Data Processing Addendum

Effective October 21, 2026

This Data Processing Addendum ("DPA") is between J&T Solutions Inc., a Delaware corporation doing business as Diced, 251 Little Falls Drive, Wilmington, DE 19808, United States ("Diced"), and the customer that accepted the Terms of Service ("Customer"). It is part of the Terms and applies automatically. You do not need to sign it. If you need a countersigned copy, email legal@diced.si.

Words defined in the Terms have the same meaning here. If this DPA and the Terms conflict on a matter of personal data, this DPA controls.

1. Why this DPA has two parts

Diced handles personal information in two different roles, and the rules differ for each. Getting the role right matters, because privacy laws give different duties to each.

Lead Data: Diced is an independent controller. Diced decides why and how it collects Lead Data, licenses it from its sources, and sells it to customers. Diced is the "business" and "controller" for Lead Data, and a data broker. When Customer receives Lead Data, Customer becomes a separate, independent controller of its copy and decides for itself how to use it. Customer is a "third party" to which Diced sells personal information, as the California Consumer Privacy Act uses that term. Diced and Customer are not joint controllers, and neither processes Lead Data on the other's behalf. Part B applies.

Customer Data: Diced is a processor. When Customer uploads its own lists for enrichment, enters lookup values, or writes "describe your buyer" prompts, Diced processes that data only to provide the Services to Customer. For this data, Diced is Customer's "processor" and "service provider". Part A applies.

Where the two meet. An enrichment lookup has both. The email, phone, IP address, postal address or hash that Customer submits is Customer Data. A match that Diced returns is Lead Data, and the chip Customer pays is the price of that sale. Diced does not add Customer's input values to its lead database, and does not use them to build or improve data that Diced sells to others. [CONFIRM: the code keeps inputs only in the enrichment job and its files. Confirm the data partner agreement does not let the partner keep or use lookup inputs, see section 5.]

Account Data. Information Diced needs to run Customer's account, such as user names, emails, billing and usage records, is Diced's own data as an independent controller. The Privacy Notice covers it. This DPA does not.

Part A. Customer Data, Diced as processor

2. Scope

Part A applies to personal information in Customer Data that Diced processes for Customer. The details of the processing are in Annex 1.

3. Customer's obligations

Customer is responsible for having a lawful basis, giving the notices and getting the consents needed for Diced to process Customer Data as described here.

Customer will not submit to the Services:

• sensitive personal information, such as health data, Social Security numbers, financial account numbers, or data revealing racial or ethnic origin, religion, sexual orientation or immigration status;
• personal information of children under 16;
• personal information of people in the European Economic Area, the United Kingdom or Switzerland.

4. Diced's obligations

Diced will:

• process Customer Data only to provide, secure and support the Services, under Customer's documented instructions. The Terms, this DPA and Customer's use of the Services are those instructions;
• tell Customer if it believes an instruction breaks the law;
• make sure people who process Customer Data are bound by confidentiality;
• protect Customer Data with the security measures in Annex 2;
• help Customer, taking into account the nature of the processing, to respond to requests from individuals and to complete data protection assessments, using the features of the Services. Diced may charge for help beyond what the Services provide;
• delete or return Customer Data as section 9 describes.

Service provider terms. As a service provider and processor under the California Consumer Privacy Act and other state privacy laws, Diced will not:

• sell or share Customer Data;
• keep, use or disclose Customer Data for any purpose other than the business purposes in Annex 1, or outside its direct business relationship with Customer;
• combine Customer Data with personal information it receives from other sources or collects itself, except as the law allows a service provider to do.

Diced will comply with the California Consumer Privacy Act and give Customer Data the same level of privacy protection it requires. Customer may take reasonable steps to stop and fix unauthorized use of Customer Data. Diced will tell Customer if it can no longer meet its obligations. Diced certifies that it understands these restrictions.

No AI training. Diced does not use Customer Data to train AI models. Prompts sent to OpenRouter for the "describe your buyer" feature are used only to answer that request. [CONFIRM: OpenRouter and routed model provider terms on logging, retention and training. The code does not set a provider data policy on requests today.]

Aggregated data. Diced may create aggregated or deidentified information from use of the Services, such as counts of requests or match rates, if it cannot reasonably be linked to Customer or to a person.

5. Subprocessors and data partners

Customer authorizes Diced to use the subprocessors listed on our subprocessors page. Diced has a written contract with each that protects Customer Data at least as much as this DPA, and Diced is responsible for them.

Diced will update the subprocessors page at least 30 days before a new subprocessor starts processing Customer Data, and will email workspace owners. In an emergency, notice may be shorter. Customer may object on reasonable data protection grounds within 15 days by emailing legal@diced.si. If the parties cannot resolve the objection within 30 days, Customer may end the affected Services, and Diced will refund the purchase price of Customer's unexpired, unspent pack and plan chips. That is Customer's only remedy for an objection. [CONFIRM: refund remedy, given chips are otherwise non-refundable.]

Data partners for enrichment. To find a match for an enrichment lookup, Diced sends the lookup value, such as an email address, to its licensed data partners. They use it only to return a matching record to Diced. [CONFIRM: this is a disclosure of Customer Data to a third party that is not on the subprocessors page. Counsel must decide whether the partner must be listed as a subprocessor for the enrichment feature, whether it can be described without being named, and whether the partner agreement restricts the partner's retention and use of lookup inputs.]

6. Security incidents

If Diced confirms a security incident that leads to unauthorized access to, or loss, disclosure or alteration of, Customer Data, Diced will tell Customer without undue delay, and in any event within 72 hours after confirming it. Diced will describe the incident, what data is affected as far as it knows, and what it is doing about it, and will update Customer as it learns more. Diced will cooperate with Customer's investigation. Customer decides whether to notify regulators and individuals about Customer Data, unless the law requires Diced to.

Telling Customer about an incident is not an admission of fault.

7. Audits

Once every 12 months, on written request, Diced will answer a reasonable security questionnaire and give information needed to show compliance with this DPA. Customer may also audit after a confirmed security incident affecting Customer Data, or when a regulator requires it. Audits need 30 days' notice, an agreed scope, must happen in business hours without disrupting the Services, and must be done by Customer or an independent auditor that is not a Diced competitor, under confidentiality. Customer pays for its audit.

8. Government requests

If a government authority asks Diced for Customer Data, Diced will refer it to Customer where it can, tell Customer unless the law forbids it, and disclose only what the law requires.

9. Deletion and return

Customer can download enrichment results and export its leads while its workspace exists.

• Uploaded enrichment files and lead export files are deleted automatically 7 days after creation.
• Enrichment results are kept as long as the enrichment job, which lasts as long as the workspace.
• When a workspace owner deletes a workspace, Diced deletes its Customer Data from the database right away, and removes its stored files.
• When the Terms end for another reason, Diced deletes Customer Data within 90 days.

Backups are overwritten in the normal backup cycle. [CONFIRM: Supabase backup and point-in-time recovery window.] Diced may keep data the law requires it to keep, under this DPA's protections.

Part B. Lead Data, Diced and Customer as independent controllers

10. Each party's responsibilities

Each party is responsible for its own compliance with privacy laws for the Lead Data it controls.

Diced is responsible for:

• collecting and licensing Lead Data lawfully from its sources;
• its data broker registrations and the notices it must give as a data broker;
• honoring requests that people send to Diced to opt out, delete, access or correct their information, and requests through California's DROP platform;
• keeping its suppression list and removing suppressed people from the Lead Data it offers.

Customer is responsible for:

• its own use of Lead Data, including all outreach, under the Terms and the Acceptable Use Policy;
• any notice the law requires it to give people when it receives their information from a data broker, and any consent it needs before contacting them;
• honoring requests that people send to Customer;
• its own security for Lead Data it holds.

11. Terms for receiving personal information that Diced sells

The California Consumer Privacy Act, and other state laws, require these terms when a business sells personal information to a third party. Customer agrees that:

1. Limited purposes. Customer receives Lead Data only for its own lawful marketing, sales and prospecting, as the Terms describe, and will use it only for those purposes.
2. Compliance. Customer will comply with the California Consumer Privacy Act and other applicable privacy laws for Lead Data, and will give Lead Data the same level of privacy protection those laws require.
3. Diced's right to check. Diced may take reasonable and appropriate steps to make sure Customer uses Lead Data consistently with these obligations. For example, Diced may ask Customer to complete a compliance questionnaire or to certify its practices.
4. Notice of problems. Customer will tell Diced within 10 business days if it decides it can no longer meet these obligations.
5. Stopping misuse. If Diced reasonably believes Customer is using Lead Data without authorization, Diced may suspend access and require Customer to stop the use and fix it, including by deleting the affected data.
6. No resale. Customer will not sell, share or disclose Lead Data to anyone else, except to its own service providers and contractors under contracts that limit their use to serving Customer.
7. Opt-outs and deletion. If Diced tells Customer that a person has opted out of sale or asked for deletion, Customer will stop using that person's Lead Data for marketing within 15 days, and will delete it if Diced asks, unless the law lets Customer keep it. [CONFIRM: Diced does not send these notices today. Decide when the law requires Diced to forward opt-outs and deletions to customers that already received the data, and build the mechanism.]
8. No reidentification. Customer will not try to reidentify deidentified or masked data.
9. Sensitive data. Customer will not use Lead Data to infer or target sensitive characteristics, as the Acceptable Use Policy describes.

12. Cooperation

Each party will give the other reasonable help with a regulator inquiry or a person's request that involves the other's Lead Data responsibilities. If Customer gets a request from a person asking Diced to stop selling or to delete their information, Customer will tell the person to use Diced's privacy request page, or forward the request to legal@diced.si.

Part C. General

13. Transfers outside the United States

Diced stores and processes data in the United States. The Services are not meant for data about people in the European Economic Area, the United Kingdom or Switzerland, and this DPA does not include Standard Contractual Clauses. [CONFIRM: if non-U.S. customers are accepted, decide whether to add the EU Standard Contractual Clauses and the UK Addendum.]

14. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms.

15. Term and changes

This DPA lasts as long as Diced processes Customer Data or Customer holds Lead Data. Diced may update it to reflect changes in law or in the Services. Diced will post updates with a new date, and give 30 days' notice of material changes by email to workspace owners. Disputes about this DPA are resolved under the Terms.

Annex 1. Details of the processing of Customer Data

Annex 2. Security measures

• Data is encrypted in transit with TLS, and stored data is encrypted at rest by our hosting providers.
• Row-level security in the database limits access to members of each workspace. Privileged database access is used only by server code.
• API keys are stored only as SHA-256 hashes and shown once. Webhook signing secrets are encrypted.
• Export download links are signed and expire after 15 minutes.
• Webhook URLs must use HTTPS, and requests to private network addresses are blocked.
• Rate limits, captchas and CSRF protection guard sign-in, forms and the API.
• Errors from upstream systems are not shown to customers, and personal information is removed from logs where possible.
• Only a small, named group of Diced staff can use administrative tools, through an allowlist.
• Uploaded files and exports are deleted on a schedule, as section 9 describes.

[CONFIRM: these measures match the deployed system. Add staff security training, access reviews and incident response procedures if Diced has them.]

Contact

J&T Solutions Inc., doing business as Diced Attn: Legal 251 Little Falls Drive, Wilmington, DE 19808, United States

• Privacy, security and DPA questions: legal@diced.si
• Support: support@diced.si