SUPERTRACK Privacy Policy

Last updated: 5/1/2026

Havoc LLC, doing business as SUPERTRACK ("Havoc LLC," "SUPERTRACK," "we," "us," or "our"), respects your privacy. This Privacy Policy explains what personal information we collect through the SUPERTRACK website and service located at www.havocsupertrack.com;www.supertrack-ct.com;havoc-supertrack-prod.us-west-2.elasticbeanstalk.com and any related domains (the “Services”), how we use and share it, and the choices and rights available to you.

This Policy is incorporated by reference into, and should be read together with, the SUPERTRACK Terms of Service.

1. Information We Collect

We collect the following categories of information:

• Account and contact information: Name, email address, company name, and phone number that you or your employer provides when creating or administering an account.
• Usage and log data: IP address, browser information, and Authorized User activity logs are collected automatically when you use the Services for purposes of providing the Services to Customer.
• Cookies and similar technologies: See Section 5 below.
• Payment information: We do not collect payment information. If a Customer pays by credit card, ACH, or other bank transfer process, we use a third-party payment processor that does not share any payment information with us.
• Communications: Records of correspondence when you contact us for support or other inquiries.

2. Customer Content

In the course of using the Services, Customers may submit information about their company, employees, and operations directly into their SUPERTRACK account (“Customer Content”). Customer Content is different from the categories above: the Customer, not Havoc LLC, decides what Customer Content is submitted and controls that data.

Havoc LLC stores and processes Customer Content solely to provide the Services as directed by the Customer, and does not access, use, analyze, or otherwise process Customer Content for Havoc LLC’s own independent purposes. In providing the Services, Havoc LLC acts as a service provider / data processor with respect to Customer Content, and the Customer (or the Customer’s employer) acts as the controller/business responsible for that data. If Customer Content includes personal information about a Customer’s employees or other individuals, it is the Customer’s responsibility to ensure it has the appropriate legal basis and notices in place to submit that information to the Services.

Havoc LLC’s processing of Customer Content on behalf of a Customer is governed by the Data Processing Addendum incorporated by reference into the Terms of Service, see below, which Customers may request by contacting privacyofficer@havocllc.com.

3. How We Use Information

We use the information described above to:

• Provide, operate, maintain, and secure the Services;
• Authenticate Authorized Users and administer accounts;
• Communicate with you about the Services, including support requests and service-related notices;
• Send product updates or marketing communications, where you have not opted out;
• Monitor, analyze, and improve the performance, security, and functionality of the Services;
• Detect, investigate, and prevent fraud, abuse, or security incidents;
• Comply with legal obligations and enforce our Terms of Service.

We only use personal information for the purposes for which it was collected, or for other purposes you have been notified of or have consented to, unless otherwise required or permitted by law.

4. Legal Basis for Processing (EU/UK Users)

Where the General Data Protection Regulation (GDPR) or UK GDPR applies, we process personal information on the following legal bases: performance of a contract with you or your employer; our legitimate interests in operating and securing the Services; compliance with a legal obligation; and, where applicable, your consent.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to authenticate users, remember preferences, and understand how the Services are used. This may include:

• Strictly necessary cookies: required for login and core functionality.
• Analytics cookies: Google Analytics used to understand usage patterns.

6. How We Share Information

We do not sell personal information. We may share information as follows:

• Service providers / subprocessors: third parties who perform services on our behalf, such as hosting (currently AWS), analytics, customer support tools, and payment processing. These providers are contractually restricted to using data only to provide services to us.
• Aggregated and de-identified data: we may disclose aggregated or de-identified information, such as summary project outcomes, for promotional purposes, consistent with our Terms of Service.
• Legal and safety reasons: where required by law, subpoena, or other legal process, or where we believe in good faith it is necessary to protect the rights, property, or safety of Havoc LLC, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to standard confidentiality protections.

7. International Data Transfers

SUPERTRACK is a U.S.-based service. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States and other countries where Havoc LLC or its service providers operate. By using the Services, you consent to this transfer, consistent with Section 17 of the Terms of Service.

8. Data Retention

We retain personal information for as long as necessary to provide the Services and fulfill the purposes described in this Policy, unless a longer retention period is required by law. When information is no longer needed, we take reasonable steps to delete or de-identify it.

9. Your Privacy Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request deletion of your personal information, subject to legal exceptions;
• Know what categories of information are collected and shared, and opt out of any “sale” or “sharing” of personal information (Havoc LLC does not sell personal information);
• Request restriction of, or object to, certain processing, and request data portability;
• Withdraw consent at any time, where processing is based on consent;
• Lodge a complaint with your local data protection authority.

If your organization is our Customer, and your personal information was submitted by your employer, some requests may need to be directed to your employer as the data controller. To exercise these rights, contact us at privacyofficer@havocllc.com.

10. Data Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption of data in transit using Transport Layer Security (TLS) and HTTPS and at rest. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Additional details on our security practices are set out in Section 4 of the Terms of Service.

11. Children's Privacy

The Services are not directed to individuals under the age of 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify affected users, such as by posting a notice on the Services or updating the “Last updated” date above. Your continued use of the Services after changes take effect constitutes acceptance of the revised Policy.

13. Contact Us

Questions about this Privacy Policy or requests regarding your personal information can be directed to our Privacy Officer at privacyofficer@havocllc.com, or to general support at support@havocllc.com.

SUPERTRACK SaaS Terms of Service

Havoc LLC Terms of Service

Last updated: 5/1/2026

By using the Havoc LLC service, doing business as SUPERTRACK, located at www.havocsupertrack.com;www.supertrack-ct.com;havoc-supertrack-prod.us-west-2.elasticbeanstalk.com, or other domain that forwards to this domain (the “Website”), and providing your data to Havoc LLC, you, individually and on behalf of your employer (collectively, “you” or “Customer”) agree to be bound by these Terms of Service (this “Agreement”). The Services are defined as your access to the Website and the information you receive from Havoc LLC through the Website (the “Services”).

This Agreement sets out the legally binding terms for your use of the Services and may be modified by Havoc LLC from time to time in its sole discretion. Any modifications shall be effective upon posting by Havoc LLC on the Website.

1. Eligibility

The Services are solely for access and use by Authorized Users (as defined below). By using the Services, you represent and warrant that you (a) have the right, authority, and capacity to enter into this Agreement and (b) will abide by all the terms and conditions of this Agreement. If you have agreed to become a paying customer for the Services, then your eligibility to use the Services shall be contingent on your continued compliance with the terms of the applicable purchase agreement and this Agreement. If you have not agreed to become a paying customer for the Services, your use of the Website is still subject to this Agreement.

2. Password

Havoc LLC shall authorize individual employees of Customer as designated by Customer from time to time (each an “Authorized User”), who will have access to the Services. You will also be asked to choose a username and a password for each Authorized User. Havoc LLC may change any username and password for any Authorized User at any time, with notice to Customer following any such change. Each Authorized User must use his or her own username and password and not disclose them to anyone else. Customer shall immediately notify Havoc LLC of any unauthorized disclosure. Customer is responsible for (a) each Authorized User’s compliance with this Agreement and (b) any employee of Customer, any person to whom Customer has given access to the Services, and any person who gains access to Customer’s Services as a result of your failure to use reasonable security precautions, even if such use was not authorized by you.

3. Term

This Agreement will remain in full force and effect while Havoc LLC offers the Services and/or you are a Customer using the Services. Either party may terminate this Agreement for any reason, at any time, except that if Customer is a party to a separate signed order form or purchase agreement with Havoc LLC that specifies a term or notice period, that order form’s term and notice provisions will control over this Section for that Customer. After this Agreement is terminated, the following provisions of this Agreement will remain in effect: Sections 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, and 17, and any other Section that by its nature survives termination.

4. Availability of and Access to Services

Havoc LLC will attempt to provide continuous availability and access to Services. If we are unable to provide access for reasons beyond our control, we will communicate the reasons for the outage and expected duration of the outage clearly and explicitly to the Customer. These outages could be due to third parties that the Service depends on, such as, but not limited to, Amazon AWS or other third-party service providers. Also, while we will make commercially reasonable attempts to back up all Customer data, in the event of recovery from disaster, the Customer may have to reconfigure the Service to get it back to the state it was in before the outage. SUPERTRACK is hosted by a third-party hosting service provider. Havoc LLC and its third-party service providers have implemented and maintain commercially reasonable technical and organizational security measures designed to meet the following objectives: (a) ensure the security and confidentiality of Customer data in Havoc LLC’s and/or its third-party service providers’ custody and control; (b) protect against anticipated threats or hazards to the security or integrity of Customer data; (c) protect against unauthorized access to or use of Customer data; (d) encrypt Customer’s Content and data during transmission by Havoc LLC and its third-party service providers and when being uploaded by Customer for use in connection with the Services using a TLS and HTTPS connection, and encrypt Customer’s Content and data at rest; and (e) ensure that Havoc LLC’s return or disposal of Customer data is performed in a manner consistent with the foregoing. However, we cannot guarantee that unauthorized third parties will never be able to defeat those measures to access your data for improper purposes. You acknowledge that there are risks inherent in internet connectivity that could result in the loss of your privacy, confidential information, and property.

5. Proprietary Rights in Content of Havoc LLC

The Services contain the copyrighted material, trademarks, patents, trade secrets, and other proprietary information (“Intellectual Property”) of Havoc LLC and its suppliers and licensors. Havoc LLC and its suppliers and licensors own and retain all proprietary rights in the Services, including all Tools. “Tools” include all functionality provided through the Services. Except for Intellectual Property which is in the public domain or for which you have been given written permission, you may not copy, modify, publish, transmit, distribute, perform, display, or otherwise use any such Intellectual Property, and the provision of such Intellectual Property to you through the Services does not transfer to you or any third party any rights, title, or interest in or to such Intellectual Property, including, without limitation, any intellectual property rights in any content and material included therein. You may not: distribute, sub-license, translate, reverse-engineer, decompile, or disassemble the Services or Intellectual Property or the source code thereof, or attempt to derive the source code thereof in any other way, save and only to the extent any foregoing restriction is prohibited by applicable law; modify the Services or Intellectual Property or merge all, or any part, of the Services or Intellectual Property or the source code thereof into another program; or remove, modify, or alter any Havoc LLC Intellectual Property from any part of the Services or Intellectual Property or the source code thereof. Havoc LLC grants you a perpetual, unlimited, worldwide, fully paid, royalty-free license to copy, use, and make derivative works of the Output of the Services, and to make any other use of or perform any other act upon the Output that an owner would be entitled to do. “Output” means all information available, reported, downloaded, or otherwise compiled from the Services, including without limitation data, images, and reports generated by or for the Customer.

6. Customer Information Provided to Havoc LLC

Customer will retain all Intellectual Property rights in Customer Intellectual Property that may be provided by Customer to Havoc LLC (“Customer Property”) under this Agreement. Havoc LLC will not publicly disclose any Customer-specific information but may disclose aggregated and de-identified customer information related to the Services for promotional purposes, such as project summary and high-level outcomes of the Services. You understand and agree that Havoc LLC may copy, use, and modify any information that you provide to Havoc LLC, including all suggestions supplied by you that relate to the Services (collectively, “Content”), for the sole purposes of providing the Services to you and improving the quality of Havoc LLC’s products and services. Furthermore, you hereby agree that Havoc LLC shall have an unlimited, royalty-free, worldwide, and perpetual license to use, copy, distribute, practice, and make derivative works of, under any intellectual property rights you may have, including but not limited to copyrights, trademarks, trade secrets, and patents, all suggestions supplied by you to Havoc LLC. By providing Content to Havoc LLC, you represent and warrant that you have the right to provide such Content to Havoc LLC and that such Content does not infringe, misappropriate, violate, or contravene any laws, regulations, or third-party rights (including, without limitation, any rights in Intellectual Property).

7. Use of Services

You must use the Services in a manner consistent with all applicable laws and regulations. Havoc LLC and its suppliers use reasonable efforts to protect the confidentiality of Content you provide. Havoc LLC cannot guarantee that unauthorized third parties will never be able to defeat those measures to access content for improper purposes. Customer acknowledges that there are risks inherent in internet connectivity that could result in the loss of Customer’s privacy, confidential information, and property. Customer also acknowledges that Customer is under no obligation to provide Customer’s confidential information in order to use the Service.

8. Disclaimer

To the extent permitted under applicable laws, the Services are provided “as-is” and “as available,” with no warranty of any kind, and Havoc LLC, on behalf of itself and its licensors and suppliers, expressly disclaims any warranty and conditions of any kind, whether express or implied, including, but not limited to, the warranties or conditions of merchantability, fitness for a particular purpose, title, accuracy, or non-infringement, and Havoc LLC and its suppliers and licensors do not guarantee and do not promise any specific results from the use of the Services. The Services are intended as a data monitoring and collaboration tool, and Customer’s use of, and reliance upon, the same are Customer’s sole responsibility, with Customer assuming all associated risks.

9. Limitation of Liability

Havoc LLC shall have no liability to Customer under this Agreement, it being acknowledged and agreed that Havoc LLC’s provision of the Services is provided solely for the convenience of Customer. If the foregoing limitation of liability is found to be unenforceable, Havoc LLC’s liability to Customer for any cause of action arising from its use of the Services or under this Agreement, and regardless of the form of the action, will at all times be limited to the amount paid by Customer to Havoc LLC for the Services during the twelve (12) months preceding such cause of action. Except for breach of the restrictions in Section 5 and in relation to the indemnity in Section 13, Customer’s liability to Havoc LLC for breach of this Agreement shall not exceed the amount paid or agreed to be paid by Customer to Havoc LLC for the Services during the twelve (12) months preceding such cause of action. Notwithstanding anything to the contrary contained herein, this Agreement shall not limit or exclude either party’s liability for gross negligence or intentional misconduct of a party or its agents or employees, or for death or personal injury. The parties agree that the limitations on and exclusions of liability in this Agreement were freely negotiated and are an integral part of the bargain, in that the Services would not have been available for the same price and under the same terms and conditions had such limitations on and exclusions of liability not been included in this Agreement.

10. U.S. Export Controls

Any software provided by Havoc LLC through the Services (the “Software”) and the Services themselves are subject to United States export controls. Neither the Services nor any Software downloaded from the Services may be exported or re-exported (i) into the territory of (or to a national or resident of) Cuba, North Korea, Iran, Syria, Sudan, or any other country to which the U.S. has embargoed goods or services, or (ii) to anyone on the U.S. Treasury Department’s list of Specially Designated Nationals or the U.S. Commerce Department’s Table of Deny Orders. By accessing the Services or downloading or using the Software, you represent and warrant that you are not located in, under the control of, or a national or resident of any such country or on any such list.

11. Dispute Resolution

This Agreement shall be governed by the laws of the State of Washington without giving effect to any conflict of laws principles that may provide for the application of the law of another jurisdiction. You and Havoc LLC agree to submit to the exclusive personal jurisdiction of, and agree that venue is proper in, the state and federal courts located in Washington State in such legal action or proceeding. Notwithstanding the foregoing, Havoc LLC may seek injunctive or other equitable relief to protect its Intellectual Property rights in any court of competent jurisdiction.

12. Electronic Communications

The communications between you and Havoc LLC use electronic means, whether you visit the Website or send us emails, or whether Havoc LLC posts notices on the Services or communicates with you via email. For contractual purposes, you (a) consent to receive communications from Havoc LLC in an electronic form, and (b) agree that all terms and conditions, agreements, notices, disclosures, and other communications that Havoc LLC provides to you electronically satisfy any legal requirement that such communications would satisfy if in writing. The foregoing does not affect your non-waivable rights.

13. Indemnity

You agree to indemnify and hold Havoc LLC, its subsidiaries, affiliates, officers, agents, licensors, and other partners and employees harmless from any loss, liability, claim, or demand, including reasonable attorney’s fees, made by any third party due to or arising out of your use of the Services in violation of this Agreement and/or arising from a breach of this Agreement and/or any breach of your representations and warranties set forth above. Havoc LLC will defend or settle, at its expense, any action brought against Customer based upon the claim that the Services, when used in accordance with the Agreement, directly infringe an issued U.S. patent or registered copyright; provided, however, that: (i) Customer notifies Havoc LLC promptly in writing of any such claim; (ii) Customer does not enter into any settlement related to any claim without Havoc LLC’s prior written consent; (iii) Havoc LLC has sole control of any claim and all related settlement negotiations; and (iv) as requested, Customer provides Havoc LLC with all information and assistance necessary to settle or defend the claim. If the Services become, or may, in the opinion of Havoc LLC, become the subject of a claim of infringement of any third-party intellectual property right, Havoc LLC may, at its option, and as Customer’s exclusive remedy: (i) procure the right for Customer to use the Services; (ii) replace or modify the Services to make them non-infringing; or (iii) refund any fees paid in advance by Customer for the Services.

14. Other

This Agreement contains the entire agreement between you and Havoc LLC regarding the use of the Services and supersedes and replaces all prior or contemporaneous understandings, representations, communications, or agreements, written or oral, including any additional or contrary terms contained in any Customer purchase order or other procurement document, whether presented contemporaneously or after Customer has entered into this Agreement, and notwithstanding any signature by Havoc LLC of such purchase order or procurement document; any such additional or contrary terms contained in such Customer purchase order or other procurement document shall be void as they may pertain to the subject matter of this Agreement. This Agreement may be updated or amended by Havoc LLC at any time, with or without notice to Customer, and Customer’s continued use of the Services shall constitute Customer’s acceptance of the updated or amended Agreement. Customer may not assign all or any part of its rights or obligations hereunder without the consent of Havoc LLC. Notwithstanding any other provisions herein, no party will be deemed a third-party beneficiary to this Agreement. If any provision of this Agreement is found to be invalid or unenforceable, such provision will be changed and interpreted to accomplish the objectives to the greatest extent possible under applicable law, and the remaining provisions will continue in full force and effect. The failure of Havoc LLC to exercise or enforce any right or provision of this Agreement shall not operate as a waiver of such right or provision. Nonperformance by either party shall be excused to the extent that performance is rendered impossible by strike, acts of God, natural disaster, internet outages, computer viruses, governmental acts or restrictions, failure of suppliers, or any other reason where failure to perform is beyond the reasonable control of the nonperforming party. The section titles in this Agreement are for convenience only and have no legal or contractual effect. You are responsible for all taxes, other than taxes levied on Havoc LLC’s income. Services fees do not include any applicable taxes. If Havoc LLC is required to pay any sales, use, goods & services, value added, or other taxes in relation to your purchase, those taxes will be billed to and paid by you.

15. Copyright/Trademark Information

All Intellectual Property owned by Havoc LLC shall remain the exclusive property of Havoc LLC. Customer agrees that Havoc LLC will retain sole ownership of all Intellectual Property even if enhancements suggested or requested by Customer become incorporated into the Services. You are not permitted to use Havoc LLC Intellectual Property without our prior written consent or as expressly provided in this Agreement.

16. Publicity

You grant Havoc LLC the right to identify you as a user in Services promotional material. At any point in time you can submit a written request via email to support@havocllc.com to have Havoc LLC remove your name, within thirty (30) days of your request, from promotional material.

17. Privacy

The Havoc LLC Online Privacy Policy for the Services is located at www.havocsupertrack.com;www.supertrack-ct.com;havoc-supertrack-prod.us-west-2.elasticbeanstalk.com/home/privacy (the “Privacy Policy”), as amended from time to time, and is hereby incorporated by reference into this Agreement. You may be requested to submit personal data in connection with your use of the Service. The ways in which Havoc LLC collects and uses personal data, and your rights to request access to and correction of your personal data, are regulated by the Privacy Policy in accordance with applicable law. You consent to the transfer of your personal data to any department or office located anywhere in the world where Havoc LLC’s global organization does business from time to time. A copy of the Privacy Policy is available on Havoc LLC’s website by clicking the link at the bottom of the page. You can request a copy of the Privacy Policy by contacting Havoc LLC’s Privacy Officer at privacyofficer@havocllc.com. To the extent Customer submits Customer Content containing personal information about its employees or other individuals, Havoc LLC’s processing of that Customer Content on Customer’s behalf is additionally governed by the Data Processing Addendum, which is incorporated by reference into this Agreement and is available upon request from Havoc LLC’s Privacy Officer.

Please contact us via email at support@havocllc.com with any questions regarding this Agreement.

Data Processing Addendum

This Data Processing Addendum (“DPA”) is entered into between Havoc LLC, doing business as SUPERTRACK (“Processor,” “Havoc LLC,” “we,” or “us”), and the customer identified in the applicable Terms of Service or order form (“Controller,” “Customer,” or “you”), and is incorporated into and forms part of the SUPERTRACK Terms of Service located at www.havocsupertrack.com;www.supertrack-ct.com;havoc-supertrack-prod.us-west-2.elasticbeanstalk.com (the “Agreement”). This DPA applies to the extent Havoc LLC processes Personal Data on behalf of Customer in the course of providing the Services. Capitalized terms not defined in this DPA have the meanings given in the Agreement.

1. Definitions

• “Data Protection Laws” means all data protection and privacy laws applicable to the processing of Personal Data under this DPA, including, as applicable, the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”).
• “Personal Data” means any information relating to an identified or identifiable natural person that is contained within Customer Content and processed by Havoc LLC on behalf of Customer under the Agreement.
• “Processing”, “Controller”, “Processor”, “Data Subject”, and “Personal Data Breach” have the meanings given in the GDPR, and “Business”, “Service Provider”, and “Sell”/“Share” have the meanings given in the CCPA, in each case to the extent applicable.
• “Subprocessor” means any third party engaged by Havoc LLC to process Personal Data in connection with providing the Services.
• “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries pursuant to the GDPR, as approved by the European Commission (Commission Implementing Decision (EU) 2021/914), together with the UK International Data Transfer Addendum, as applicable.

2. Roles of the Parties

The parties agree that, with respect to Personal Data, Customer is the Controller (or, under the CCPA, the Business) and Havoc LLC is the Processor (or, under the CCPA, the Service Provider). Customer is solely responsible for the accuracy, quality, and legality of Personal Data submitted to the Services and the means by which Customer acquired it, and for ensuring it has a valid legal basis to submit Personal Data to Havoc LLC for processing.

3. Scope and Instructions

Havoc LLC will process Personal Data only: (a) to provide, maintain, and support the Services in accordance with the Agreement; (b) in accordance with Customer’s documented instructions, including those reflected in the Agreement, this DPA, and Customer’s configuration and use of the Services; and (c) as required to comply with applicable law, in which case Havoc LLC will inform Customer of that legal requirement before processing, unless the law prohibits such notice. Havoc LLC will promptly notify Customer if, in its opinion, an instruction from Customer infringes Data Protection Laws. The subject matter, duration, nature and purpose of processing, and categories of Personal Data and Data Subjects are described in Annex A.

Havoc LLC will not (a) Sell or Share Personal Data, (b) retain, use, or disclose Personal Data for any purpose other than providing the Services, (c) retain, use, or disclose Personal Data outside the direct business relationship with Customer, or (d) combine Personal Data with personal information Havoc LLC receives from other sources, except as permitted by Data Protection Laws.

4. Confidentiality

Havoc LLC will ensure that personnel authorized to process Personal Data are subject to a duty of confidentiality (whether contractual or statutory) and process Personal Data only to the extent necessary to perform their job functions.

5. Security Measures

Havoc LLC will implement and maintain appropriate technical and organizational measures designed to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, or damage, as described in Annex B and in Section 4 of the Terms of Service. Customer acknowledges that these measures are subject to technical progress and development and that Havoc LLC may update or modify them, provided the security of the Services is not materially diminished.

6. Subprocessors

Customer provides general authorization for Havoc LLC to engage Subprocessors to process Personal Data, provided Havoc LLC: (a) maintains a list of current Subprocessors, attached as Annex C and updated from time to time; (b) imposes data protection terms on each Subprocessor that are substantially no less protective than this DPA; and (c) remains liable to Customer for each Subprocessor’s performance of its obligations. Havoc LLC will provide notice of any new Subprocessor at least 10 days before granting the new Subprocessor access to Personal Data, by emailing the customer’s designated contact. Customer may object to a new Subprocessor on reasonable data-protection grounds by notifying Havoc LLC in writing within 10 days of such notice; the parties will work in good faith to resolve the objection, and if they cannot, Customer’s sole remedy is to terminate the affected Services in accordance with the Agreement.

7. Assistance with Data Subject Requests

Taking into account the nature of the processing, Havoc LLC will provide reasonable assistance to Customer, by appropriate technical and organizational measures, to fulfill Customer's obligations to respond to requests from Data Subjects to exercise their rights under Data Protection Laws (including access, correction, deletion, restriction, portability, and objection). If Havoc LLC receives a request directly from a Data Subject regarding Personal Data it processes on Customer's behalf, Havoc LLC will not respond directly (other than to confirm receipt) and will promptly forward the request to Customer, unless legally prohibited from doing so.

8. Personal Data Breach Notification

Havoc LLC will notify Customer without undue delay, and in any event within 72 hours after becoming aware of a confirmed Personal Data Breach affecting Personal Data processed on Customer's behalf. Such notice will include, to the extent then known, a description of the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed to address the breach. Havoc LLC will provide reasonable cooperation and information to assist Customer in meeting its own breach notification obligations under Data Protection Laws.

9. Data Protection Impact Assessments

Havoc LLC will provide Customer with reasonable cooperation and information necessary for Customer to carry out any data protection impact assessment or prior consultation with a supervisory authority that Customer reasonably believes is required by Data Protection Laws, taking into account the nature of the processing and the information available to Havoc LLC.

10. Audits

Havoc LLC will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, which may include summaries or excerpts of relevant audit reports or certifications then held by Havoc LLC. If such reports are not available or not sufficient to demonstrate compliance, Customer may request an audit of Havoc LLC's relevant policies and procedures, no more than once per 12 months; subject to reasonable advance notice, confidentiality obligations, and scheduling during normal business hours so as not to unreasonably interfere with Havoc LLC's operations. Customer will bear its own costs of any audit, and reimburse Havoc LLC's reasonable costs, unless the audit reveals a material breach of this DPA.

11. International Transfers

Havoc LLC is based in, and processes Personal Data in, the United States. Where Customer's transfer of Personal Data to Havoc LLC constitutes a restricted transfer under the GDPR or UK GDPR, the parties agree that the Standard Contractual Clauses (Module Two: Controller to Processor), and the UK International Data Transfer Addendum, are incorporated by reference and will apply to that transfer, with Havoc LLC as “data importer” and Customer as “data exporter.” Where the parties have executed a separate signed copy of the SCCs and/or UK Addendum, that signed copy controls. The technical and organizational measures required by Annex II to the SCCs are as set out in Annex B to this DPA.

12. Deletion or Return of Personal Data

Upon termination or expiration of the Agreement, and subject to Customer's instructions, Havoc LLC will, within 30 days, delete or return all Personal Data processed on Customer's behalf, except to the extent applicable law requires Havoc LLC to retain some or all of the Personal Data, in which case Havoc LLC will isolate and protect that Personal Data from further processing and delete it once the retention requirement ends. This obligation is in addition to, and does not replace, any data export or retention terms set out in the Agreement.

13. Liability

Each party's liability arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitations and exclusions of liability set out in Section 9 (Limitation of Liability) of the Terms of Service, which are incorporated into this DPA by reference.

14. Term

This DPA will remain in effect for as long as Havoc LLC processes Personal Data on behalf of Customer under the Agreement, and will terminate automatically upon termination or expiration of the Agreement.

15. Order of Precedence

In the event of a conflict between this DPA and the Agreement with respect to the processing of Personal Data, this DPA controls. In the event of a conflict between this DPA and the Standard Contractual Clauses (where applicable), the Standard Contractual Clauses control.

16. Contact

Questions regarding this DPA can be directed to Havoc LLC's Privacy Officer at privacyofficer@havocllc.com.

Annex A

Annex B - Technical and Organizational Security Measures

• Encryption of data in transit via TLS and HTTPS.
• Encryption of data at rest.
• Access controls including role-based access, unique user credentials, password requirements.
• Logging and monitoring practices.
• Backup and disaster recovery procedures.
• Hosting infrastructure secured by AWS data center controls.

Annex C - List of Subprocessors

Havoc LLC will update this Annex as its Subprocessors change and will provide notice in accordance with Section 6 of this DPA.