Prefect's Data Processing Addendum

EFFECTIVE DATE: April 17, 2026

This Data Processing Addendum (this "Addendum") forms part of, and is incorporated into, the Prefect Terms and Conditions (the "Agreement") for the provision of Prefect services (as amended from time to "Prefect" or "Company") and the customer entity that is a party to the Agreement ("Client"). We may update this Addendum from time to time, and we will provide reasonable notice of any such updates. Any terms not defined in this Addendum shall have the meanings set forth in the Agreement.

1. DEFINITIONS

"Affiliate" means (i) an entity of which a party directly or indirectly owns fifty percent (50%) or more of the stock or other equity interest, (ii) an entity that owns at least fifty percent (50%) or more of the stock or other equity interest of a party, or (iii) an entity which is under common control with a party by having at least fifty percent (50%) or more of the stock or other equity interest of such entity and a party owned by the same person, but such entity shall only be deemed to be an Affiliate so long as such ownership exists.

"Client Account Data" means personal data that relates to Client's relationship with Company, including the names or contact information of individuals authorized by Client to access Client's account and billing information of individuals that Client has associated with its account. Client Account Data also includes any data Company may need to collect for the purpose of managing its relationship with Client, identity verification, or as otherwise required by applicable laws and regulations.

"Client Usage Data" means Service usage data collected and processed by Company in connection with the provision of the Services, including without limitation data used to identify the source and destination of a communication, activity logs, and data used to optimize and maintain performance of the Services, and to investigate and prevent system abuse.

"Data Exporter" means Client.

"Data Importer" means Company.

"Data Protection Laws" means any applicable laws and regulations in any relevant jurisdiction relating to the use or processing of Personal Data (in each case, as updated, amended or replaced from time to time) including:

• "EU Data Protection Law": Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) ("GDPR") and the EU e-Privacy Directive (Directive 2002/58/EC), each as implemented and transposed into local law by any EU member states.

• "Swiss DPA": the Swiss Federal Act on Data Protection 1992 (including as amended or superseded).

• "UK Data Protection Law": the UK Data Protection Act and GDPR as incorporated into UK law by the Data Protection Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (each as amended, superseded, or replaced).

• "US Data Protection Law": all applicable comprehensive state Applicable Privacy Laws and regulations in each case as may be amended or superseded from time to time, including the California Privacy Rights Act ("CPRA"); Colorado Privacy Act; Connecticut Personal Data Privacy and Online Monitoring Act; Delaware Personal Data Privacy Act; Indiana Consumer Data Protection Act; Iowa Consumer Data Protection Act; Montana Consumer Data Privacy Act; Oregon Consumer Privacy Act; Tennessee Information Protection Act; Texas Data Privacy and Security Act; Utah Consumer Privacy Act; Virginia Consumer Data Protection Act.