Data Processing Addendum

1. Scope and roles

This Data Processing Addendum ("DPA") is between 3AM Super Intelligence Inc. ("3AM", "Processor") and the customer that has agreed to the Software Licence Agreement or another agreement with us for 3AM (the "Agreement"; the customer is the "Customer"). Terms not defined here have the meaning given in the Agreement or in Data Protection Law.

"Data Protection Law" means all laws that apply to the processing of personal data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, India's Digital Personal Data Protection Act, 2023, and US state privacy laws such as the California Consumer Privacy Act.

Where we are a processor

We process personal data on the Customer's behalf only when the Customer, or someone acting for it, gives us Support Data: logs, diagnostics, configuration, screenshots, screen shares, exports or other material shared so we can provide support or professional services. For Support Data, the Customer is the controller (or a processor acting for its own controller), and 3AM is its processor (or sub-processor).

What we don't receive

The Software runs on the Customer's infrastructure. Customer Data (alerts, logs, metrics, incident records, audit logs, credentials, and data in connected systems) is processed by the Software under the Customer's control and is not transmitted to 3AM. Model providers the Customer chooses to send masked evidence to (for example, a hosted model endpoint the Customer contracts with) are the Customer's own suppliers, not our sub-processors.

Where we are a controller

We process licence and account data (licence ids, install fingerprints, Software versions, signed usage reports with hashed service names, the IP addresses of licence requests, and business contact details) as an independent controller, to administer licences, prevent unlicensed use, bill and communicate with the Customer, as described in our Privacy Policy. This DPA's processor terms don't apply to that data, but we protect it with the same security measures.

2. Details of the processing

3. Instructions

We process Support Data only on the Customer's documented instructions, which are this DPA, the Agreement and the Customer's support requests, unless the law requires otherwise; in that case we'll tell the Customer first, unless the law forbids it. We'll tell the Customer if we believe an instruction breaches Data Protection Law. We won't sell Support Data, share it for cross-context behavioural advertising, use it to train models, or combine it with other data, except as Data Protection Law permits a processor to.

4. Our personnel

Only personnel who need Support Data to provide support can access it, and they are bound by confidentiality obligations.

5. Security

We implement the technical and organisational measures in Annex 1, appropriate to the risk. We may update them, provided they don't reduce the overall level of protection.

6. Sub-processors

The Customer authorises us to use the sub-processors on our sub-processor list. We impose data protection terms on each that are at least as protective as this DPA, and we remain responsible for their performance.

We'll give at least 30 days' notice before adding or replacing a sub-processor, by updating the list and emailing customers who have asked for notices at [email protected]. The Customer may object on reasonable data protection grounds within that period; we'll then discuss a solution in good faith, and if we can't find one, the Customer may end the affected part of the Agreement and receive a refund of prepaid fees for it.

7. International transfers

We are a US company, and Support Data may be processed in the United States and other countries where we or our sub-processors operate. Where a transfer of personal data from the EEA, the UK or Switzerland to a country without an adequacy decision takes place under this DPA, the parties agree that:

• the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference: Module Two where the Customer is a controller, Module Three where it is a processor; clause 7 (docking) applies; in clause 9, option 2 (general authorisation) with the notice period in section 6; the optional wording in clause 11 does not apply; in clauses 17 and 18, the law and courts of Ireland; Annex I is section 2 of this DPA, with the Customer as data exporter and 3AM as data importer; Annex II is Annex 1;
• for the UK, the International Data Transfer Addendum issued by the Information Commissioner applies, with its tables completed from this DPA, and either party may end it as section 19 of the Addendum allows;
• for Switzerland, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, the Federal Data Protection and Information Commissioner is the competent authority, and the term "member state" includes Switzerland.

If we move processing to another provider or region, these protections continue to apply. If a transfer mechanism is invalidated, we'll work with the Customer to put a valid one in place.

8. Assistance, rights and breaches

We'll help the Customer, taking into account the nature of the processing, to answer data subject requests, carry out data protection impact assessments and consult authorities, as they relate to Support Data. We'll pass on any data subject request we receive about Support Data without answering it ourselves, unless the Customer authorises us to.

We'll notify the Customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Support Data, with the information we have and will update it as we learn more, so the Customer can meet its own obligations. We'll take reasonable steps to contain and remedy the breach. Notifying a breach is not an admission of fault.

9. Deletion

We delete Support Data when it's no longer needed for the support request it was sent for, and in any case within 90 days after the request is closed, unless the Customer asks us to keep it longer or the law requires us to. At the end of the Agreement, we delete any remaining Support Data within 30 days, or return it first if the Customer asks. Copies in backups are deleted as the backups expire and are protected until then.

10. Audits

We'll make available the information reasonably needed to show compliance with this DPA, including answers to the Customer's security questionnaires and, when we have them, our third-party audit reports. If that isn't enough, or a regulator requires it, the Customer (or an independent auditor it appoints, bound by confidentiality) may audit our compliance with this DPA once a year, on 30 days' notice, during business hours, at its own cost, in a way that doesn't disrupt our business or compromise other customers' data. Regulated customers (such as banks and financial institutions) may also exercise the audit and access rights their regulators require of their outsourcing arrangements, on the same principles.

11. US state privacy laws

Where the CCPA or a similar US state law applies, 3AM is a "service provider" or "processor" for Support Data. We will not sell or share it; retain, use or disclose it outside the direct business relationship or for any purpose other than the business purposes in this DPA; or combine it with personal information from other sources, except as the law permits. We certify that we understand and will comply with these restrictions, and will tell the Customer if we can no longer meet our obligations.

12. General

This DPA is governed by the law that governs the Agreement, except where the Standard Contractual Clauses require otherwise. If this DPA and the Agreement conflict on data protection, this DPA prevails; if this DPA and the Standard Contractual Clauses conflict, the Clauses prevail. Each party's liability under this DPA is subject to the limits in the Agreement, to the extent Data Protection Law allows.

Contact for data protection matters: [email protected]; 3AM Super Intelligence Inc., c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA.

Annex 1: Security measures