Data Processing Addendum

1. Scope and roles

1.1 Roles. Customer is the controller, or business, and Provider is the processor, or service provider, of End User Personal Data. Provider's processing of Customer's account data and of website visitors' data is governed by the Privacy Policy, not by this Addendum.

1.2 Customer's responsibilities. Customer is responsible for the lawfulness of its instructions and for giving End Users the notices, and obtaining the consents, that Data Protection Laws require, including for call recording and artificial-intelligence disclosure under Terms Section 7.

1.3 Prohibited data. Customer will not submit data the Terms prohibit, including protected health information and special-category data. Provider has no liability to Customer for a claim arising from that data.

2. Details of the processing

Annex 1 describes the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

3. Instructions and permitted uses

3.1 Instructions. Provider processes End User Personal Data only on Customer's documented instructions. The Terms, this Addendum and Customer's configuration and use of the Service are Customer's complete instructions. Any other instruction requires Provider's written agreement and may carry a fee.

3.2 Unlawful instructions. Provider will inform Customer if, in Provider's opinion, an instruction infringes Data Protection Laws, and may decline to follow it.

3.3 Processing required by law. Where law requires Provider to process End User Personal Data other than on Customer's instructions, Provider will inform Customer first, unless that law prohibits it.

3.4 Operating the Service. Provider may use End User Personal Data to provide, secure, support and debug the Service for Customer.

3.5 Service improvement. Customer authorizes Provider to use End User Personal Data to improve the Service, including review of transcripts and logs by Provider's personnel, with or without artificial-intelligence tools, to improve the Service's code, prompts and workflows for all customers. Where Data Protection Laws treat that use as Provider acting as a controller, Provider is responsible for it as controller.

3.6 De-identified data. Provider may create de-identified or aggregated data that does not identify any person and may use it for any lawful purpose. Provider will not attempt to re-identify it.

4. Confidentiality

Provider ensures that the persons it authorizes to process End User Personal Data are bound by confidentiality obligations or are under a statutory duty of confidentiality.

5. Security

5.1 Measures. Provider implements the technical and organizational measures described in Annex 2, which are designed to protect End User Personal Data appropriately to the risk.

5.2 Updates. Provider may update those measures, provided the overall level of security is not materially reduced.

6. Sub-processors

6.1 Authorization. Customer generally authorizes Provider to engage Sub-processors in the categories listed in Annex 3. The current list is published at firstaiemployee.com/data-processors, and Provider will give the names of its Sub-processors on written request.

6.2 Sub-processor terms. Provider imposes on each Sub-processor data protection obligations no less protective in substance than those in this Addendum, to the extent they apply to the services that Sub-processor provides. Provider remains liable to Customer for each Sub-processor's performance of those obligations, subject to Clause 13.1.

6.3 Changes. Provider will give at least ten (10) days' notice before a new Sub-processor begins processing End User Personal Data, by email to the address on Customer's account or by updating the list at firstaiemployee.com/data-processors.

6.4 Objection. Customer may object in writing on reasonable data protection grounds within ten (10) days of that notice. Provider will consider the objection in good faith. If Provider does not resolve it, Customer's sole and exclusive remedy is to terminate the affected Service and receive a pro rata refund of prepaid fees for the unused period.

7. Requests from End Users

7.1 Self-service tools. The Service provides tools to export and delete End User Personal Data, which Customer uses to respond to End Users' requests.

7.2 Requests made to Provider. If an End User makes a request to Provider about End User Personal Data, Provider will refer the End User to Customer and will not respond itself unless the law requires it.

7.3 Further assistance. Taking into account the nature of the processing, Provider will give reasonable further assistance on Customer's written request. Provider may charge reasonable fees for assistance beyond the self-service tools.

8. Security incidents and assessments

8.1 Notice. Provider will notify Customer without undue delay after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss or alteration of, or unauthorized disclosure of or access to, End User Personal Data (a "Security Incident"). Notice goes to the email address on Customer's account and includes, as it becomes available, the information Customer reasonably needs to meet its own notification obligations.

8.2 Exclusions. Unsuccessful attempts and activities that do not compromise End User Personal Data, including pings, port scans, denial-of-service attempts and failed log-ins, are not Security Incidents.

8.3 No admission. A notice of a Security Incident is not an acknowledgment of fault or liability.

8.4 Assessments. Taking into account the nature of the processing and the information available to it, Provider will give reasonable assistance, at Customer's expense, with the data protection impact assessments and prior consultations with supervisory authorities that Data Protection Laws require of Customer.

9. Return and deletion

9.1 Export. During the subscription, Customer may export End User Personal Data using the Service's export tools.

9.2 Deletion. After Customer's account ends, Provider deletes End User Personal Data from its active systems within thirty (30) days, unless applicable law requires Provider to keep it. Copies in backups are deleted as those backups expire on their normal rotation and remain protected by this Addendum until then. Records Provider keeps for its own legal purposes, such as consent, opt-out and billing records, are governed by the Privacy Policy.

9.3 Confirmation. On Customer's written request, Provider will confirm the deletion in writing.

10. Audits

10.1 Information. Provider will make available the information reasonably necessary to demonstrate its compliance with this Addendum, in the form of written answers to a reasonable security questionnaire, no more than once a year.

10.2 Audits. Where that information does not meet a requirement of Data Protection Laws, or a supervisory authority requires it, Customer may audit Provider's compliance with this Addendum, itself or through an independent auditor that is not a competitor of Provider and is bound by confidentiality. An audit requires at least thirty (30) days' written notice, takes place no more than once in any twelve (12) months and during business hours, follows a scope agreed in advance, does not include access to other customers' data, and is at Customer's expense.

11. Location and transfers

11.1 Location. Provider stores End User Personal Data in the United States.

11.2 Transfer mechanism. Where Data Protection Laws require a transfer mechanism for End User Personal Data transferred to Provider, the Standard Contractual Clauses approved by the European Commission (Module Two, or Module Three where Customer is itself a processor) and, for the United Kingdom, the UK International Data Transfer Addendum are incorporated into this Addendum by reference. Customer is the data exporter and Provider the data importer; Annexes 1 to 3 of this Addendum complete their appendices; the optional docking clause does not apply; Clause 6 of this Addendum sets the Sub-processor authorization and notice period; and the Clauses are governed by the law of Ireland, with disputes before the courts of Ireland.

12. United States privacy laws

Where Customer is a business and Provider a service provider or contractor under the California Consumer Privacy Act or a similar US state law, Provider: (a) processes End User Personal Data only for the business purpose of providing the Service under the Terms and this Addendum; (b) does not sell or share it; (c) does not retain, use or disclose it outside the direct business relationship with Customer or for any other purpose, except as those laws permit; (d) does not combine it with personal information from other sources, except as those laws permit; (e) complies with those laws and provides the level of privacy protection they require; (f) will notify Customer if it can no longer meet its obligations under them; and (g) allows Customer to take reasonable and appropriate steps to stop and remediate unauthorized use. Provider certifies that it understands these restrictions and will comply with them.

13. General

13.1 Liability. Each party's liability arising out of or relating to this Addendum is subject to the exclusions and limitations of liability in Terms Section 16, which apply to this Addendum and the Terms together, except to the extent Data Protection Laws do not allow them.

13.2 Precedence. This Addendum prevails over the Terms only on the processing of End User Personal Data. Standard Contractual Clauses incorporated under Clause 11.2 prevail over this Addendum where they conflict.

13.3 Governing law. Terms Section 19 governs this Addendum, except as Clause 11.2 provides.

13.4 Changes. Provider may update this Addendum as provided in Terms Section 20.

13.5 Notices. Notices go to [email protected] for data protection matters and to [email protected] for legal notices, First AI Employee LLC, 30 N Gould St Ste N, Sheridan, WY 82801.

13.6 No third-party beneficiaries. This Addendum creates no rights for anyone other than the parties, except as incorporated Standard Contractual Clauses provide.

Annex 1. Details of the processing

Annex 2. Technical and organizational measures

1. Encryption of data in transit using TLS.
2. Encryption at rest of database and file storage, and additional encryption of stored credentials and connection tokens.
3. Role-based access controls for Customer's team, and access to production systems limited to authorized personnel.
4. Logging of changes made through the Service.
5. Separation of each customer's data by customer identifier.
6. Validation of uploaded files.
7. Regular backups.
8. Confidentiality obligations for personnel, as set out in Clause 4.

Annex 3. Sub-processor categories

Services Customer connects to its own accounts, such as its calendar, business software or review platforms, are Customer's own providers and not Sub-processors.