GDPR

Avalanche Computing Taiwan Inc. GDPR DataProcessing Addendum

This GDPR Data Processing Addendum("DPA") is entered into between:

Avalanche Computing Taiwan Inc., a company registered under the laws of Taiwan, with its registered office at 2F., No. 34,
Sec. 4, Renai Rd., Daan Dist.,Taipei City, Taiwan ("Data
Controller"),

and

Avalanche Computing, a SaaS AI development tool, with its principal office at 2F., No. 34, Sec. 4, Renai Rd., Daan Dist.,Taipei
City, Taiwan ("Data Processor").

This DPA forms part of the Agreement between the Data Controller and Data Processor (the "Agreement") and
is effective as of [Effective Date].

1. Definitions

1.1 "GDPR" means the General Data Protection Regulation (EU) 2016/679.

1.2 "Data Subject" has the meaning ascribed to it in the GDPR.

1.3 "Data Processing" has the meaning ascribed to it in the GDPR.

1.4 "Personal Data" has the meaning ascribed to it in the GDPR.

2. Data Processing

2.1 Subject Matter: The subject matter of the Data Processing is the processing of Personal Data necessary for the provision
of the SaaS AI development tools by Avalanche Computing as described in the
Agreement.

2.2 Duration: The Data Processing shall commence on the Effective Date and continue for the duration of the Agreement.

3. Data Protection Obligations

3.1 Compliance with Laws: The DataProcessor shall process Personal Data in accordance with applicable data
protection laws, including the GDPR.

3.2 Confidentiality: The Data Processor shall ensure that any person acting under its authority who has access to
Personal Data is bound by confidentiality obligations.

4. Security Measures

4.1 Technical and Organizational Measures:The Data Processor shall implement appropriate technical and organizational
measures to ensure a level of security appropriate to the risk.

5. Sub-Processing

5.1 Consent: The Data Processor shall not engage another processor without prior specific or general written authorization
of the Data Controller.

6. Data Subject Rights

6.1 Data Subject Requests: The DataProcessor shall provide reasonable assistance to the Data Controller in
responding to Data Subject requests.

7. Data Breach Notification

7.1 Notification: The Data Processor shall notify the Data Controller without undue delay upon becoming aware of a
Personal Data breach.

8. Return or Deletion of Data

8.1 Return or Deletion: Upon termination ofthe Agreement, the Data Processor shall, at the choice of the Data Controller,
delete or return all Personal Data.

9. Governing Law and Jurisdiction

9.1 Governing Law: This DPA shall begoverned by and construed in accordance with the laws of Taiwan.

9.2 Jurisdiction: Any disputes arising out of or in connection with this DPA shall be subject to the exclusive
jurisdiction of the courts of Taiwan.

IN WITNESS WHEREOF, the Parties hereto have executed this GDPR Data Processing Addendum as of the Effective Date.