8 of the Terms permit, will not sell Customer Data, will not use Customer Data for advertising or marketing, will not use Customer Data, or any data derived from it, to train, tune, or improve any third-party or general-purpose model, and will not use one Customer's Customer Data to configure, tune, or improve the Services for any other Customer, in each case as stated in Section 8 of the Terms. Reason may use Customer's Customer Data to configure and tune the prompts, settings, and features the Services use for Customer's own account; that processing is a Documented Instruction, its results are used only for Customer's account, and the resulting configurations are discarded when Customer Data is deleted under Section 9. Reason may create and use de-identified, aggregated statistics about Authorized Users' use of the features of the Services, such as login counts, feature usage, and filing volumes, that are not derived from the content of any record and that do not identify Customer, any client, taxpayer, business, individual, or contractor, as Section 8 of the Terms provides. Customer Data is not used in development or testing environments except at Customer's written request for a specific support matter, after which it is deleted from those environments.

2.4 If Reason believes that a Documented Instruction violates Applicable Data Protection Law, Reason will notify Customer in writing without undue delay and may suspend performance of that instruction until the parties resolve the matter. Reason is not obligated to conduct a legal review of Customer's instructions, and this Section 2.4 does not make Reason responsible for determining what Customer's law permits.

2.5 Nothing in this DPA changes the nature of the Services described in Section 1 of the Terms. Reason is not an auditor, assessor, appraiser, tax preparer, tax advisor, accountant, collection agency, or law firm, and the Services do not determine what property must be listed, tax liability, assessed value, or the outcome of any audit, discovery, or enforcement action, and do not guarantee that a jurisdiction will accept, process, or timely receive a filing.

3. Details of Processing

3.1 Subject matter. The subject matter of the processing is Customer Data that Customer and its Authorized Users submit to, import into, generate within, or process through the Taxscribe Services.

3.2 Nature and purpose. Reason processes Customer Data to host, store, copy, transmit, process, display, and back up Customer Data as necessary to provide, maintain, secure, and support the Services described in the Terms and the Ordering Document, including the preparation and validation of business personal property listings, extension requests, and related filings and schedules, the transmission of filings to the jurisdictions Customer designates and the relay of those jurisdictions' acknowledgments, rejections, and correspondence to Customer, bulk upload and application programming interface processing, the receipt, review, management, and export of filings by a Gov Customer, reporting and export, and technical support requested by Customer.

3.3 Categories of data subjects. The individuals whose Personal Information may be included in Customer Data are taxpayers, business owners, officers, and registered agents, Customer's clients where Customer files on their behalf, property owners and lessees, and other individuals named in the listings, filings, schedules, and business, tax, or assessment records submitted by or to Customer. Account Information about Customer's own personnel and Authorized Users is not Customer Data and is described in the Privacy Policy.

3.4 Categories of data. Customer Data may include business personal property listings, extension requests, schedules, fixed-asset and depreciation data, business identifying information, taxpayer identification numbers as they appear in listings, client information a professional filer enters, supporting documents, jurisdiction correspondence and determinations relating to Customer's filings, a Gov Customer's listing, account, and assessment records, notes, determinations, and exports, and outputs the Services generate from that information for Customer. Customer Data may include Confidential Tax Information, including taxpayer identification numbers such as federal employer identification numbers and Social Security numbers where they appear in the listings, filings, and schedules Customer submits or receives, and Reason protects them as Confidential Tax Information under this DPA. Customer will not submit payment-card numbers or bank account or routing numbers to the Services, which are not designed to receive them; payment-card information for the purchase of Credits is provided directly to Stripe as Section 7.8 of this DPA describes and is not Customer Data.

3.5 Duration. Reason will process Customer Data for the term of Customer's account or subscription under the Terms and the Ordering Document, for the return period described in Section 9 of this DPA, and thereafter only for the limited retention described in Section 9 of this DPA.

3.6 Transmission to jurisdictions. When Customer or its Authorized Users submit a filing through the Services to a jurisdiction, Customer directs Reason to deliver that filing and its contents to that jurisdiction, and the jurisdiction receives and holds the filed record under its own law, including its public records, confidentiality, and retention laws. That delivery is a Documented Instruction and a disclosure Customer has directed under Section 8 of the Terms; it is not a sale, a breach of confidentiality, or an engagement of a Subprocessor, and the receiving jurisdiction is not a Subprocessor of Reason. After delivery, the jurisdiction's copy of the filed record is that jurisdiction's Customer Data where it is a Gov Customer, and is otherwise outside the Services and this DPA, and Customer's own copy of the filing remains Customer's Customer Data. Reason may confirm to a jurisdiction that a filing was submitted and when, and may relay the jurisdiction's acknowledgments, rejections, and correspondence to Customer, as part of providing the Services. Reason is not responsible for a jurisdiction's handling of a filing after delivery.

3.7 AI-Assisted Features. Reason processes Customer Data through the AI-Assisted Features described in Section 1 of the Terms only as a Documented Instruction, when Customer or its Authorized Users use those features. The prompts and instructions that Customer and its Authorized Users submit to AI-Assisted Features, and the outputs those features return, are Customer Data and are protected as such under Section 8 of the Terms and this DPA. Reason does not use Customer Data to train or improve any third-party or general-purpose model, and configures the Services for Customer's own account as Section 2.3 provides. Each third-party model provider that processes Customer Data for AI-Assisted Features is a Subprocessor, and Section 7 of this DPA, including Section 7.9, governs its engagement.

4. Confidentiality and Personnel

4.1 Customer Data is Customer's confidential information, as Section 8 of the Terms provides, and Reason will hold it in confidence in accordance with that Section and this DPA.

4.2 Reason will ensure that each employee and individual contractor of Reason who is authorized to access Customer Data is bound by a written obligation of confidentiality that survives the end of that person's engagement, has completed security and confidentiality training appropriate to that person's role before being granted access and at least annually thereafter, and has been informed of the confidential nature of Customer Data and of the tax confidentiality restrictions that apply to it.

4.3 Reason's personnel cannot view Customer Data through the Services unless Customer's designated administrator invites Reason support personnel into Customer's account, which Customer controls and may revoke at any time. Apart from that, access to Customer Data is limited to a small number of United States-based production engineers with privileged database access, used only as the Reserved right to review in Section 8 of the Terms permits. Reason logs privileged database access and will provide the relevant records to Customer in connection with a Security Incident affecting Customer's Customer Data. Reason grants access on the basis of least privilege, reviews access rights periodically, and revokes access promptly when a person's role changes or engagement ends.

4.4 Data Firewall. Reason is affiliated with a firm that provides audit, discovery, valuation, and related professional services to state and local government entities, as disclosed in Section 25 of the Terms. Reason and each affiliate are separate corporate entities, and neither has access to the other's data or systems. The Data Firewall in Section 8 of the Terms applies to all processing under this DPA and provides that "Customer Data, and any information derived from it, including de-identified or aggregated information and the fact that any business, taxpayer, or filer has or has not filed, amended, or requested an extension through the Services, will not be used in, disclosed for, or made available to any audit engagement, audit bid, proposal, or other professional services engagement of Company or any affiliate, except as required by law, as you direct in a writing signed by your authorized representative rather than an individual Authorized User, or with your written consent given in the same manner." A jurisdiction receives the listing a filer files with it whatever channel the filer uses, and the Data Firewall governs Reason's copy of it and Reason's systems; delivery of a filing to the jurisdiction Customer designates under Section 3.6 of this DPA is therefore not a disclosure by Reason to an affiliate. Where a jurisdiction engages an affiliate as its contract auditor, any access the affiliate has to filed records is granted by the jurisdiction under its own law and controls, not by Reason, and Reason will not provide an affiliate, through Taxscribe Pro, through Account Information, Credit, or usage records, or otherwise, with any information about a filer or a filing that the jurisdiction would not itself have received from the filing. Reason enforces this restriction through logical separation of the Services' production environment from systems used for affiliate professional services engagements, and through role-based controls under which Reason's internal administrative access to Customer Data is limited to Taxscribe personnel and is not granted to any person by reason of, or for the purpose of, work on an affiliate engagement. Access that Customer itself grants to affiliate personnel by provisioning them as its Authorized Users is under Customer's control and is not a disclosure by Reason. Reason will describe these controls to Customer in further detail on request under Section 8.5, and they are within the scope of an audit under Section 8.6.

4.5 The Services do not obtain federal tax information from the Internal Revenue Service or any other federal source. If Customer chooses to submit Customer Data that includes federal tax information subject to 26 U.S.C. 6103, Customer is responsible for determining that the disclosure to Reason is permitted under that section and its regulations, will notify Reason in writing before submitting it, and the parties will address in the Ordering Document the additional safeguarding, personnel, reporting, and notification obligations of IRS Publication 1075 that apply; Reason will cooperate with those obligations as the Ordering Document provides, and does not represent that the Services satisfy them except as so stated. Where Customer's law requires a contractor's personnel to execute a prescribed confidentiality acknowledgment or certification before accessing Confidential Tax Information, Reason will execute it as part of the Ordering Document and will deliver executed acknowledgments to Customer on request.

5. Security Measures

5.1 Reason will maintain administrative, technical, and physical safeguards designed to protect the security, confidentiality, integrity, and availability of Customer Data and to protect Customer Data against Security Incidents. The Security Overview posted on the Website describes Reason's practices as of its stated date for Customer's information; the contractual security commitments are those in this Section 5 and in the Ordering Document.

5.2 Reason may update the Security Overview from time to time as its practices and technology evolve, provided that during the term of Customer's account or subscription the safeguards Reason maintains will be no less protective, taken as a whole, than those listed in Section 5.3 of this DPA and any additional safeguards stated in the Ordering Document.

5.3 Without limiting Section 5.1, Reason's safeguards include the following.

• Encryption of Customer Data in transit over public networks using industry-standard protocols, and encryption of Customer Data at rest within the production environment.
• Logical access controls for the Services and the systems that support them, including unique credentials for each user, multi-factor authentication for Reason personnel with administrative access to production systems, role-based authorization, and prompt revocation of access on role change or departure.
• Logging and monitoring of administrative access to production systems and of security-relevant events, with logs retained and protected against tampering for a period sufficient to support the investigation of Security Incidents.
• Vulnerability management, including regular scanning of the Services and their supporting infrastructure, risk-based remediation of identified vulnerabilities, and timely application of security patches.
• Secure development practices, including code review and testing of changes before release to production, and logical separation of production from development and testing environments.
• Daily backups of the Customer Data held in Reason's databases, stored immutably with protections no less rigorous than those applied to production data and retained for seven (7) years, and an annual disaster recovery exercise that includes testing of restoration procedures. Files uploaded to the Services are held in redundant cloud object storage but are not currently included in backup snapshots, and Customer should retain its own copies of uploaded files.
• Business continuity and disaster recovery procedures designed to restore the Services following a disruption.
• Physical security for the data centers that host the Services, provided through Reason's hosting Subprocessors and subject to the flow-down obligations in Section 7 of this DPA.

5.4 Reason will host and store Customer Data, including backups, only in data centers located in the United States. Reason will not transfer Customer Data outside the United States, and will not permit a Subprocessor to do so, unless Customer agrees otherwise in writing. For purposes of this Section, "transfer" means storing or hosting Customer Data outside the United States. Remote access to the Services by Customer's Authorized Users from outside the United States is under Customer's control and is not a transfer by Reason. Reason will disclose on request whether any Reason personnel or Subprocessor provides support or administrative access to systems holding Customer Data from outside the United States.

5.5 Customer is responsible for the security of its own systems, networks, and devices, for the credentials and application programming interface keys it and its Authorized Users use to access the Services, for configuring the access and permission settings that the Services make available, and for the security of any Customer Data once it has been exported from the Services.

6. Security Incident Notification

6.1 Reason will notify Customer of a Security Incident affecting Customer Data without undue delay and in any event no later than seventy-two (72) hours after Reason confirms that a Security Incident has occurred. If, five (5) business days after Reason first becomes aware of facts reasonably indicating that a Security Incident may have occurred, Reason has neither confirmed nor ruled it out, Reason will give Customer a preliminary notice that the matter is under investigation. Notice will be given by email and, for a confirmed Security Incident, by telephone where a number has been provided, to Customer's designated administrator and security contact and to any other address stated for security notices in the Ordering Document; where no security contact has been designated, notice to the designated administrator suffices.

6.2 To the extent the information is known at the time of notice, the notice will describe the nature of the Security Incident, the categories and approximate volume of Customer Data and data subjects affected, the date or estimated date of the Security Incident and of its discovery, the likely consequences, the measures Reason has taken or proposes to take to contain and remediate it, and a point of contact at Reason. Where all of this information is not available within seventy-two (72) hours, Reason will provide the initial notice with the information then available and will supplement it as further information becomes available.

6.3 Reason will keep Customer reasonably informed of the progress of its investigation and remediation, will provide a written summary of the Security Incident and its root cause when the investigation is complete, and will take reasonable steps to contain the Security Incident and to prevent its recurrence.

6.4 Reason will cooperate reasonably with Customer in Customer's own investigation of a Security Incident and in Customer's compliance with any breach notification, reporting, or remediation obligations that Applicable Data Protection Law imposes on Customer, including by providing information reasonably needed for notices to affected individuals, clients, regulators, law enforcement, or the public. Where a Security Incident results from Reason's or a Subprocessor's breach of this DPA, the reasonable costs Customer incurs for notifications that its law requires are direct damages recoverable subject to Section 11.

6.5 Customer, as the entity that controls Customer Data or its record custodian, is responsible for determining whether a Security Incident requires notification to affected individuals, clients, regulators, or others under Applicable Data Protection Law and for making any such notification. Reason will not notify affected individuals, regulators, the media, or other third parties of a Security Incident affecting Customer Data on Customer's behalf unless Customer directs it in writing or applicable law requires Reason to do so, in which case Reason will, where legally permitted, give Customer prior notice of and a reasonable opportunity to comment on the content of the notification.

6.6 Reason's notice of a Security Incident is not an admission of fault or liability by Reason. Reason's obligations under this Section 6 do not apply to a security incident that affects only Customer's own systems, devices, or credentials and does not involve unauthorized access to Customer Data within the Services.

7. Subprocessors

7.1 Customer generally authorizes Reason to engage Subprocessors to process Customer Data in connection with the Services, subject to this Section 7. Customer specifically authorizes the Subprocessors identified on the list posted on the Website under Section 7.2 as of the date of the Ordering Document or, where there is none, the date Customer first uses the Services, and Reason will attach that list to the Ordering Document on request.

7.2 Reason will maintain a current list of its Subprocessors, identifying each Subprocessor, the service it provides, the country in which it processes Customer Data, and the categories of Customer Data it can access. Reason will post the list on the Website and will provide it to Customer on request.

7.3 Reason will give Customer at least thirty (30) days' written notice before authorizing a new Subprocessor to process Customer Data, by email to Customer's designated administrator and to the notice address stated in the Ordering Document, and will update the posted list; for a Pro Customer that has no Ordering Document, notice is given by updating the posted list and by email to the account email address, and the thirty (30) day period runs from that update. Customer may object to a new Subprocessor on reasonable grounds relating to data protection by giving Reason written notice within the thirty (30) day period, stating the grounds for the objection.

7.4 If Customer objects, the parties will work together in good faith to resolve the objection, which may include Reason offering a reasonable alternative that avoids the use of the new Subprocessor for Customer Data. If the parties are unable to resolve the objection within thirty (30) days after Reason receives it, Customer may terminate the affected Services on written notice to Reason, without penalty, and Reason will refund the prepaid fees attributable to the unexpired portion of the committed term for the affected Services after the effective date of termination, and Section 9 of this DPA applies. This refund and the return rights in Section 9 are Customer's remedies for an unresolved objection under this Section 7.

7.5 Reason will not permit a Subprocessor to process Customer Data until Reason has entered into a written agreement with the Subprocessor that imposes data protection, confidentiality, and security obligations no less protective of Customer Data than those in Section 8 of the Terms and this DPA, to the extent applicable to the service the Subprocessor provides. Where a Subprocessor is an infrastructure provider whose terms are not individually negotiable, Reason will engage it only under terms that Reason has reasonably determined provide protections substantially equivalent to those required by this Section 7.5.

7.6 Reason remains responsible to Customer for the performance of each Subprocessor's obligations with respect to Customer Data to the same extent Reason would be responsible had it performed the processing itself, subject to Section 11 of this DPA.

7.7 Replacement of a Subprocessor with another provider of the same service, and changes to a Subprocessor's corporate name or ownership, are subject to the notice in Section 7.3 but are not by themselves grounds for objection unless they result in a material reduction in the protection of Customer Data.

7.8 Payment processing. Stripe, Inc. processes payment card transactions for the purchase of Credits by Taxscribe Pro Customers under Section 5 of the Terms. Stripe receives only the information needed to process and record a payment, which the cardholder enters directly into Stripe's embedded payment form, and does not receive filing content or other Customer Data. Reason receives from Stripe only a transaction confirmation and the last four digits of the card, and never receives or stores card numbers. Because Stripe receives payment and Account Information rather than Customer Data, it is a service provider for purposes of the Privacy Policy rather than a Subprocessor of Customer Data; Reason nonetheless identifies it on the list maintained under Section 7.2 for transparency, and Stripe's terms are not individually negotiable. Stripe does not process Customer Data for Taxscribe Gov, for which Reason does not process payment cards.

7.9 Model providers. Where features of the Services use third-party artificial intelligence model providers, each such provider that processes Customer Data is a Subprocessor identified on the list maintained under Section 7.2. Reason engages each model provider only under zero-data-retention terms, under which the provider receives Customer Data only in the requests Reason makes to it to provide the Services, may not use Customer Data to train or improve its models, does not retain Customer Data after the request is processed, and processes Customer Data in the United States, consistent with Section 5.4. Reason configures each model provider's service to disable any data-sharing, data-retention, or model-training option that would otherwise permit the provider to use Customer Data for its own purposes, and Section 7.5 applies to a model provider whose terms are not individually negotiable in the same manner as it applies to an infrastructure provider. Firebase Authentication, a Google service, processes Authorized User credentials for sign-in and is identified on the same list.

8. Assistance to Customer

8.1 Individual requests. If Reason receives a request from a taxpayer, business, client of Customer, or other individual to access, correct, delete, or otherwise exercise rights with respect to Personal Information within Customer Data, or an inquiry about how Customer processes such information, Reason will not respond substantively and will direct the requester to Customer, except where law requires Reason to respond. Reason will notify Customer of the request promptly where Reason can identify the Customer to which it relates. Taking into account the nature of the processing, Reason will assist Customer in responding to such requests through the search, export, correction, and deletion functions of the Services and, where those functions are insufficient, through reasonable additional assistance at Customer's request.

8.2 Public records requests. If Customer receives a request for records under its public records law that calls for Customer Data in Reason's possession, Reason will, at Customer's request, cooperate reasonably in locating, retrieving, and producing the requested Customer Data to Customer, so that Customer may respond under its own law. Reason will not itself determine whether a record is public or confidential under Customer's law.

8.3 Litigation holds and legal process. If Customer notifies Reason in writing that a litigation hold, preservation order, or record retention requirement applies to identified Customer Data, Reason will preserve that Customer Data as Customer directs, notwithstanding the deletion provisions of Section 9 of this DPA, until Customer notifies Reason in writing that the hold has been released. If Reason receives a subpoena, court order, or other legal process demanding Customer Data, Reason will proceed as provided in Section 8 of the Terms, including giving Customer prompt notice where legally permitted so that Customer may seek a protective order, and will disclose only the Customer Data that Reason is legally compelled to disclose.

8.4 Third-party requests for Customer records. Reason will refer to Customer any request from a third party, including the press, a member of the public, another government entity, or a taxpayer, for Customer Data or for records of Customer's use of the Services, and will not produce Customer Data in response to such a request except as Customer directs in writing, as Section 8.3 provides, or as a transmission Customer has directed under Section 3.6 requires.

8.5 Security assessments and questionnaires. Sections 8.5 through 8.7 apply to Gov Customers and to Pro Customers that have an Ordering Document; other Pro Customers may review the Security Overview and request the subprocessor list, and Reason will answer reasonable written security questions from them where it reasonably can. On Customer's written request, no more than once per year, Reason will complete a reasonable written security questionnaire concerning the Services and respond in writing to Customer's reasonable follow-up questions. Reason will also, on request and subject to reasonable confidentiality protections, provide Customer with a copy or summary of its most recent SOC 2 Type II report and ISO 27001 certificate and any other third-party audit report or security certification concerning the Services that Reason holds at the time of the request, with confidentiality protections consistent with Customer's public records law, including any exemption for security information. Reason completes a SOC 2 examination annually and maintains ISO 27001 certification; it does not represent that any other report or certification exists or will be obtained except as stated in the Security Overview or an Ordering Document.

8.6 Audits. Where the written materials described in Section 8.5 do not reasonably satisfy Customer's obligations under Applicable Data Protection Law, Customer, or an independent auditor engaged by Customer and reasonably acceptable to Reason, may conduct an audit of Reason's compliance with this DPA, subject to the following conditions.

• The audit may be conducted no more than once in any twelve (12) month period, on at least thirty (30) days' written notice, during normal business hours, and in a manner that does not unreasonably interfere with Reason's operations.
• The audit may be conducted remotely or, where remote review is insufficient, at Reason's premises, and will be limited to systems, records, and personnel relevant to the processing of Customer Data. Reason may exclude information relating to other customers and may require that access to a Subprocessor's facilities be arranged through the Subprocessor's own audit or certification programs.
• Customer bears its own costs of the audit and will reimburse Reason for reasonable time and expenses incurred in supporting an audit that exceeds two (2) business days of Reason personnel time, at Reason's then-current professional services rates, unless the audit reveals a material breach of this DPA by Reason.
• Customer and its auditor will keep the audit findings and all information obtained during the audit confidential, will use them only to assess and enforce compliance with this DPA and Applicable Data Protection Law, and will sign a reasonable confidentiality agreement with Reason before the audit begins, except to the extent Customer's public records law requires disclosure.
• Customer will provide Reason with a copy of the audit findings, and the parties will confer in good faith regarding remediation of any deficiency the audit identifies.

8.7 Additional audits. The frequency limit in Section 8.6 does not apply to an audit conducted within twelve (12) months after a Security Incident affecting Customer's Customer Data, or to an audit that Applicable Data Protection Law, a regulator with authority over Customer, or a state or federal auditor requires Customer to conduct, provided that Customer gives Reason as much advance notice as the circumstances reasonably permit and the other conditions of Section 8.6 apply. The conditions of Section 8.6 regarding auditor acceptability, cost reimbursement, and confidentiality agreements do not apply to an audit, inspection, or review conducted by or at the direction of Customer's internal auditor, Customer's state auditor, or Customer's state department of revenue in the exercise of their statutory access rights, which are preserved. Where Reason holds a current third-party audit report or certification covering the scope of Customer's audit, Customer will first review that report, and an audit will be limited to matters the report does not reasonably address.

8.8 Retrieval and production of Customer Data in response to a public records request, subpoena, litigation hold, or audit using the standard search and export functions of the Services is provided at no charge. Assistance under this Section 8 that requires more than reasonable effort in the ordinary course, including custom data extracts, legal review, or professional services, may be provided at the professional services rates stated in the Ordering Document or, where none are stated, Reason's then-current rates, on Customer's written approval, except where the assistance is required because of Reason's breach of this DPA.

9. Return and Deletion of Customer Data

9.1 During the term, Customer may export Customer Data at any time using the export functions the Services make available, as Section 8 of the Terms provides. A Pro Customer's filed records are retained, and remain accessible and exportable by that Customer, for as long as its account remains open, so that it can access prior-year filings.

9.2 For sixty (60) days after termination or expiration of Customer's account or subscription, Customer may request, and Reason will provide within thirty (30) days of the request, a copy of Customer Data consisting of listing header, asset, and account data in documented, commonly used, machine-readable electronic formats together with a data dictionary, and filed forms, schedules, and jurisdiction correspondence as PDF documents, at no additional charge. Reason will provide the copy through a secure transfer method, will confirm in writing when the copy is complete, and will cooperate reasonably with Customer's transition to a successor system, including by answering reasonable questions about the data format and structure, for up to eight (8) hours of Reason personnel time at no charge for a Gov Customer or a Pro Customer with an Ordering Document, and up to two (2) hours for other Pro Customers, with further assistance available at the rates described in Section 8.8. Reason will not delete Customer Data during the sixty (60) day period or while a request made within it is pending.

9.3 After the sixty (60) day period, Reason will remove Customer Data from its live systems, including live systems of Subprocessors, within ninety (90) days after Customer requests removal in writing. Where Customer does not request removal, Reason retains Customer Data, which for a retired account may be moved to offline or archival storage, for up to seven (7) years after the end of the subscription and then deletes it. In either case retention is subject to applicable law, a legal hold under Section 8.3 of this DPA, a record retention obligation that Customer has notified Reason of in writing, and the Ordering Document, and Customer Data that Reason retains remains subject to this DPA for as long as Reason retains it.

9.4 Reason's backups are immutable and are retained for seven (7) years, so Customer Data contained in backups is not deleted by targeted deletion and expires on that schedule. Customer Data in backups will not be restored to a live environment or otherwise used after Customer Data has been removed from live systems except as required to recover the Services, to comply with law, or under a legal hold. Backup copies remain subject to the security and confidentiality obligations of this DPA until they expire.

9.5 On Customer's written request, Reason will provide a written certification, signed by an authorized representative, confirming that Customer Data has been removed from live systems or deleted in accordance with this Section 9, identifying any Customer Data retained under Section 9.3 and the basis for its retention, and stating the date by which the last backup containing Customer Data will expire.

9.6 Deletion under this Section 9 does not affect de-identified, aggregated statistics that are excluded from Customer Data under Section 8 of the Terms, and does not affect the copy of a filed record that a jurisdiction holds under Section 3.6 of this DPA.

10. Government Records

10.1 Reason holds Customer Data as a service provider to Customer. Nothing in this DPA, the Terms, or an Ordering Document transfers custody, control, or ownership of public records, or of any other records that Customer is responsible for under its law, away from Customer.

10.2 Reason is not a records custodian, agency, or public body for purposes of Customer's public records law, records retention law, or open meetings law, and does not assume Customer's obligations under those laws, except to the extent that Customer's law expressly imposes obligations on a contractor or service provider holding public records on a public body's behalf, in which case Reason will comply with those obligations as they apply to Customer Data in its possession and Customer will identify them to Reason in writing on request.

10.3 Customer is responsible for classifying Customer Data under its public records, retention, and confidentiality laws, for determining what is public and what is confidential, for applying its own retention schedules to the source records it maintains, and for notifying Reason in writing of any retention obligation that requires Reason to hold Customer Data longer than Section 9 of this DPA provides.

10.4 Reason will refer any third party who requests Customer's records from Reason to Customer, as Section 8.4 of this DPA provides, and Section 27 of the Terms applies to Customer Data that constitutes public records under Customer's law.

11. Liability

11.1 This DPA is subject to Section 20 of the Terms. Each party's liability arising out of or relating to this DPA, however arising, is subject to the exclusions and the aggregate limitation of liability in Section 20 of the Terms, and this DPA does not create a separate, additional, or higher limitation of liability.

11.2 The carve-outs in Section 20 of the Terms apply to this DPA. Nothing in this DPA limits either party's liability for its gross negligence, willful misconduct, or fraud, or any liability that cannot be limited or excluded under applicable law.

11.3 Any refund payable under Section 7.4 of this DPA is a return of prepaid fees, not damages, and does not count against or expand the limitation of liability in Section 20 of the Terms.

11.4 Any claim under this DPA is subject to Section 17 of the Terms and to Section 27 of the Terms.

12. Government Users

12.1 This Section 12 applies to a Customer that is a federal, state, or local government entity, or an agency, department, or instrumentality of one, including every Gov Customer. The protections for government entities in Section 27 of the Terms apply to this DPA as if set out in full here. In particular, Sections 11 and 14 of this DPA and any other provision of this DPA that limits Reason's liability or specifies governing law or venue apply to Customer only to the extent permitted by the laws applicable to Customer, and nothing in this DPA waives any sovereign or governmental immunity available to Customer.

12.2 Where Customer's law requires that a contract for the processing of Confidential Tax Information or other government records contain specific provisions, including provisions subjecting a contractor's personnel to the confidentiality obligations and penalties that apply to Customer's own officers and employees, the parties will include those provisions in the Ordering Document, and those provisions will control over this DPA to the extent of any conflict.

12.3 Nothing in this DPA is intended to limit any right Customer has under the Terms or an Ordering Document, and where a provision of the Terms or an Ordering Document is more favorable to Customer than a provision of this DPA, that provision applies.

13. Term, Amendment, and Precedence

13.1 This DPA takes effect on the effective date of Customer's first purchase of Credits, paid subscription, or Ordering Document or, where executed as part of an Ordering Document, on that Ordering Document's effective date, and remains in effect for as long as Reason processes Customer Data, including during the return and deletion periods in Section 9 of this DPA. Sections 4, 6, 7.9, 8.3, 9, 10, 11, 12, and 14 of this DPA, and any other provision that by its nature should survive, survive termination or expiration of the Terms and the Ordering Document for so long as Reason retains any Customer Data.

13.2 Reason may amend this DPA in the manner and with the notice that the Terms provide for amendments to the Terms. A change to this DPA will not apply to a Customer with a paid subscription or an Ordering Document until the start of the next renewal term unless Customer agrees to it earlier or the change is required by law, and applies to a Pro Customer that holds purchased Credits and has no Ordering Document as the Amendments paragraph of the Terms provides, and no amendment will reduce the protection of Customer Data below that provided by Section 8 of the Terms. Where this DPA has been executed as part of an Ordering Document, it may be amended only by a written amendment signed by both parties.

13.3 The order of precedence stated in the Preamble governs any conflict between this DPA and the other documents governing the Services.

13.4 If any provision of this DPA is determined to be unlawful, void, or unenforceable, that provision is deemed severable and does not affect the validity and enforceability of the remaining provisions, and the parties will substitute a valid provision that most closely achieves the intent of the severed provision.

14. Governing Law

14.1 This DPA is governed by the law that governs the Terms under Section 16 of the Terms, subject to Section 27 of the Terms and Section 12 of this DPA, and disputes are resolved as Section 17 of the Terms provides, including its exception for government entities from arbitration. Where Customer's law requires that disputes be resolved in the courts of Customer's state or under Customer's state's law, that requirement controls.

15. Contact

15.1 Notices under this DPA are given as Section 24 of the Terms provides. Security Incident notices from Reason will be sent to the addresses described in Section 6.1 of this DPA, and Customer is responsible for keeping those addresses current.

15.2 Questions about this DPA, requests for the Subprocessor list, security questionnaires, audit requests, deletion certifications, and notices of legal holds or retention obligations may be directed to Reason at the following address.

Reason Consulting Corporation, Attention: Data Protection, Taxscribe, 2820 Selwyn Ave, STE 856, Charlotte, NC 28209, United States; email contact@reason.consulting.