US State Privacy Laws Addendum

Effective date: August 5, 2026

This US State Privacy Laws Addendum (the “US Addendum”) is incorporated into and forms part of the Data Processing Agreement (the “DPA”) between the customer (the “Customer”) and AI LAWTECH sp. z o.o. (“Referent”), which in turn forms part of the Agreement under which the Customer is licensed to use the Referent platform (the “Service”).

This US Addendum applies to the extent Referent processes Personal Information on the Customer’s behalf that is subject to US State Privacy Laws. In the event of a conflict between this US Addendum and the DPA with respect to Personal Information subject to US State Privacy Laws, this US Addendum prevails.

In all other respects the DPA continues in full force, including its Annex 1 (details of processing), Annex 2 (technical and organisational measures) and Annex 3 (sub-processors).

Scope and defined laws

1.1. “US State Privacy Laws” means, as applicable to the processing:

(a) the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, together with its implementing regulations and any amendments (the “CCPA”);
(b) the Texas Data Privacy and Security Act (the “TDPSA”);
(c) the Virginia Consumer Data Protection Act;
(d) the Colorado Privacy Act;
(e) the Connecticut Data Privacy Act;
(f) the Utah Consumer Privacy Act;
(g) the Oregon Consumer Privacy Act;
(h) the Montana Consumer Data Privacy Act;
(i) the Delaware Personal Data Privacy Act;
(j) the Iowa Consumer Data Protection Act;
(k) the Nebraska Data Privacy Act;
(l) the New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island comprehensive consumer privacy statutes;
(m) together, in each case including their implementing regulations and amendments, and any other comprehensive US state consumer privacy law that takes effect after the date of this US Addendum.

1.2. Defined terms. “Personal Information”, “Personal Data”, “Business”, “Service Provider”, “Contractor”, “Controller”, “Processor”, “Consumer”, “Sell”, “Share”, “Deidentified” and “Sensitive Personal Information” have the meanings given to them in the applicable US State Privacy Laws. “Content”, “Customer Personal Data” and “Sub-processor” have the meanings given in the DPA. For clarity, Personal Information processed under this US Addendum is Customer Personal Data for the purposes of the DPA.

1.3. Roles. With respect to Personal Information subject to US State Privacy Laws:

(a) under the CCPA, the Customer is a Business and Referent is a Service Provider;
(b) under all other US State Privacy Laws, the Customer is a Controller and Referent is a Processor.

1.4. The Customer is responsible for complying with its own obligations as a Business or Controller under the US State Privacy Laws, including providing notices to, and honouring requests from, Consumers.

CCPA-specific terms

2.1. For the purposes of compliance with the CCPA, Referent agrees that:

(a) Personal Information is disclosed by the Customer to Referent only for the limited and specified purposes set out in the Agreement and the DPA, and Referent shall not retain, use or disclose Personal Information for any other purpose, except as permitted by the CCPA and as expressly stated in Section 4 of this US Addendum;
(b) Referent shall comply with the applicable obligations under the CCPA and shall provide the same level of privacy protection as is required of a Business by the CCPA;
(c) the Customer has the right (but not the obligation) to take reasonable and appropriate steps to monitor Referent’s compliance with this US Addendum and to help ensure that Referent uses Personal Information in a manner consistent with the Customer’s obligations under the CCPA;
(d) Referent shall notify the Customer promptly in writing if it determines that it can no longer meet its obligations under the CCPA;
(e) on such notice, or otherwise where the Customer reasonably believes Personal Information is being used without authorisation, the Customer has the right to take reasonable and appropriate steps to stop and remediate unauthorised use of Personal Information;
(f) Referent shall not Sell or Share Personal Information;
(g) Referent shall not retain, use, cache or disclose Personal Information for any purpose other than performing the services under the Agreement, or outside the direct business relationship between the Customer and Referent, except as permitted by the CCPA and Section 4 of this US Addendum;
(h) Referent shall not combine Personal Information received from, or on behalf of, the Customer with Personal Information it receives from, or on behalf of, another person, or collects from its own interaction with a Consumer, except as expressly permitted by the CCPA;
(i) Referent shall enable the Customer to comply with Consumer requests under the CCPA, as further set out in the DPA and Section 3.1(d) of this US Addendum;
(j) where Referent engages a Sub-processor to process Personal Information, it shall do so under a written contract that binds the Sub-processor to obligations no less protective than those imposed on Referent under this US Addendum, and Referent remains responsible for the Sub-processor’s performance as if it were its own. Sub-processors are notified and may be objected to as set out in Section 7 of the DPA;
(k) on the Customer’s request, Referent shall delete or return all Personal Information at the end of the provision of the services, unless retention is required by law, in accordance with Section 13 of the DPA;
(l) Referent handles Deidentified information in accordance with Section 4 of this US Addendum; and
(m) Referent acknowledges and certifies that it understands and will comply with the restrictions and obligations set out in this Section 2.

2.2. Sensitive Personal Information. Where the Content includes Sensitive Personal Information, Referent processes it only for the purposes permitted under the CCPA and the Agreement, and does not use it to infer characteristics about a Consumer.

Terms applicable to all other US State Privacy Laws

3.1. For the purposes of compliance with the US State Privacy Laws other than the CCPA, Referent agrees that:

(a) Instructions. The Customer instructs Referent to process Personal Data solely for the purposes set out in the Agreement and the DPA. The nature and purpose of the processing, the type of Personal Data, the categories of Consumers and the duration of the processing are set out in Annex 1 to the DPA;
(b) Security. Referent shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as further described in Annex 2 to the DPA;
(c) Confidentiality. Each person processing Personal Data on Referent’s behalf is subject to a written duty of confidentiality with respect to that Personal Data, in accordance with Section 5 of the DPA;
(d) Consumer rights. Taking into account the nature of the processing and the information available to it, Referent shall assist the Customer, through appropriate technical and organisational measures and as reasonably practicable, in responding to Consumer rights requests;
(e) Security and breach assistance. Referent shall assist the Customer with its obligations relating to the security of processing and, where applicable, the notification of a breach of security of Referent’s systems, taking into account the nature of the processing and the information available to Referent. Referent notifies the Customer of a Personal Data Breach as set out in Section 11 of the DPA;
(f) Assessments. Referent shall provide the information necessary to enable the Customer to conduct and document data protection assessments, and shall allow and cooperate with reasonable assessments by the Customer or the Customer’s designated assessor. In the alternative, and as expressly permitted by the TDPSA, Referent may arrange for a qualified and independent assessor to assess its policies and technical and organisational measures using an appropriate and accepted control standard or framework and assessment procedure, and provide a report of that assessment to the Customer on request. Referent is pursuing SOC 2 certification.
(g) Demonstrating compliance. Referent shall make available to the Customer, on reasonable request, all information in its possession necessary to demonstrate its compliance with the applicable US State Privacy Laws, as further set out in Section 12 of the DPA;
(h) Sub-processors. Referent shall engage any Sub-processor under a written contract requiring the Sub-processor to meet the obligations of Referent with respect to the Personal Data, in accordance with Section 7 of the DPA;
(i) Deletion or return. At the Customer’s direction, Referent shall delete or return all Personal Data to the Customer after the provision of the services is completed, unless retention is required by law, in accordance with Section 13 of the DPA.

Deidentified and aggregated data

4.1. This Section states the only circumstances in which Referent uses data derived from the Content for its own purposes. It is consistent with, and does not expand, Referent’s rights under the DPA and the Terms of Service.

4.2. Referent does not use Personal Information for its own commercial purposes, does not use it to build or improve services provided to any other customer, and does not use the Content to train or improve generative artificial intelligence models, nor does it permit its AI Sub-processors to do so.

4.3. Deidentified and aggregated data. Referent may create and use deidentified and aggregated data derived from use of the Service in order to operate, secure, analyse and improve the Service, including to monitor and improve the quality of its AI features. Such data does not identify, and cannot reasonably be used to identify, the Customer, any User, any Consumer or any other individual, and does not constitute Personal Information under the CCPA or Personal Data under the other US State Privacy Laws.

4.4. Where Referent creates or receives Deidentified information, Referent shall:

(a) take reasonable measures to ensure that the information cannot be associated with, or reasonably linked to, a Consumer, household or device;
(b) publicly commit to maintain and use the information only in deidentified form and not to attempt to reidentify it, except as permitted by law solely to test the effectiveness of its deidentification measures;
(c) not attempt to reidentify the information; and
(d) contractually obligate any recipient of such information to the same commitments.

4.5. To the extent Referent uses Personal Information for internal purposes, it does so only as expressly permitted by the CCPA for a Service Provider’s internal use to build or improve the quality of the services it provides to the Customer, and never to build or improve services provided to another business, to build a profile about a Consumer, or for any purpose prohibited by Section 2.

Artificial intelligence

5.1. The Service includes features that use artificial intelligence to assist the Customer’s users, as described in the DPA and the Terms of Service. AI features are assistive only and do not make decisions producing legal or similarly significant effects on any individual on a solely automated basis; the Customer’s users review and decide.

5.2. Where Personal Data is collected, stored or processed by an artificial intelligence system, Referent shall assist the Customer with regard to the security of that processing, as required by the TDPSA, taking into account the nature of the processing and the information available to Referent. This Section reflects Tex. Bus. & Com. Code § 541.104(a)(2) as amended with effect from 1 January 2026.

5.3. Referent contractually prohibits its AI Sub-processors from using the Content or Personal Information to train or improve their general-purpose models. The AI Sub-processors engaged by Referent are listed in Annex 3 to the DPA.

5.4. Referent does not use AI model providers established in China.

5.5. The Customer remains responsible for any disclosures required toward its own clients and other individuals regarding the use of artificial intelligence, automated processing and the nature and limitations of AI-generated content, as set out in the DPA and the Terms of Service. Referent makes model disclosure text and Sub-processor details available to support this.

Processing locations and transfers

6.1. For Users located in the United States, the Service is provided from infrastructure located in the United States. Certain processing nevertheless takes place in the European Economic Area, including by Referent’s personnel and by the Sub-processors listed in Annex 3 to the DPA. Personal Information subject to US State Privacy Laws may therefore be processed outside the United States, including in the European Economic Area.

6.2. The US State Privacy Laws do not restrict such processing, and Referent applies the security measures in Annex 2 to the DPA regardless of processing location. The Customer acknowledges and instructs this processing.

Relationship with the DPA and the Agreement

7.1. This US Addendum supplements the DPA. Except as expressly modified here, all terms of the DPA continue to apply, including confidentiality, security, sub-processing, breach notification, audit, deletion and liability.

7.2. The order of precedence for Personal Information subject to US State Privacy Laws is: (1) this US Addendum; (2) the DPA; (3) the Agreement. For personal data subject to the GDPR or UK GDPR, the DPA and its transfer mechanisms continue to govern.

7.3. Nothing in this US Addendum requires either party to act in a manner that would breach the US State Privacy Laws.

Term

8.1. This US Addendum takes effect on acceptance of the Agreement and remains in force for as long as Referent processes Personal Information subject to US State Privacy Laws on the Customer’s behalf.

AI LAWTECH sp. z o.o. · Henryka Sienkiewicza 36/5, 26-600 Radom, Poland · NIP 9482639603

Privacy contact: privacy@referent.law · Legal notices: contact@referent.law