Data Processing Addendum

PostroomIQ: Email to Board

Effective date: October 17, 2026

This Data Processing Addendum ("DPA") forms part of the PostroomIQ Terms of Service between you, the monday.com account that installs PostroomIQ ("Customer," "you"), and Alpenglow Software LLC ("we," "us," "Processor"). It applies automatically when you accept the Terms, and covers the personal data we process on your behalf through the App ("Customer Personal Data"). If this DPA conflicts with the Terms or the Privacy Policy on the processing of Customer Personal Data, this DPA controls.

1. Roles

You are the controller of Customer Personal Data (or a processor acting for your own client, in which case we are your sub-processor). We are your processor, and a "service provider" or "processor" under US state privacy laws. For account and usage data we use to run our business, we act as an independent controller under our Privacy Policy, and this DPA does not apply to it.

2. Details of Processing

• Subject matter and purpose: providing the App: receiving emails sent to your intake addresses, reading them with an AI model, extracting the fields your template asks for, writing items and updates to your monday.com boards, the review queue, and related support and security.
• Nature: receipt, storage, AI extraction, transmission to monday.com, and deletion.
• Duration: while the App is installed, plus the deletion periods in Section 9 and the Privacy Policy.
• Categories of data subjects: senders and recipients of emails sent to your intake addresses, and people named in those emails or their attachments (for example, your customers, vendors, prospects, and their staff); your users of the App.
• Categories of personal data: names, business contact details (email addresses, phone numbers, postal addresses), job titles, company names, order, invoice, and lead details, email metadata, and any other personal data that appears in emails you send to the App. You agree not to send the data the Terms exclude (including health information, recruiting data, documents collecting taxpayer identification numbers, and payment card numbers). No special categories of personal data are intended.

3. Instructions

We process Customer Personal Data only on your documented instructions, which are the Terms, this DPA, and your configuration and use of the App, unless the law requires otherwise; in that case we will tell you first unless the law forbids it. We will tell you if we believe an instruction breaks data protection law.

4. Confidentiality

Anyone we authorize to process Customer Personal Data is bound by confidentiality. Our staff do not access the content of your emails, attachments, or extracted values except with your written permission for a specific support case, to fulfil a data request you make, to investigate a security incident or abuse of an intake address, or where required by law, and we never use that content in evaluation or test sets, or to train AI or machine-learning models, unless you opt in.

5. Security

We maintain appropriate technical and organizational measures, described in Section 3 of the Privacy Policy, including encryption in transit for connections the App makes, encryption of stored personal data (other than identifiers and the other unencrypted fields listed in Section 3 of the Privacy Policy) and of monday.com tokens (AES-256-GCM, with keys kept in monday code's secret store), account-scoped data access, treating every email as untrusted, logs designed to exclude email content, and deletion schedules. We may update these measures as long as the overall level of protection does not decrease.

6. Sub-processors

You give us general authorization to use sub-processors. The current list is in Section 4 of the Privacy Policy, under "Sub-processors of your email data". We impose on each sub-processor, under written terms (which may be the sub-processor's standard data processing terms), data protection obligations that are no less protective than this DPA, and we remain responsible for their performance. Before we add or replace a sub-processor that processes Customer Personal Data, we will give at least 15 days' notice by email to your account's admin contact or in the App. You may object on reasonable data protection grounds within that period; if we cannot address your objection, you may uninstall the App before the change takes effect.

7. Assistance

• Data subject requests: if a person contacts us about Customer Personal Data, we will refer them to you. We will help you respond to requests to access, correct, delete, or export data, including by providing a machine-readable copy or deleting your account's data on request, within 30 days.
• Impact assessments and consultations: we will give you reasonable information about the App's processing to help with data protection impact assessments and consultations with authorities.
• Personal data breaches: if we become aware of a personal data breach affecting Customer Personal Data, we will notify monday.com within 24 hours, as our agreement with monday.com requires, and then notify you without undue delay and in any event within 72 hours of becoming aware of it, with the information you reasonably need to meet your own obligations, and we will take reasonable steps to contain it.

8. Audits

On written request, and no more than once a year unless a breach or an authority requires it, we will provide the information reasonably necessary to demonstrate our compliance with this DPA, starting with written answers to a security questionnaire. If that information is not sufficient to demonstrate compliance, you (or an independent auditor you appoint, bound by confidentiality) may conduct a reasonable audit on at least 30 days' notice, during business hours, at your cost, and in a way that does not compromise other customers' data. Requests go to the contact address below.

9. Deletion and Return

When you uninstall the App, we delete the Customer Personal Data we store within 10 days, except the records listed in Section 9 of the Terms, which you consent to our keeping for the periods stated there and which hold no email content, contact details, or extracted values. While installed, processing records are deleted after 12 months. Before uninstalling, you may ask for a copy of your data. Data the App wrote to your boards stays in monday.com under your control. Our email provider keeps each received email for 30 days, as described in the Privacy Policy.

10. International Transfers

We process Customer Personal Data in the United States, and our sub-processors may process it where they operate. Where a transfer of personal data from the European Economic Area, Switzerland, or the United Kingdom to us requires a transfer mechanism, the following are incorporated into this DPA by reference:

• the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 ("SCCs"), Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor, with you as data exporter and us as data importer. Clause 7 (docking) does not apply; Clause 9 option 2 (general authorization, with the notice period in Section 6) applies; the optional wording in Clause 11 does not apply; Clauses 17 and 18 are governed by, and disputes resolved in the courts of, Ireland; and Annexes I and II are completed by Sections 2 and 5 of this DPA, with the competent supervisory authority determined under Clause 13;
• for transfers from the United Kingdom, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0), with the tables completed by this DPA and either party able to end it as allowed by its Section 19; and
• for transfers from Switzerland, the SCCs as adapted for the Swiss Federal Act on Data Protection, with the Swiss Federal Data Protection and Information Commissioner as the competent authority.

If the SCCs conflict with this DPA, the SCCs control.

11. US State Privacy Laws

Where US state privacy laws (such as the California Consumer Privacy Act) apply, we act as your service provider or processor. We will not sell or share Customer Personal Data (as those laws define "sell" and "share"); retain, use, or disclose it for any purpose other than providing the App to you, or outside our direct business relationship with you; or combine it with personal data we receive from other sources, except as those laws allow. We will comply with our obligations under those laws and provide the same level of privacy protection they require of you; you may take reasonable and appropriate steps to ensure we use Customer Personal Data consistently with your obligations, and, on notice, to stop and remediate unauthorized use; and we will bind our sub-processors to the same restrictions. We will tell you if we can no longer meet these obligations.

12. Liability

Each party's liability under this DPA is subject to the limitations of liability in the Terms, except where the law does not allow it.

13. Contact