This SpaceX Super Intelligence Partner Data Processing Agreement (“Partner DPA”) forms part of the SpaceX Super Intelligence Partner Network Agreement between Anysphere, Inc., a Texas corporation (“Anysphere”), and the entity that has accepted that agreement (“Partner”) (the “Partner Agreement”). This Partner DPA is the Partner Data Processing Agreement referred to in Section 12.2 (Data Processing Agreement) of the Partner Agreement and governs the processing of Personal Data that either party receives from the other in connection with the Partner Program. This Partner DPA is an Addendum to the Partner Agreement, which is available at https://cursor.com/terms/spn (or any successor URL designated by Anysphere) and through the Partner Portal, and is administered through the Partner Portal.

Partner accepts this Partner DPA by accepting the Partner Agreement, by clicking to accept this Partner DPA through the Partner Portal, or by otherwise participating in the Partner Program after being presented with or given access to this Partner DPA. The individual accepting this Partner DPA on Partner’s behalf represents that they are authorized to bind Partner and any of Partner’s Affiliates approved to participate in the Partner Program under Section 2.3 of the Partner Agreement.

1. Definitions.

   1. Interpretation. Capitalized terms used but not defined in this Partner DPA have the meanings given in the Partner Agreement. The terms “controller,” “processor,” “data subject,” “processing” (and “process”), “business,” “service provider,” “contractor,” “third party,” “sell,” “share,” and “supervisory authority” have the meanings given in the applicable Data Protection Laws, and include any equivalent terms used in those laws.

   2. Defined Terms. In this Partner DPA:

      “Compliance Screening Data” means Personal Data relating to Partner’s owners, officers, directors, personnel, or agents that Anysphere collects to assess Partner’s eligibility for, and continued participation in, the Partner Program, including information about current or former government employment or affiliation, employment or business relationships with Anysphere or its personnel, sanctions and restricted-party status, and any violation, self-disclosure, investigation, inquiry, allegation, or enforcement action relating to anti-corruption, anti-money laundering, sanctions, or export control laws.

      “Data Protection Laws” means all laws and regulations relating to privacy, data protection, data security, or electronic marketing that apply to a party’s processing of Program Personal Data, including, as applicable: (a) the EU General Data Protection Regulation 2016/679 (“GDPR”) and the ePrivacy Directive 2002/58/EC, together with their national implementing laws; (b) the GDPR as it forms part of the law of the United Kingdom (“UK GDPR”), the UK Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003; (c) the Swiss Federal Act on Data Protection (“FADP”); (d) US State Privacy Laws; (e) Canada’s Personal Information Protection and Electronic Documents Act and Canada’s Anti-Spam Legislation; (f) Australia’s Privacy Act 1988 and Spam Act 2003; (g) Singapore’s Personal Data Protection Act 2012; (h) Japan’s Act on the Protection of Personal Information; (i) India’s Digital Personal Data Protection Act, 2023; and (j) Brazil’s Lei Geral de Proteção de Dados; in each case as amended, replaced, or supplemented from time to time.

      “Disclosing Party” means the party (including its Affiliates and anyone acting on its behalf) that provides or makes available Program Personal Data to the other party, and “Receiving Party” means the party (including its Affiliates) that receives it.

      “Partner-Provided Data” means Program Personal Data that Partner, its Affiliates, or anyone acting on their behalf provides or makes available to Anysphere or its Affiliates.

      “Personal Data” means any information relating to an identified or identifiable natural person, and any other information defined as “personal data,” “personal information,” or a similar term under Data Protection Laws.

      “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Program Personal Data while it is in the possession, custody, or control of the Receiving Party or any person processing it on the Receiving Party’s behalf.

      “Program Personal Data” means Personal Data that a Disclosing Party provides or makes available to the Receiving Party in connection with the Partner Program, whether through the Partner Portal, Partner Program forms, deal registration submissions, account-mapping tools, shared collaboration channels, email, meetings, or otherwise, but excludes the data and activities described in Section 2.2.

      “Restricted Transfer” means a transfer of Program Personal Data that is subject to the GDPR, the UK GDPR, or the FADP to a country or territory that the competent authority has not recognized as providing an adequate level of protection for Personal Data, where no other lawful transfer mechanism applies.

      “SCCs” means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced from time to time, and “Module One” and “Module Two” mean the controller-to-controller and controller-to-processor modules of the SCCs, respectively.

      “Sensitive Data” means: (a) special categories of personal data, sensitive personal data, or sensitive personal information under Data Protection Laws, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and genetic, biometric, or health data, or data concerning a person’s sex life or sexual orientation; (b) Personal Data relating to criminal convictions, offences, or allegations; (c) government-issued identifiers, including social security, tax identification, passport, and driver’s license numbers; (d) financial account, bank account, or payment card numbers; (e) precise geolocation data; (f) account passwords and other authentication credentials; and (g) Personal Data of children.

      “Anysphere-Provided Data” means Program Personal Data that Anysphere, its Affiliates, or anyone acting on their behalf provides or makes available to Partner or its Affiliates.

      “SpaceXSI Privacy Notice” means Anysphere’s privacy notice available at https://cursor.com/privacy (or any successor URL designated by Anysphere), as updated from time to time.

      “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B.1.0) issued by the UK Information Commissioner, as amended or replaced from time to time.

      “US State Privacy Laws” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations (“CCPA”), and all other comprehensive US state consumer privacy laws, in each case as in effect from time to time.

2. Scope.

   1. Application. This Partner DPA applies to each party’s processing of Program Personal Data that it receives from the other party. Program Personal Data typically arises from the Partner Program activities described in Annex 1 (Description of Processing), as those activities are updated in the Program Rules from time to time.

   2. Exclusions. This Partner DPA does not apply to, and Program Personal Data does not include:

      1. Partner’s use of the Service. Personal Data processed in connection with Partner’s (or its Affiliates’) purchase, access, or use of the Service as a customer, including under any company plan, Evaluation License, sandbox, or not-for-resale access, which is governed by the Master Services Agreement or other applicable customer terms, the Data Processing Addendum available at https://cursor.com/terms/dpa, and any applicable terms of use;

      2. Partner Services and Customer Data. Customer Data, and any other Personal Data that Partner processes for or under an agreement with a Customer when performing Partner Services, which is governed solely by the agreement between Partner and that Customer. Where Partner provides Partner Services to a Customer and Anysphere provides the Service to the same Customer, each party processes that Customer’s Personal Data under its own agreement with the Customer, and neither party acts as the other’s processor or subprocessor;

      3. Marketplace activities. Personal Data processed in connection with any Plugin or Partner’s participation in the Marketplace (including any data described as “Plugin Data” or “User Content” in the SpaceXSI Marketplace Terms), which is governed by the SpaceXSI Marketplace Terms;

      4. Separate agreements. Personal Data processed under any separate written agreement that authorizes Partner to resell, distribute, or subcontract the Service, or under any other separate agreement between the parties that contains its own data protection terms, to the extent of that agreement’s scope; and

      5. Independently collected data. Personal Data that a party collects independently and not from the other party, even if it relates to the same individuals or organizations, including Personal Data that Anysphere collects directly from a Customer or prospective Customer.

   3. Relationship to Section 12.1. This Partner DPA supplements, and does not limit, Partner’s obligations under Section 12.1 (Notice and Consent) of the Partner Agreement.

3. Roles of the Parties.

   1. Independent Controllers. Except as set forth in Section 8 (Processor Arrangements), each party acts as an independent controller (and, where applicable under US State Privacy Laws, as a business or third party) with respect to the Program Personal Data it receives from the other party. Each party independently determines the purposes and means of its own processing. The parties are not joint controllers, and neither party processes Program Personal Data on behalf of the other.

   2. Each Party’s Own Compliance. Each party is responsible for its own compliance with Data Protection Laws in relation to its processing of Program Personal Data, including providing notices, establishing a lawful basis, responding to data subjects, maintaining records of processing, and meeting its obligations to supervisory authorities. Neither party shall knowingly process Program Personal Data in a way that causes the other party to breach Data Protection Laws.

4. Disclosure of Program Personal Data.

   1. Lawful Disclosure. Each Disclosing Party shall ensure that its collection of Program Personal Data, and its disclosure of that data to the Receiving Party, comply with Data Protection Laws. Without limiting Section 12.1 (Notice and Consent) of the Partner Agreement, Partner represents and warrants that, for all Partner-Provided Data, Partner has provided all notices, obtained all consents, and established all lawful bases required under Data Protection Laws for: (a) Partner to disclose the data to Anysphere; and (b) Anysphere to process the data for the purposes described in Section 5.1(a), including to contact the relevant Customer or prospective Customer about the Service and to verify Partner’s engagement with that Customer.

   2. Notice to Customers and Prospective Customers. Where required by applicable law, before submitting a deal registration or otherwise disclosing the Personal Data of a Customer’s or prospective Customer’s personnel to Anysphere, Partner shall inform the relevant individuals (or ensure they have been informed) that Partner may share their contact and opportunity information with Anysphere, that Anysphere may use that information as described in the SpaceXSI Privacy Notice, and that Partner may receive Partner Program benefits if the Customer or prospective Customer purchases from Anysphere. Partner shall not disclose to Anysphere the Personal Data of any individual who has objected to, or opted out of, the sharing of their Personal Data with Anysphere.

   3. Notice to Partner Personnel. Partner shall inform its and its Affiliates’ personnel, contractors, owners, officers, and directors whose Personal Data Partner provides to Anysphere (including Partner Portal users and Admins, individuals pursuing accreditations, members of shared collaboration channels, and individuals identified in Compliance Screening Data) that Anysphere will process their Personal Data as described in this Partner DPA and the SpaceXSI Privacy Notice, including by making the SpaceXSI Privacy Notice available to them.

   4. Data Minimization and Sensitive Data. Each Disclosing Party shall disclose only the Program Personal Data that is reasonably necessary for the relevant Partner Program purpose. Partner shall not provide Sensitive Data to Anysphere except: (a) where Anysphere requests it through a Partner Portal form, the Program Rules, or another written request, such as payment routing and tax information needed to pay fees, or Compliance Screening Data; or (b) as Anysphere otherwise approves in writing. Any such request constitutes Anysphere’s express written request for purposes of Section 12.1 (Notice and Consent) of the Partner Agreement, limited to the Sensitive Data requested. When submitting proof of marketing activities, event outcomes, or similar information, Partner shall use aggregated metrics, company domains, or job titles instead of individual-level Personal Data wherever practicable.

   5. Accuracy and Updates. Each Disclosing Party shall take reasonable steps to ensure that the Program Personal Data it discloses is accurate and up to date, and shall promptly notify the Receiving Party if it learns that any Program Personal Data it disclosed is inaccurate or out of date, or that an individual has withdrawn consent to, or objected to, the Receiving Party’s processing. Partner shall keep its Partner Portal user information current and shall promptly notify Anysphere, through the Partner Portal or at partnersupport@x.ai, when an individual with a Partner Portal account, an active accreditation, or membership in a shared collaboration channel leaves Partner’s organization or no longer participates in Partner’s Partner Program activities.

5. Processing by the Receiving Party.

   1. Purpose Limitation.

      1. Anysphere. Anysphere may process Partner-Provided Data: (i) to operate, administer, and improve the Partner Program, including for the purposes described in Annex 1; (ii) to market, sell, provide, and support the Service, and to manage its relationships with the Customers and prospective Customers identified in Partner-Provided Data, in accordance with the SpaceXSI Privacy Notice and Data Protection Laws; (iii) to verify Partner’s compliance with the Partner Agreement, the Program Rules, and applicable laws, and to detect and prevent fraud, abuse, and security incidents; (iv) to comply with legal obligations and to establish, exercise, or defend legal claims; and (v) for any other purpose permitted by Data Protection Laws and described in the SpaceXSI Privacy Notice.

      2. Partner. Partner shall process Anysphere-Provided Data only for the specific Partner Program purpose for which Anysphere provided it (for example, co-selling on an identified opportunity, account planning with Anysphere, or administering Partner’s participation in the Partner Program), and in accordance with the Partner Agreement, the Program Rules, this Partner DPA, and Data Protection Laws. Partner shall not: (i) sell, rent, or license Anysphere-Provided Data; (ii) use Anysphere-Provided Data to market or promote any product or service that competes with the Service, or for any marketing unrelated to the purpose for which Anysphere provided it; (iii) combine Anysphere-Provided Data with other data to build or enrich contact databases, profiles, or lead lists for purposes unrelated to the Partner Program; or (iv) disclose Anysphere-Provided Data to any third party except as permitted under Section 5.4.

      3. Other processing. Either party may also process Program Personal Data for another purpose where required by applicable law, where necessary to protect the vital interests of an individual, or where the individual has consented to the further processing.

   2. Transparency. Each party shall maintain and make available a privacy notice that meets the requirements of Data Protection Laws for its processing of Program Personal Data. Where Anysphere contacts an individual whose Personal Data it received from Partner, Anysphere shall provide the information required by Data Protection Laws within the time required, which may be at the time of Anysphere’s first communication with that individual.

   3. Confidentiality and Security. Each Receiving Party shall: (a) implement and maintain appropriate technical and organizational measures to protect Program Personal Data against Personal Data Breaches, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of the processing, and the risks to individuals, which measures will include at least those described in Annex 2 (Minimum Security Measures); (b) limit access to Program Personal Data to personnel, contractors, and service providers who need access for the purposes permitted under Section 5.1; and (c) ensure that persons authorized to process Program Personal Data are bound by appropriate confidentiality obligations. Partner is responsible for securing its Partner Portal accounts and credentials in accordance with Section 8 (Partner Portal Access) of the Partner Agreement.

   4. Service Providers and Onward Disclosures.

      1. Processors. Each Receiving Party may engage processors and service providers to process Program Personal Data on its behalf, including providers of partner portal and partner relationship management platforms, customer relationship management systems, account-mapping tools, collaboration and communications tools, learning management systems, payment and tax services, cloud hosting, and AI-enabled productivity tools. The Receiving Party shall engage such processors only under a written agreement that requires them to protect Program Personal Data in a manner consistent with this Partner DPA and Data Protection Laws, and remains responsible for their processing.

      2. Anysphere Affiliates. Anysphere may disclose Partner-Provided Data to its Affiliates for the purposes described in Section 5.1(a). Each Anysphere Affiliate that receives Partner-Provided Data shall process it in accordance with this Partner DPA.

      3. Other disclosures. Except as permitted by this Section 5.4, a Receiving Party shall not disclose Program Personal Data to any third party other than: (i) its and its Affiliates’ professional advisors who are bound by confidentiality obligations; (ii) a successor in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets, as permitted under the Partner Agreement; (iii) as required by applicable law, court order, or a competent governmental authority, subject to Section 5.7; or (iv) as otherwise permitted by Data Protection Laws and, in the case of Partner, with Anysphere’s prior written consent.

   5. Data Subject Requests. Each party is responsible for responding to requests from individuals exercising their rights under Data Protection Laws with respect to the Program Personal Data it controls. If a party receives a request that relates to the other party’s processing, it shall, where lawful, promptly (and in any event within five (5) business days) forward the request to the other party or inform the individual how to contact the other party, and the parties shall reasonably cooperate to respond. If an individual objects to marketing communications, withdraws consent, or requests deletion, and the request is relevant to the other party’s processing of Program Personal Data, the party receiving the request shall promptly notify the other party so that it can take any action required by Data Protection Laws.

   6. Personal Data Breaches. The Receiving Party shall notify the Disclosing Party without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach involving Program Personal Data received from the Disclosing Party. The notice will describe, to the extent then known, the nature of the Personal Data Breach, the categories and approximate number of individuals and records concerned, the likely consequences, and the measures taken or proposed to address the Personal Data Breach and mitigate its effects, and the Receiving Party shall supplement the notice as further information becomes available. The Receiving Party shall take reasonable steps to contain, investigate, and remediate the Personal Data Breach and shall reasonably cooperate with the Disclosing Party. Each party is responsible for any notifications to supervisory authorities and individuals that Data Protection Laws require of it as a controller, and the parties shall coordinate in good faith on the content and timing of those notifications. Except as required by law, neither party shall name the other party in any notification or public statement about a Personal Data Breach without the other party’s prior written consent. Partner shall send notices under this Section 5.6 to legal@cursor.com, and such notices also satisfy Section 5(g) (Partner Obligations) of the Partner Agreement with respect to the Personal Data Breach.

   7. Government and Regulator Requests. If a Receiving Party receives a request from a supervisory authority, law enforcement agency, or other governmental authority for Program Personal Data received from the other party, the Receiving Party shall, where legally permitted, promptly notify the Disclosing Party, disclose only the minimum Program Personal Data required to respond, and reasonably cooperate with the Disclosing Party’s efforts to respond to or challenge the request.

   8. Retention and Deletion.

      1. General. Each Receiving Party shall retain Program Personal Data only for as long as necessary for the purposes permitted under Section 5.1, and shall then delete or anonymize it, except as required or permitted by applicable law.

      2. Anysphere-Provided Data. Upon expiration or termination of the Partner Agreement, or upon Anysphere’s earlier written request, Partner shall stop using Anysphere-Provided Data and, within thirty (30) days, delete it (or, at Anysphere’s request, return it), and shall certify in writing that it has done so upon Anysphere’s request, except to the extent applicable law requires Partner to retain it. Program Personal Data retained in routine backups may be deleted in accordance with Partner’s standard backup cycle, provided it remains protected in accordance with this Partner DPA and is not actively used.

      3. Partner-Provided Data. Anysphere may retain Partner-Provided Data after expiration or termination of the Partner Agreement to the extent reasonably necessary to: (i) administer registration fees, referral fees, and other amounts that accrued before termination; (ii) maintain records relating to the Partner Program, including for the period described in Section 20.5 (Records) of the Partner Agreement; (iii) continue its direct relationships with Customers and prospective Customers; (iv) comply with legal obligations; and (v) establish, exercise, or defend legal claims. Anysphere shall retain Compliance Screening Data only for as long as necessary for the compliance purposes for which it was collected and as required by applicable law.

   9. Automated Tools and AI. Anysphere may use automated tools, including AI models and agents operated by Anysphere, its Affiliates, or its service providers, to help review and process Partner applications, deal registrations, benefit requests, marketing activity submissions, and other Partner Program submissions and communications. Anysphere personnel make the decision to approve, reject, condition, or revoke a Partner application or deal registration, and Anysphere shall not subject any individual to a decision based solely on automated processing that produces legal effects concerning that individual or similarly significantly affects them, except as permitted by Data Protection Laws. Anysphere will not use Personal Data contained in Partner-Provided Data to train AI models that Anysphere makes generally available to third parties. Partner shall not input Anysphere-Provided Data into any AI tool or other third-party service that uses that data to train models for the benefit of anyone other than Partner, or that otherwise uses that data for its own purposes.

   10. Cooperation. Each party shall provide the other with reasonable information and cooperation, at its own cost, as needed for the other party to comply with its obligations under Data Protection Laws relating to Program Personal Data, including in relation to data protection impact assessments, records of processing, and inquiries from supervisory authorities.

6. US State Privacy Laws.

   1. No Sale. The parties acknowledge that any registration fees, referral fees, or other Partner Benefits provided under the Partner Program are consideration for Partner’s referral, sourcing, co-selling, and related services as described in Section 7 (Deal Registration, Fees, and Payment) of the Partner Agreement, and not for Program Personal Data. Neither party discloses Program Personal Data to the other in exchange for monetary or other valuable consideration, and the parties do not intend any disclosure under this Partner DPA to constitute a sale or sharing of Personal Data under US State Privacy Laws.

   2. Third-Party Terms. To the extent a Receiving Party receives Program Personal Data as a third party under US State Privacy Laws, or a disclosure under this Partner DPA is otherwise treated as a sale or sharing, the Receiving Party shall: (a) process that Program Personal Data only for the limited and specified purposes set out in Section 5.1 and Annex 1; (b) comply with its applicable obligations under US State Privacy Laws and provide the same level of privacy protection to that Program Personal Data as US State Privacy Laws require; (c) permit the Disclosing Party, upon written notice, to take reasonable and appropriate steps to ensure that the Receiving Party uses that Program Personal Data in a manner consistent with the Disclosing Party’s obligations under US State Privacy Laws, and to stop and remediate any unauthorized use; (d) notify the Disclosing Party if it determines that it can no longer meet its obligations under US State Privacy Laws; and (e) honor any opt-out or other consumer request that the Disclosing Party communicates to it as required by US State Privacy Laws.

7. International Data Transfers.

   1. General. Each party may process Program Personal Data in the United States and in any other country where it, its Affiliates, or its processors operate, provided that it complies with the transfer requirements of Data Protection Laws.

   2. EEA Transfers. To the extent a disclosure of Program Personal Data from the Disclosing Party to the Receiving Party is a Restricted Transfer subject to the GDPR, the parties agree to Module One of the SCCs (or, where Section 8 applies and the Receiving Party acts as the Disclosing Party’s processor, Module Two of the SCCs), which are incorporated into this Partner DPA by reference, and:

      1. the Disclosing Party is the “data exporter” and the Receiving Party is the “data importer”;

      2. the optional docking clause in Clause 7 applies;

      3. in Clause 9 of Module Two, Option 2 (general written authorization) applies, with the notice period set forth in Section 8.2(d);

      4. the optional language in Clause 11(a) does not apply;

      5. in Clause 13, the competent supervisory authority is determined in accordance with Clause 13(a), and where the data exporter is not established in the EEA and has not appointed a representative under Article 27 of the GDPR, the competent supervisory authority is the Irish Data Protection Commission;

      6. in Clause 17, Option 1 applies and the SCCs are governed by the laws of Ireland;

      7. in Clause 18(b), disputes will be resolved before the courts of Ireland;

      8. Annex I of the SCCs is completed with the information in Annex 1 to this Partner DPA; and

      9. Annex II of the SCCs is completed with the information in Annex 2 to this Partner DPA.

   3. UK Transfers. To the extent a Restricted Transfer is subject to the UK GDPR, the SCCs apply as set forth in Section 7.2, as amended by the UK Addendum, which is incorporated into this Partner DPA by reference, and: (a) Tables 1 to 3 of the UK Addendum are completed with the information in Section 7.2 and Annexes 1 and 2 to this Partner DPA; and (b) for Table 4, neither party may end the UK Addendum under Section 19 of the UK Addendum.

   4. Swiss Transfers. To the extent a Restricted Transfer is subject to the FADP, the SCCs apply as set forth in Section 7.2 with the following changes: (a) references to the GDPR are references to the FADP; (b) references to the “EU,” “Union,” and “Member State” include Switzerland, and the term “Member State” does not prevent data subjects in Switzerland from bringing claims in their place of habitual residence; and (c) the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner.

   5. Alternative Transfer Mechanisms. A party may rely on an adequacy decision, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions (where that party is certified), or any other transfer mechanism recognized under Data Protection Laws instead of the SCCs. If a transfer mechanism relied on under this Section 7 is invalidated or ceases to be available, the parties shall cooperate in good faith to implement an alternative lawful transfer mechanism, and Anysphere may update this Partner DPA under Section 11.2 for that purpose.

   6. Other Jurisdictions. Where the Data Protection Laws of any other jurisdiction require specific contractual terms for the transfer of Program Personal Data outside that jurisdiction, the parties agree that this Partner DPA (including, where permitted, the SCCs as adapted for that jurisdiction) constitutes those terms, and each party shall enter into any additional transfer terms that Anysphere reasonably makes available through the Partner Portal to meet those requirements.

   7. Conflict. In the event of any conflict between this Partner DPA and the SCCs (including as amended by the UK Addendum or Section 7.4), the SCCs will govern to the extent of the conflict.

8. Processor Arrangements.

   1. Application. This Section 8 applies only where the parties expressly agree in an Addendum, the Program Rules, or another writing that one party (the “Processing Party”) will process Program Personal Data on behalf of, and on the documented instructions of, the other party (the “Instructing Party”), for example where Partner collects registrations on Anysphere’s behalf for an event hosted by Anysphere. For that processing, the Instructing Party is the controller and the Processing Party is its processor (and, where applicable, its service provider or contractor under US State Privacy Laws), and Sections 3.1 and 5.1 do not apply to that processing.

   2. Processor Obligations. The Processing Party shall:

      1. process the Program Personal Data only on the Instructing Party’s documented instructions, including with regard to transfers, unless applicable law requires otherwise (in which case it shall inform the Instructing Party before processing, unless the law prohibits this), and promptly inform the Instructing Party if, in its opinion, an instruction infringes Data Protection Laws;

      2. ensure that persons authorized to process the Program Personal Data are bound by confidentiality obligations;

      3. implement the measures described in Annex 2 and any other measures required by Article 32 of the GDPR, where applicable;

      4. not engage another processor without the Instructing Party’s general written authorization, which the Instructing Party grants for the processors identified by the Processing Party when the arrangement is agreed; give the Instructing Party at least thirty (30) days’ notice (which Anysphere may give through the Partner Portal or its subprocessor page) of any intended addition or replacement, during which the Instructing Party may object on reasonable data protection grounds; bind each processor to written terms providing at least the same level of protection as this Section 8; and remain liable for each processor’s performance;

      5. taking into account the nature of the processing, assist the Instructing Party through appropriate measures in responding to data subject requests and in meeting its obligations relating to security, Personal Data Breach notification, data protection impact assessments, and prior consultation with supervisory authorities;

      6. notify the Instructing Party without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting the Program Personal Data it processes on the Instructing Party’s behalf;

      7. at the Instructing Party’s choice, delete or return the Program Personal Data at the end of the processing and delete existing copies, unless applicable law requires retention;

      8. make available to the Instructing Party the information reasonably necessary to demonstrate compliance with this Section 8, and allow for and contribute to audits, including inspections, by the Instructing Party or an independent auditor it mandates, no more than once in any twelve (12) month period (except following a Personal Data Breach or where required by a supervisory authority), on at least thirty (30) days’ notice, subject to reasonable confidentiality obligations and at the Instructing Party’s cost, provided that the Processing Party may instead provide current independent certifications or audit reports where they reasonably address the scope of the audit; and

      9. where US State Privacy Laws apply: not sell or share the Program Personal Data; not retain, use, or disclose it for any purpose other than the business purposes specified by the Instructing Party, or outside the direct business relationship between the parties; not combine it with Personal Data received from other sources except as permitted by US State Privacy Laws; comply with US State Privacy Laws and provide the same level of privacy protection they require; notify the Instructing Party if it can no longer meet its obligations; and permit the Instructing Party to take reasonable and appropriate steps to stop and remediate any unauthorized use.

9. Liability and Remedies.

   1. Liability. Each party’s liability arising out of or relating to this Partner DPA, including under the SCCs as between the parties, is subject to Section 17 (Limitation of Liability) of the Partner Agreement, including its treatment of Excluded Claims, as modified by any applicable Addendum. Nothing in this Partner DPA limits either party’s liability to data subjects under the SCCs, or any liability that cannot be limited under applicable law.

   2. Indemnification. Partner’s breach of this Partner DPA is a breach of the Partner Agreement for purposes of Section 16.1 (Partner Indemnity) of the Partner Agreement.

   3. Suspension. If Partner breaches this Partner DPA, or Anysphere reasonably believes that continuing to disclose Program Personal Data to Partner would violate Data Protection Laws, Anysphere may, without liability, suspend its disclosure of Anysphere-Provided Data to Partner and Partner’s ability to submit Program Personal Data, in addition to its rights under Section 18 (Term and Termination) of the Partner Agreement.

10. Compliance Verification.

    1. Partner. Upon Anysphere’s reasonable written request, no more than once in any twelve (12) month period (except following a Personal Data Breach, at the request of a supervisory authority, or where Anysphere has a reasonable basis to suspect non-compliance), Partner shall complete a reasonable written privacy and security questionnaire and provide reasonable supporting documentation demonstrating its compliance with this Partner DPA. Anysphere’s rights under Section 20.5 (Records) of the Partner Agreement extend to Partner’s compliance with this Partner DPA.

    2. Anysphere. Anysphere makes information about its security program, including its SOC 2 Type II report, available through its Trust Center at https://trust.cursor.com (or such other URL as Anysphere may designate by notice to Partner from time to time), and shall respond to Partner’s reasonable written questions about its processing of Partner-Provided Data.

11. Term, Updates, and General.

    1. Term. This Partner DPA takes effect on the earlier of (a) the date on which Partner accepts this Partner DPA (including by accepting the Partner Agreement) through the Partner Portal; or (b) the date of Partner’s first participation in the Partner Program, as permitted by Anysphere, after being presented with or given access to this Partner DPA, and continues for as long as either party processes Program Personal Data received from the other party. Sections 5.8, 9, and 11 survive any expiration or termination of this Partner DPA or the Partner Agreement.

    2. Updates. Anysphere may update this Partner DPA in accordance with Section 20.4 (Amendments and Program Updates) of the Partner Agreement by posting the updated Partner DPA on the Partner Portal or at the applicable URL. Updates required to comply with Data Protection Laws, or with guidance or decisions of a supervisory authority, may take effect on posting or as otherwise required by law. No update will modify the SCCs or the UK Addendum, except to adopt an amended or replacement version issued by the competent authority.

    3. Order of Precedence. This Partner DPA is one of the Addenda under the Partner Agreement. Except as set forth in this Partner DPA, the Partner Agreement shall remain unmodified and in full force and effect. With respect to the processing of Program Personal Data, in the event of any conflict, the following order of precedence applies to the extent of the conflict: (a) the SCCs, to the extent they apply; (b) this Partner DPA; (c) the Partner Agreement and any other Addenda; and (d) the Program Rules.

    4. Governing Law and Disputes. Except as required by the SCCs or Data Protection Laws, this Partner DPA is governed by the law, and disputes under it will be resolved in the manner, set forth in Section 19 (Dispute Resolution) of the Partner Agreement.

    5. Affiliates. Where Partner’s Affiliates participate in the Partner Program under Section 2.3 of the Partner Agreement, Partner accepts this Partner DPA on their behalf, shall ensure that they comply with it, and remains liable for their compliance. Anysphere’s Affiliates that process Partner-Provided Data may rely on and enforce this Partner DPA as express third-party beneficiaries, in addition to the third-party beneficiary rights in Section 20.6 (Third-Party Beneficiaries) of the Partner Agreement.

    6. Privacy Contacts. Partner shall designate a privacy contact in the Partner Portal, failing which Anysphere may send notices under this Partner DPA to Partner’s Partner Portal Admin. Anysphere’s privacy contact is legal@cursor.com, or such other contact details as Anysphere may designate from time to time through the Partner Portal or by email to Partner’s designated privacy contact.

    7. No Other Third-Party Beneficiaries. Except as set forth in Section 11.5 and as provided for data subjects in the SCCs, this Partner DPA does not create any rights for any third party.

ANNEX 1 – Description of Processing

This Annex 1 also constitutes Annex I of the SCCs where the SCCs apply under Section 7.

Part A – List of Parties

Part B – Processing by Partner Program Activity

Part C – Other Processing Details

Purposes of processing: As described in Section 5.1.

Nature of processing: Collection, recording, organization, structuring, storage, retrieval, consultation, use, analysis (including automated and AI-assisted review under Section 5.9), disclosure by transmission, alignment or combination, restriction, erasure, and destruction.

Sensitive Data: The parties do not intend to exchange Sensitive Data other than (a) Compliance Screening Data, which may include information about public-sector affiliation and alleged offences, and (b) payment and tax identifiers. Safeguards: purpose limitation, need-to-know access restrictions, encryption in transit and at rest, and limited retention, as described in Sections 4.4 and 5.8.

Frequency of transfer: Continuous, for the duration of the Partner Agreement.

Retention period: As described in Section 5.8.

Recipients and onward transfers: As described in Section 5.4.

Competent supervisory authority: As described in Section 7.2(e) for EEA transfers; the UK Information Commissioner for UK transfers; and the Swiss Federal Data Protection and Information Commissioner for Swiss transfers.

ANNEX 2 – Minimum Security Measures

This Annex 2 also constitutes Annex II of the SCCs where the SCCs apply under Section 7. Each party shall maintain at least the following measures for Program Personal Data in its possession, custody, or control:

1. Governance. A written information security program with a designated responsible individual, and security and privacy policies that are reviewed at least annually.

2. Access control. Role-based access on a least-privilege basis, unique user IDs, multi-factor authentication for systems that store Program Personal Data (including Partner Portal accounts, where available), and removal of access promptly, and in any event within five (5) business days, after an individual changes role or leaves the organization.

3. Personnel. Confidentiality obligations for all personnel with access, background checks where lawful and appropriate for the role, and security and privacy training at least annually.

4. Encryption. Encryption of Program Personal Data in transit using TLS 1.2 or higher, and at rest using industry-standard encryption.

5. Endpoint and network security. Managed devices with endpoint protection, timely security patching, and network controls such as firewalls and intrusion detection.

6. Logging and monitoring. Logging of access to systems that store Program Personal Data, and monitoring designed to detect unauthorized access.

7. Vulnerability management. Regular vulnerability scanning and timely remediation of identified vulnerabilities based on severity.

8. Processor management. Security and privacy due diligence on processors before engagement, and written contractual protections consistent with this Partner DPA.

9. Incident response. A documented and periodically tested incident response plan that enables the party to meet the notification timelines in this Partner DPA.

10. Business continuity. Backup and recovery procedures appropriate to the risk.

11. Minimization and disposal. Collection limited to what is necessary, and secure deletion or anonymization of Program Personal Data when it is no longer needed.

12. Approved tools. Processing of Program Personal Data only in approved business systems, and not in personal email accounts, personal devices without appropriate controls, or unapproved AI tools.

In addition, Anysphere maintains the technical and organizational measures described in its SOC 2 Type II report and its Trust Center at https://trust.cursor.com (or such other URL as Anysphere may designate by notice to Partner from time to time).