Data Processing Addendum (Summary)

1. Roles and scope

The Customer is the controller (or “business”) and AI Tech is the processor (or “service provider”) for personal data contained in Customer Data. Processing covers hosting, storage, retrieval, calculation, display, export, support, and optional AI-assisted features of the Service, for the duration of the subscription plus the export and deletion period.

Data subjects: the Customer’s Authorized Users, directors, partners, owners, employees, contractors, staff, clients and leads, online shoppers, vendors and other individuals whose data the Customer submits. Categories of data: contact details, role and access information, compensation and payroll-related information, leave and attendance, identity document numbers (stored encrypted), bank account and payment details, transaction records, orders and sales, delivery addresses, documents and receipts, and activity logs. The Customer should not submit special-category data unless necessary.

2. Processing on instructions

We process Customer personal data only on the Customer’s documented instructions (including as set by the Terms and the Customer’s configuration of the Service), unless required by law. We will not sell or share it, or use it for any purpose other than providing the Service, including not combining it with data from other sources except as permitted by law, and will not use it to train generative AI models. We will tell the Customer if we believe an instruction breaches data protection law.

3. Confidentiality of personnel

Personnel authorized to process Customer personal data are bound by confidentiality obligations and access it only as needed to operate, support and secure the Service, or as required by law.

4. Security measures

We implement appropriate technical and organizational measures, including: encryption in transit (TLS); encryption of stored documents and imported files, with keys stored separately from backups; logical separation of customer workspaces with server-side permission enforcement; role-based access and least-privilege administration; password hashing; two-step sign-in by email code or passkey for every user; sign-in history with new-device alerts; network protection and rate limiting; append-only activity logging with redaction of secrets; encrypted backups; vulnerability management; and incident response procedures. See our Security overview.

5. Subprocessors

The Customer authorizes the subprocessors listed on our Subprocessors page. We impose data protection terms on each subprocessor no less protective than the DPA and remain responsible for their performance. We will give at least 30 days’ notice of new subprocessors (by updating the page and notifying customers who subscribe to updates). The Customer may object on reasonable data-protection grounds; if we cannot reasonably accommodate the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for the unused period.

6. Assistance and data subject requests

We will promptly forward to the Customer any request we receive from a data subject about Customer Data and will not respond except to redirect them. Taking into account the nature of processing, we will help the Customer respond to requests and with data protection impact assessments and consultations with regulators, where required.

7. Personal data breach notification

We will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer personal data, and provide the information reasonably available to help the Customer meet its own notification obligations. We will take reasonable steps to contain and remediate the breach.

8. Return and deletion

During the subscription and for 30 days after it ends, the Customer can export Customer Data. We then delete Customer personal data from active systems within 60 days after the subscription ends, and from backups on their normal rotation, unless retention is required by law, in which case we continue to protect it.

9. Audits and information

We will make available information reasonably necessary to demonstrate compliance with the DPA, including responses to reasonable security questionnaires and, when available, third-party audit reports. Where those are insufficient and required by law, the Customer may conduct an audit once per year on reasonable notice, at its own cost, subject to confidentiality.

10. International transfers

Customer Data is primarily hosted in the United States. For transfers of personal data from the EEA, UK or Switzerland, the parties rely on the EU Standard Contractual Clauses (Module 2 or 3, as applicable), the UK International Data Transfer Addendum, and equivalent Swiss mechanisms, which are incorporated into the full DPA.

11. US state privacy laws

For personal information subject to the CCPA/CPRA and similar US state laws, we act as a service provider/processor, will comply with applicable obligations, provide the same level of privacy protection required by those laws, notify the Customer if we can no longer meet them, and allow the Customer to take reasonable steps to stop and remediate unauthorized use.