SUBCONTRACTOR DATA AGREEMENT

Redline Design - Subcontractor Data Agreement Preamble This Subcontractor Data Agreement (the "Agreement" or "DPA") is entered into as of ("Effective Date") by and between Redline Design ("Company") and ("Subcontractor"). This Agreement sets forth the terms and conditions under which Subcontractor may Process Personal Data on behalf of Company (and/or on behalf of Company's clients) in connection with the provision of services (the "Services") as defined in the Master Services Agreement ("Principal Agreement"). In the event of any conflict between this DPA and the Principal Agreement concerning the Processing of Personal Data, this DPA shall prevail. 1. Definitions Terms such as "Applicable Data Protection Laws," "Company Personal Data," "Controller," "Data Subject," "Personal Data," "Personal Data Breach," "Processing," "Processor," and "Sub-processor" shall have the meanings aligned with relevant laws such as GDPR and CCPA/CPRA. This agreement uses these terms to ensure legal clarity. 2. Scope of Processing Instructions for Processing: Subcontractor shall Process Company Personal Data only on documented instructions from Company. Details of Processing: The subject-matter, duration, nature, purpose, types of data, and categories of Data Subjects are set forth in Annex 1 to this agreement. Compliance with Laws: Subcontractor shall comply with all Applicable Data Protection Laws. 3. Roles and Responsibilities of the Parties Company's Role: Company is either a Controller or a Processor of the Company Personal Data and warrants that it has a lawful basis to provide the data to Subcontractor for Processing. Subcontractor's Role: Subcontractor is a Processor (or Sub-processor) of the Company Personal Data. CCPA/CPRA Specific Obligations: Subcontractor confirms it is a "Service Provider" or "Contractor," shall not "sell" or "share" Company Personal Data, and shall not retain, use, or disclose the data for any purpose other than performing the Services. 4. Subcontractor's Obligations Subcontractor agrees and warrants that it shall: Process According to Instructions: Process data only as instructed by Company and shall immediately inform Company if an instruction appears to infringe on data protection laws. Confidentiality: Ensure its personnel authorized to Process Company Personal Data are bound by confidentiality. Security of Processing: Implement and maintain appropriate technical and organizational security measures as detailed in Annex 2 to protect Company Personal Data. Sub-processing: Not engage any other Sub-processor without prior written authorization from Company and will impose the same data protection obligations on them via a written contract. Subcontractor remains fully liable for the performance of its Sub-processors. International Data Transfers: Not transfer Company Personal Data to a restricted country without Company's consent and without appropriate safeguards (e.g., Standard Contractual Clauses) in place. 

Assistance to Company: Assist Company in responding to Data Subject rights requests and in meeting its own compliance obligations regarding security, breach notification, and data protection impact assessments. Personal Data Breach Notification: Notify Company without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach. The notification will describe the nature of the breach, likely consequences, and measures taken. Data Deletion or Return: At Company's choice, delete or return all Company Personal Data after the end of the Services and provide written certification of such deletion. Information and Audit: Make available all information necessary to demonstrate compliance and allow for audits conducted by Company or a mandated auditor. 5. Company's Obligations Company shall provide clear and lawful instructions, ensure it has a valid lawful basis for the Processing, and inform Subcontractor of any relevant changes. 6. Audit Rights Company has the right to conduct audits (not more than once annually, unless a breach occurs) to verify Subcontractor's compliance with this DPA. Subcontractor may provide relevant third-party audit reports (e.g., SOC 2 Type II) as an alternative. 7. Liability and Indemnification Liability: Each Party's liability is subject to the limitations in the Principal Agreement, but these shall not limit liability for gross negligence, willful misconduct, or breaches of confidentiality related to Personal Data. Indemnification: Subcontractor shall indemnify and hold harmless Company from any claims or losses arising from Subcontractor's breach of this DPA. Insurance: Subcontractor shall maintain appropriate Commercial General Liability, Professional Liability, and Cyber Liability insurance. 8. Term and Termination This DPA remains in effect as long as Subcontractor Processes Company Personal Data. Company may terminate this DPA and the Principal Agreement for a material breach by Subcontractor. Obligations regarding confidentiality and data deletion shall survive termination. 9. Governing Law and Jurisdiction This DPA is governed by the laws of [Jurisdiction to be specified], and the courts of [Jurisdiction to be specified] shall have exclusive jurisdiction. 10. Miscellaneous This DPA, along with its Annexes and the Principal Agreement, constitutes the entire agreement. No amendment is effective unless in writing and signed by both Parties. In case of conflict, this DPA prevails over the Principal Agreement regarding data Processing. Annex 1: Details of Processing This annex will be completed by the Parties to specify the subject-matter, duration, nature, and purpose of the Processing, as well as the types of Personal Data and categories of Data Subjects involved. It will also list any approved Sub-processors. 

Annex 2: Minimum Security Measures 

This annex details the minimum technical and organizational security measures Subcontractor must implement. These include maintaining information security policies, enforcing strong access controls with MFA, encrypting data at rest and in transit, implementing network security controls like firewalls and IDS/IPS, maintaining physical security, having a documented incident response plan, ensuring business continuity, and adhering to secure software development practices.