Data Processing Addendum

Last Updated: May 28, 2026

Introduction

This Data Processing Addendum ("DPA") forms part of the agreement between Pax AI, Inc. ("Pax", "we", "us") and the customer ("Customer", "you") governing the provision of the Pax trade compliance platform and related services (the "Services"). It describes how Pax processes personal data and customer trade data on your behalf.

In the event of a conflict between this DPA and the main agreement, this DPA governs with respect to the processing of personal data.

Definitions

  • Customer Data means the trade, entry, export, financial, and supporting documentation you submit to the Services.
  • Personal Data means any information relating to an identified or identifiable natural person that is contained within Customer Data.
  • Processing means any operation performed on personal data, whether by automated means or otherwise.
  • Sub-processor means a third party engaged by Pax to process personal data in connection with the Services.

Roles of the Parties

For Customer Data submitted to the Services, you act as the controller and Pax acts as the processor. Pax processes Customer Data only on your documented instructions, including as set out in the agreement and this DPA, unless required to do otherwise by applicable law.

Scope and Purpose of Processing

Pax processes Customer Data solely to:

  • Provide, maintain, and improve the Services;
  • Classify goods, evaluate eligibility, and prepare and file trade compliance submissions on your behalf;
  • Provide support and respond to your requests; and
  • Comply with applicable law, including obligations to U.S. Customs and Border Protection.

We do not sell Customer Data, and we do not use it to train models that are made available to other customers without your authorization.

Confidentiality

Pax ensures that personnel authorized to process Customer Data are bound by appropriate confidentiality obligations and receive training relevant to their responsibilities.

Security Measures

Pax maintains technical and organizational measures designed to protect Customer Data against unauthorized access, loss, or disclosure, consistent with our SOC 2 program. These include encryption in transit and at rest, access controls, logging and monitoring, and a documented incident response process.

Sub-processors

You authorize Pax to engage sub-processors to support delivery of the Services. Pax imposes data protection obligations on each sub-processor that are no less protective than those in this DPA and remains responsible for their performance. A current list of sub-processors is available on request.

Data Subject Requests

Pax will, to the extent legally permitted, promptly notify you if it receives a request from a data subject to exercise their rights. Taking into account the nature of the processing, Pax will provide reasonable assistance to enable you to respond to such requests.

Data Breach Notification

Pax will notify you without undue delay after becoming aware of a personal data breach affecting Customer Data and will provide information reasonably necessary for you to meet your own notification obligations.

International Transfers

Where Pax transfers personal data across borders, it does so in accordance with applicable data protection law and using a lawful transfer mechanism.

Retention and Deletion

Pax retains Customer Data for as long as necessary to provide the Services and to comply with legal and regulatory recordkeeping obligations applicable to trade compliance filings. Upon termination, and subject to those obligations, Pax will delete or return Customer Data on your request.

Contact

For questions about this DPA or our data processing practices, contact us at [email protected].