Data Privacy Addendum

Last Modified: 08/06/2026

This Data Privacy Addendum (“Addendum”) is entered into between Ethena, Inc. (“Ethena”) and your company (“Customer”), each a “Party” and collectively the “Parties.” This Addendum amends and forms part of the Ethena Services Agreement, Master Services Agreement, or other comparable agreement entered into by the Parties (whether executed directly or incorporated by reference into an Order Form or similar document executed by the Parties) (“Agreement”) and details the Parties’ obligations on the protection of Personal Data associated with Ethena’s Processing of Customer’s Personal Data within the scope of the applicable Agreement.

Customer and Ethena agree as follows:

1. Definitions. For purposes of this Addendum:
   1. “Data Protection Laws” means all privacy and data protection laws and regulations applicable to a Party’s Processing of Personal Data under the Agreement, including, where applicable, (i) Regulation 2016/679/EU (“GDPR”), including member state implementations thereof, (ii) the GDPR as incorporated into United Kingdom law by the Data Protection Act of 2018 (“UK GDPR”), (iii) the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq. (as amended by the California Privacy Rights Act) and its implementing regulations (“CCPA”); and (iv) all other applicable privacy and data protection laws and regulations, each as amended.
   2. “Data Subject” means an identified or identifiable natural person or household about whom Personal Data relates.
   3. “Personal Data” means any data in Ethena’s possession or control relating to a Data Subject that Customer, its Authorized Users, or Data Subjects upload, submit, provide, transmit, or otherwise make available to Ethena through the Service, or that Ethena Processes on Customer’s behalf in connection with providing the Service, and that is deemed “personal data,” “personal information,” or an analogous term under Data Protection Laws.
   4. “Process” and “Processing” mean any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, creating, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
   5. “Restricted Transfer” means a transfer of Personal Data that is subject to the GDPR, UK GDPR, or the Swiss Federal Act on Data Protection (“FADP”) from the European Economic Area (“EEA”), Switzerland, or the United Kingdom (“UK”) (as applicable) to a country outside of the EEA, Switzerland or the UK (as applicable) which is not subject to an adequacy determination by the applicable data protection authority.
   6. “Security Incident” means any breach of Ethena’s security, leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
   7. “Standard Contractual Clauses” or “SCC” means:
      1. in respect of Personal Data of EEA Data Subjects, the standard contractual clauses set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj) (the “EU Standard Contractual Clauses”);
      2. in respect of Personal Data of Swiss Data Subjects, the EU Standard Contractual Clauses, provided that any references in the clauses to the GDPR shall refer to the FADP; the term ‘member state’ must not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence in accordance with clause 18(c) of the EU Standard Contractual Clauses; and
      3. in respect of Personal Data of UK Data Subjects, EU Standard Contractual Clauses together with the International Data Transfer Addendum to the EU Standard Contractual Clauses Version B1.0, in force 21 March 2022 (the text of which is available at: https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf) (the “UK Addendum”).
   8. Subprocessor” means any processor engaged by Ethena to assist Ethena in Processing Personal Data in connection with Ethena’s provision of Services.
   9. Where applicable, the terms “controller,” “business,” “personal data,” “processor,” “service provider,” “consumer,” “sell,” “share,” “business purpose,” “commercial purpose,” and “supervisory authority” (or any equivalent terms) shall have the meaning ascribed to them under the relevant Data Protection Law.
   10. Other capitalized terms used but not defined above shall have the meanings set forth in this Addendum or the Agreement, as applicable.
2. Role of the Parties and Nature of the Personal Data Processing and Protection. 
   1. 1. The Addendum applies to Ethena’s Processing of Personal Data. In this context, Ethena is a processor or service provider to Customer, and Customer is a controller or business.
      2. Ethena will Process Personal Data solely: (1) pursuant to Customer’s documented instructions, which will include Processing as authorized or permitted under the Agreement, including this Addendum, and to fulfill its obligations to Customer under the Agreement, including this Addendum; and (2) as required to comply with Data Protection Laws, provided that Ethena will inform Customer (unless prohibited by applicable law) of the applicable legal requirement. Ethena may Process Personal Data to generate non-personal data, including Aggregated Anonymous Data as defined in the Agreement, and use such data for its legitimate business purposes, provided that Ethena shall not attempt to re-identify, nor permit any third party to attempt to re-identify, any Personal Data from such data.
      3. Each Party will comply with its obligations under Data Protection Laws. Ethena will promptly notify Customer if it determines that it cannot meet its obligations under Data Protection Laws. Upon receiving written notice from Customer that Ethena has Processed Personal Data without authorization, Ethena will take reasonable and appropriate steps to stop and remediate such Processing.
      4. Ethena will not: 
         1. Retain, use, or disclose Personal Data outside of the direct business relationship between Ethena and Customer unless permitted by Data Protection Laws;
         2. “Sell” or “share” Personal Data, as such terms are defined in the CCPA; 
         3. Retain, use, or disclose Personal Data for any purpose other than the business purposes specified in this Addendum or otherwise permitted by Data Protection Laws; or
         4. Combine Personal Data with any “personal information” (as defined in the CCPA) it receives from other person(s) or otherwise collects other than as expressly permitted under Data Protection Law.
      5. Ethena will take reasonable steps to ensure that the persons it authorizes to Process Personal Data have committed themselves to confidentiality or are under an appropriate legal obligation of confidentiality. 
      6. Ethena will implement and maintain reasonable and appropriate technical and organizational measures designed to protect Personal Data against Security Incidents in accordance with requirements under Data Protection Laws. Such measures shall be substantially as described in Annex 2 to this Addendum.
      7. Ethena will not use Personal Data or authorize any third-party AI provider to use Personal Data, to train, fine-tune, improve, or develop any artificial intelligence model, machine learning model, or similar technology, except with Customer’s separate written authorization.
      8. Customer has the right to take reasonable and appropriate steps to ensure that Ethena uses Personal Data in a manner consistent with Customer’s obligations under the CCPA by exercising the audit and information rights described in Section 6 (Audits).
3. Assistance.
   1. Data Subject Requests. Upon written request of Customer, Ethena will assist Customer in the fulfillment of Customer’s obligations to respond to verifiable requests by Data Subjects (or their representatives) for exercising their rights under Data Protection Laws (such as rights to access or delete Personal Data) (each, a “Data Subject Request”) by providing the assistance described in this subsection. Customer is responsible for verifying, evaluating, and responding to Data Subject Requests. Ethena will, to the extent permitted by Data Protection Laws, notify Customer without undue delay if Ethena receives a Data Subject Request that identifies Customer as the Ethena customer to whom it pertains. To the extent Customer, in its use of the Services, does not have the ability to address the Data Subject Request through the Services itself, Ethena will, on Customer’s request, provide reasonable assistance to Customer in responding to such Data Subject Request, to the extent the response to such Data Subject Request is required under Data Protection Laws.
   2. Data Protection Impact Assessments. Ethena will provide reasonable assistance to and cooperation with Customer for Customer’s performance of a data protection impact assessment of Processing where required by Data Protection Laws, taking into account the nature of Processing, the information available to Ethena, and the information available to Customer through the Services or Ethena’s standard Documentation.
   3. Supervisory Authorities. Ethena will provide reasonable assistance to and cooperation with Customer for Customer’s consultation with regulatory authorities in relation to the Processing or proposed Processing of Personal Data, to the extent required by Data Protection Laws and taking into account the nature of Processing and the information available to Ethena.
   4. Security Assistance. Ethena will provide reasonable assistance to Customer to enable Customer to fulfill its compliance obligations under Data Protection Laws to secure Personal Data, taking into account the nature of Processing and the information available to Ethena, by providing the information and assistance described in Section 6 (Audits).  
4. Security Incident. In the event Ethena becomes aware of a Security Incident, Ethena will provide prompt notice to Customer (in writing; email will suffice) without undue delay (and no more than seventy-two (72) hours after becoming aware of the Security Incident), and will subsequently provide updates, as appropriate, on the status of the investigation and mitigation efforts. Ethena will take commercially reasonable steps to mitigate the effects and minimize any impact from the Security Incident and assist Customer in complying with any related notification obligations under Data Protection Laws. Ethena’s notice of or response to a Security Incident is not an acknowledgement of fault or liability.
5. Subprocessors. 
   1. Customer authorizes Ethena to use Ethena Subprocessors to Process Personal Data in accordance with the provisions within this Addendum and Data Protection Laws. A list of Ethena’s current Subprocessors can be found on Ethena’s website, at https://app.goethena.com/documents/EthenaSubprocessors.html, and Customer hereby consents to Ethena’s use of such Subprocessors. 
   2. Ethena will notify Customer of any intended addition or replacement of a Subprocessor, including the name, location, and processing activities of the proposed Subprocessor, and provide Customer with the opportunity to object within ten (10) days after Ethena’s notice. Any objection must be done in writing and based on a reasonable belief that the change will have a material adverse impact on the protection of Personal Data. Ethena may respond to the objection by, at Ethena’s election: (i) canceling the Subprocessor for Customer’s Personal Data; (ii) taking reasonable corrective steps to address the objection; or (iii) giving Customer the opportunity to stop using the affected portion of the Service. If Ethena determines that none of the foregoing is commercially reasonable and the Subprocessor change will apply, Customer may terminate the affected Services by providing written notice to Ethena within five (5) days after Ethena’s response.
   3. Ethena will impose data protection obligations upon any Subprocessor that are no less protective of Personal Data than those included in this Addendum in all material respects. Ethena is liable for its Subprocessors’ performance in connection with the Agreement to the same extent Ethena is liable for its own performance consistent with the limitations of liability set forth in the Agreement.
6. Audits. Ethena will make available to Customer such information in Ethena’s control and possession reasonably necessary to demonstrate compliance with the obligations under this Addendum. Customer may conduct an audit of Ethena’s compliance no more than once per calendar year, at Customer’s expense, limited to information reasonably necessary to verify Ethena’s obligations under this Addendum, and subject to confidentiality obligations no less protective than those in the Agreement. Ethena is not required to provide access to other customers’ data, internal financial information, trade secrets, or its systems. Ethena is not required to provide information or access that, in Ethena’s reasonable opinion, could compromise the security of Ethena’s systems or premises or cause Ethena to breach applicable law or contractual obligations.
7. Destruction of Personal Data. Upon termination or expiration of the Agreement and following any export period under the Agreement, unless prohibited by law, Ethena shall within thirty (30) days, delete or anonymize Personal Data. Notwithstanding the foregoing, Ethena may retain Personal Data to the extent required by applicable law or pursuant to its standard backup, archival, security, legal, accounting, tax and dispute-resolution obligations and practices. The certification of deletion contemplated by Section 8.5 of the SCCs shall be provided on Customer’s written request.
8. International Transfers of Personal Data. With respect to Restricted Transfers of Personal Data, the Parties agree that the Standard Contractual Clauses shall apply, form part of this Addendum, and take precedence over the rest of this Addendum to the extent of conflict, with the modifications set forth below. In addition, where required by Data Protection Laws, Ethena will implement supplementary measures designed to protect Restricted Transfers, including encryption at rest at the storage layer and in transit, pseudonymization where feasible, and transfer impact assessments.
   1. Transfers from the EEA or Switzerland. With respect to transfers of Personal Data out of the EEA or Switzerland, the EU Standard Contractual Clauses will apply and are incorporated into this Addendum by reference, provided that: (i) Module Two will apply and all other module options will not apply; (ii) in Clause 7 (Docking clause), the optional docking clause will apply; (iii) in Clause 9 (Use of sub-processors), Option 2 will apply and the time period for prior notice of Subprocessor change shall be set out in Section 5 of this Addendum; (iv) in Clause 11 (Redress), the optional language will not apply; (v) in Clauses 17 (Governing Law) and 18 (Choice of Forum and Jurisdiction), the Parties choose the law of Ireland and the courts of Ireland; (vi) Annex I is completed as set out in Annex 1 hereto; (vii) Annex II is completed as set out in Annex 2 hereto; and (viii) Annex III is completed as set out in Section 5 of this Addendum.
   2. Transfers from the UK. With respect to transfers of Customer Personal Data out of the UK, the UK Addendum will apply and is incorporated into this Addendum by reference, provided that (i) details of the Parties in Table 1 of the UK Addendum shall be as set out in Annex 1 hereto, with Customer as the exporter and Ethena as the importer (with no requirement for signature); (ii) for the purposes of Table 2, the UK Addendum shall be appended to the EU Standard Contractual Clauses as modified in Section 8(a) above and including the Annexes; (iii) the appendix information listed in Table 3 is set out in this Addendum; and (iv) either Party may end the UK Addendum as set out in Section 19 of the UK Addendum.
   3. Each party’s signature to this Addendum shall be considered a signature to the Standard Contractual Clauses. If required by the laws or regulatory procedures of any jurisdiction, the Parties shall execute or re-execute the Standard Contractual Clauses as separate documents. In case of conflict between the Standard Contractual Clauses and this Addendum, the Standard Contractual Clauses will prevail.
9. Indemnity and Limitations of Liability. Any indemnification obligations and limitations of liability with respect to a Security Incident or this Addendum will be as provided in the Agreement, including with respect to Ethena’s liability for its Subprocessors’ performance.
10. Conflict. In the event of any conflict or inconsistency between the Agreement and this Addendum, this Addendum shall prevail solely with respect to the Processing of Personal Data.
11. Governing Law. The Agreement’s choice of law and venue provision applies to this Addendum unless otherwise required by law.

This Addendum is executed by duly authorized representatives of each Party.

Annex 1

Details of Processing Activities

A. List of Parties

Data exporter(s):

Name: Customer, as set out in the Agreement.
Address: Customer address, as set out in the Agreement.
Contact person’s name, position and contact details: Customer’s contact details, as set out in the Agreement.
Activities relevant to the data transferred under these Clauses: Use of the Service pursuant to the Agreement.
Signature and date:  This Annex 1 shall be deemed executed upon execution of the Agreement.
Role: Controller

Data importer(s):

Name: Ethena, Inc.
Address: 33 Nassau Ave., 2nd Floor, Brooklyn, NY 11222
Contact person’s name, position and contact details: As set out in the Agreement.
Activities relevant to the data transferred under these Clauses: Processing to provide the Services pursuant to the Agreement, including as described under the Addendum, its appendices, and any applicable Order Form and/or Statement of Work.
Signature and date:  This Annex 1 shall be deemed executed upon execution of the Agreement.
Role: Processor

B. Description of Transfer

Categories of data subjects whose personal data is transferred

Depending on the Services in scope of the Agreement, the categories of data subjects whose Personal Data is processed include employees, officers, contractors, consultants, temporary workers, and other authorized users of the Services, as well as individuals identified in reports, disclosures, cases, or other user submissions.

Categories of personal data transferred

Depending on the Services in scope of the Agreement, the categories of Personal Data processed include name; email address; country and state of work; manager status; information, data, responses, reports, disclosures, messages, feedback, prompts, inputs, outputs, or other content submitted to or generated through the Services, in each case to the extent relating to an identified or identifiable individual; electronic identification data (notably IP addresses and user agent data); manager, department, office location, and additional custom fields selected by Customer; as well as any other Personal Data that may be processed pursuant to the Agreement.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

None anticipated, except to the extent Customer, its Authorized Users, or Data Subjects submit sensitive data through their use of the Services, including through reports, disclosures, cases, free-text fields, or uploaded content. Customer will not submit Prohibited Sensitive Information except as expressly authorized in the Agreement, an Order Form, or this Addendum.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Continuous, for the length of the Agreement between the parties.

Nature of the processing

Hosting, storage, use, disclosure, and deletion of Personal Data in connection with providing the Services.

Purpose(s) of the data transfer and further processing

To provide, secure, maintain, and support the Services for Customer, as set out in the Agreement.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

Personal Data shall be retained for the length of time necessary to provide the Services under the Agreement, or as otherwise required by applicable law. Retention periods will be determined based on the nature of the data, the purpose of Processing, and applicable legal or regulatory requirements.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

Ethena’s Subprocessors will Process Personal Data to assist Ethena in providing the Services pursuant to the Agreement, for as long as needed for Ethena to provide the Services.

C. Competent Supervisory Authority

In respect of the Standard Contractual Clauses, means the competent supervisory authority determined in accordance with Clause 13 of the SCCs. In respect of the UK Addendum, means the UK Information Commissioner's Office.

Annex 2

Technical and Organizational Measures Designed to Ensure the Security of Personal Data

This Annex 2 describes the technical and organizational measures implemented by Ethena which are designed to apply to Personal Data an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

Minimum Technical and Organization Measures

A. Ethena has implemented and will maintain reasonable and appropriate technical and organizational measures designed to protect Personal Data against accidental loss, destruction or alteration, unauthorized disclosure or access, or unlawful destruction, including the policies, procedures, and internal controls set forth in this Annex 2.       

B. More specifically, Ethena’s security program includes, at a minimum:

Certifications

• Ethena maintains a yearly SOC 2 Type 2 examination in the trust service categories of security and availability. 
• A copy of Ethena’s SOC 2 Type 2 report is available upon request (subject to confidentiality obligations). 

Data Hosting

• Personal Data is hosted and stored in Amazon Web Services, at centers located in the United States.
• Ethena does not intentionally host production Personal Data outside the United States or Canada except as directed or authorized by Customer, including through Customer’s configuration of the Services or use of the Services by Customer, its Authorized Users, or Data Subjects, or as required by applicable law. Any such Processing will be conducted in accordance with Data Protection Laws and this Addendum.

Data protection

• Accessing all critical systems requires multi-factor authentication, and Ethena enforces multi-factor authentication on all of its company accounts where available.
• TLS is used for data transmission (SSL v3 not used for security reasons).
• Personal Data is encrypted at rest at the storage layer using AES-256 or equivalent encryption, and encrypted in transit using TLS.
• All servers (application and database) are regularly updated to apply current security patches.
• Endpoint protection is deployed on corporate devices.
• Full disk encryption is enabled on all corporate devices.

Application access

• Single Sign-On (SSO) available. Standard product includes single sign-on via Google account for administrators, and Ethena training is delivered via magic links.

Application Security

• Ethena is a multi-tenant cloud platform. Ethena’s engineering team and penetration testers test controls designed to prevent cross-company access as a part of annual white box penetration testing.
• Only HTTPS endpoints are exposed to the public internet.
• Ethena prioritizes regular updates to core frameworks.
• Application changes are tied to change requests and require review by another engineer.
• Ethena runs a Continuous Integration/Continuous Delivery pipeline.
• Ethena’s infrastructure is managed through version-controlled infrastructure-as-code, requiring the same review practices as all other code at Ethena.

Personnel Management

• All employees with database access are background checked. As permitted under applicable law, background checks cover criminal history, credential/education verification, employment history verification, and professional reference checks.

• Security training conducted upon onboarding and annually thereafter. Training covers, at a minimum:
  • Relevant privacy and data protection laws
  • Current cyber threats (e.g., phishing, malware, ransomware) 
  • Safe password creation and management (corporate password management solution required)
  • Two-factor authentication (required where available and enforced where technically feasible)
  • Secure handling of Customer data and Personal Data, including when using third-party and AI-enabled tools
  • Incident reporting

Third-party audits

• Independent penetration tests are performed at least annually and, as appropriate under Ethena’s security program, following material changes, and they cover both internally and externally facing systems (application and infrastructure).
• Vulnerability scanning included as part of Ethena’s security testing program.
• An attestation letter from our most recent penetration test can be made available upon request.

Vendor/subcontractor management

• Ethena reviews vendors/tools, including vendors/tools used to support AI-enabled functionality, that have access to Personal Data or are critical to Ethena’s function for their data protection and security practices (including audits from credible third parties, where available) before their use.
• Ethena reviews material updates to the privacy or security policies of such vendors/tools when Ethena becomes aware of them.
• Ethena only works with Subprocessors that maintain SOC 2, ISO 27001, or comparable third-party security certifications.