Data Processing Addendum

This Addendum forms part of the Terms of Service between CloudEffects LLC ("Processor") and Customer ("Controller").

Customer is the controller of personal data about its End Customers and Users ("Customer Personal Data"), and the business operator handling personal information under Japan's Act on the Protection of Personal Information ("APPI"). CloudEffects processes Customer Personal Data only as Customer's processor, entrusted party under the APPI, and service provider under the California Consumer Privacy Act and similar U.S. state laws ("U.S. State Privacy Laws").

CloudEffects processes Customer Personal Data only to provide the Services (the business purposes described in section 3) and on Customer's documented instructions, including instructions given by configuring the Services, approving AI proposals and granting Agent Mandates. CloudEffects will not:

• sell or share Customer Personal Data, as those terms are defined in U.S. State Privacy Laws;
• retain, use or disclose it for any other purpose, including any commercial purpose, or outside the direct business relationship with Customer;
• combine it with personal data CloudEffects receives from other sources or collects itself, except as U.S. State Privacy Laws permit for service providers;
• disclose it to third parties, except to sub-processors under section 6 or as required by law under section 11;
• use it to train AI models.

CloudEffects will tell Customer if it believes an instruction violates applicable law.

Personnel with access are bound by confidentiality, receive instructions on handling personal data, and get access only as far as their work needs it.

CloudEffects maintains the technical and organizational measures described on the Security page, including tenant isolation and encryption of stored credentials.

Customer authorizes the sub-processors listed on the Sub-processors page. CloudEffects will give at least 30 days' notice of new sub-processors, and Customer may object on reasonable grounds. CloudEffects will bind each sub-processor by written contract to data protection obligations no less protective than this Addendum, including the restrictions in section 2, and remains responsible to Customer for its sub-processors.

CloudEffects will help Customer respond to data subject and consumer requests (such as access, correction, deletion and suspension of use) and, where required, with impact assessments. If CloudEffects receives such a request directly, it will forward it to Customer and not respond itself unless Customer instructs it to.

CloudEffects will notify Customer without undue delay, and within 72 hours, after becoming aware of a breach affecting Customer Personal Data. The notice will include what CloudEffects knows of the nature of the breach, the data and people affected and the measures taken, so that Customer can meet its own duties to report and notify (including under Article 26 of the APPI).

At the end of the Terms, CloudEffects will make Customer Personal Data available for export and then delete it as set out in the Terms. This does not apply to Customer Personal Data that applicable law requires CloudEffects to retain, or that CloudEffects must preserve under a court order, a preservation request from a public authority or another legal obligation. CloudEffects will keep only what is required, only for as long as it is required, protect it as this DPA requires, and process it for no other purpose.

Once a year, and on reasonable request, CloudEffects will provide Customer with the information reasonably needed to show that it complies with this Addendum, including how its measures are carried out and any change in the laws of the countries where Customer Personal Data is processed that could affect them. Customer may take reasonable and appropriate steps, on notice, to confirm that CloudEffects uses Customer Personal Data consistently with this Addendum, and to stop and remediate any unauthorized use.

Customer Personal Data is processed in the United States (AWS US West, Oregon region). For personal data from the EEA or the UK, the Standard Contractual Clauses and the UK Addendum apply. If a public authority requests Customer Personal Data, CloudEffects will notify Customer unless the law forbids it, and disclose only what it is legally required to disclose.

For Customer Personal Data subject to the APPI, CloudEffects is a third party in a foreign country, and this Addendum is the arrangement by which CloudEffects takes measures equivalent to those the APPI requires of a business operator (Article 28(1) and Article 16 of the Enforcement Rules). In particular, CloudEffects:

1. handles the data only within the purposes in section 2, and not in ways that could encourage or induce illegal or unjust acts;
2. keeps the data accurate as instructed, and deletes it when no longer needed (section 9);
3. takes security measures (section 5) and supervises its personnel (section 4) and sub-processors (section 6);
4. reports breaches (section 8);
5. does not provide the data to third parties, or onward to third parties in other countries, except as sections 2 and 6 allow;
6. assists with requests from individuals (section 7).

Information for Customer's duties. To help Customer check how these measures are carried out and provide information to individuals on request (Article 28(3)), CloudEffects provides: the country where the data is processed (United States); an outline of its personal information protection system — there is no comprehensive federal privacy law, and protection comes from sector-specific federal laws and state laws such as the California Consumer Privacy Act; the measures in this section; and the annual information in section 10. If CloudEffects can no longer carry out these measures, it will notify Customer without delay, and Customer may suspend the provision of data and terminate the affected Services.

CloudEffects will comply with the obligations that U.S. State Privacy Laws place on service providers and provide the level of privacy protection they require. CloudEffects will notify Customer if it determines that it can no longer meet those obligations. Customer will inform CloudEffects of consumer requests that it must act on, and CloudEffects will act on them as section 7 describes. CloudEffects certifies that it understands and will comply with the restrictions in section 2.