Data Processing Addendum

Capitalised terms used but not defined in this DPA have the meaning given in the Terms of Service or applicable Data Protection Laws. For clarity:

• "Controller" means the entity that determines the purposes and means of the processing of Personal Data; in this DPA, the Customer.
• "Processor" means the entity that processes Personal Data on behalf of the Controller; in this DPA, ai-agents.bar.
• "Personal Data" means any information relating to an identified or identifiable natural person, processed by Processor on behalf of Controller in connection with the Services.
• "Sub-processor" means any third party engaged by Processor to process Personal Data on Controller's behalf.
• "Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
• "Data Protection Laws" means the GDPR, the UK GDPR, the Swiss FADP and any other applicable laws on the processing of personal data.
• "SCCs" means the Standard Contractual Clauses approved by the European Commission Decision 2021/914, including subsequent amendments, and equivalent UK and Swiss instruments.

The subject matter of the processing is the provision of the Services as described in the Terms of Service and Documentation. The duration of the processing corresponds to the term of the Customer's subscription, plus any retention period required to fulfil contractual or legal obligations as described in section 9.

Processor processes Personal Data on documented instructions from Controller for the purpose of providing, securing, maintaining and improving the Services, including: enabling user access, executing AI agent runs, performing integrations, generating logs and reports, providing customer support and complying with legal obligations.

Processor will not process Personal Data for any other purpose unless required by applicable law, in which case Processor will inform Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The categories of Data Subjects and Personal Data processed under this DPA are described in Annex 1. Controller is responsible for determining the lawfulness of submitting any specific category of Personal Data to the Services.

Processor will:

1. Documented instructions. Process Personal Data only on documented instructions from Controller, including with regard to international transfers, unless required to do so otherwise by applicable law.
2. Confidentiality. Ensure that personnel authorised to process Personal Data are bound by appropriate confidentiality obligations, whether contractual or statutory.
3. Security. Implement and maintain the technical and organisational measures set out in Annex 2 to ensure a level of security appropriate to the risk.
4. Sub-processors. Engage Sub-processors only in accordance with section 6.
5. Assistance. Assist Controller as set out in section 7 to enable Controller to comply with its obligations under Data Protection Laws.
6. Breach notification. Notify Controller of Personal Data breaches as set out in section 8.
7. Return / deletion. Return or delete Personal Data as set out in section 9.
8. Audit. Make available to Controller information necessary to demonstrate compliance, and allow audits as set out in section 11.

Controller provides general written authorisation for Processor to engage Sub-processors to provide the Services, subject to the conditions of this section.

Processor maintains an up-to-date list of Sub-processors, available on request and via subscription notifications. Processor will inform Controller of any intended addition or replacement of Sub-processors at least 30 days in advance, giving Controller the opportunity to object on reasonable data-protection grounds. If the parties cannot resolve the objection, Controller may terminate the affected portion of the Services.

Processor will impose data-protection obligations on Sub-processors that are no less protective than those in this DPA, and remains fully liable to Controller for the performance of each Sub-processor's obligations.

Taking into account the nature of the processing and the information available to Processor, Processor will assist Controller, by appropriate technical and organisational measures and to the extent reasonably possible, in:

• Responding to Data Subject requests under Articles 15–22 GDPR.
• Ensuring compliance with the obligations under Articles 32–36 GDPR (security, breach notification, DPIAs and prior consultation).
• Providing the information needed to demonstrate compliance, where Controller cannot reasonably obtain such information through the standard self-service tools made available in the Services.

Processor will notify Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach affecting Controller's Personal Data. The notification will, to the extent reasonably possible, describe:

• The nature of the breach, including the categories and approximate number of Data Subjects and records concerned.
• The likely consequences of the breach.
• The measures taken or proposed to address the breach and mitigate its effects.
• The contact point for further information.

Processor will provide additional information as it becomes available and cooperate reasonably with Controller's response.

Upon termination or expiration of the Services, Processor will, at Controller's choice, delete or return all Personal Data to Controller, and delete existing copies, unless storage is required by applicable law. Standard self-service export tools are available throughout the term and for a defined period after termination as described in the Documentation.

Backup copies will be deleted in accordance with Processor's documented backup-retention schedule, after which Personal Data will be irretrievable.

Where Processor or its Sub-processors transfer Personal Data outside the European Economic Area, the United Kingdom or Switzerland to a country not subject to a recognised adequacy decision, the transfer will be governed by the SCCs, which are hereby incorporated by reference into this DPA. The parties agree:

• For EU transfers: Module Two (Controller to Processor) of the SCCs applies; for transfers Processor to Sub-processor, Module Three applies.
• The optional clauses of the SCCs are deemed selected as follows: docking clause (Clause 7) — included; Option 2 of Clause 9(a) (general written authorisation, with 30-day notice); Option 1 of Clause 17 (governing law as per the Member State of Controller's establishment, or as otherwise required); Clause 18(b) (jurisdiction of the Member State courts).
• For UK transfers: the UK International Data Transfer Addendum is incorporated and deemed completed using equivalent details.
• For Swiss transfers: the SCCs apply with the modifications required by the Swiss FADP and FDPIC guidance.

Processor maintains transfer impact assessments and supplementary measures (including encryption, pseudonymisation and access restrictions) for each transfer scenario, available on request.

Processor will make available to Controller, upon reasonable request, the audit reports and certifications it maintains (including SOC 2 Type II and ISO/IEC 27001), summaries of penetration tests and the latest version of Annex 2.

Where the foregoing is not sufficient to demonstrate compliance, Controller may, at its own expense and no more than once per year (unless required by a competent supervisory authority), conduct an audit limited to information necessary to verify Processor's compliance with this DPA. Audits will be subject to reasonable advance notice (at least 30 days), confidentiality, and conducted in a manner that does not disrupt Processor's operations or compromise the security of other customers' data.

Each party's liability arising under or in connection with this DPA, whether in contract, tort or otherwise, is subject to the limitations and exclusions of liability set out in the Terms of Service, except where prohibited by law.

Processor implements and maintains the following technical and organisational measures, which may be updated from time to time provided that the level of security is not reduced. A more detailed description is available in the Security & Trust Center at /security.html.