Data Processing Addendum

• Applicable Data Protection Laws: laws and regulations applicable to the processing of Personal Data under the Agreement, including where applicable the GDPR, UK GDPR, Swiss data-protection law, PIPEDA and applicable Canadian provincial privacy laws, the CCPA/CPRA, and other applicable U.S. state privacy laws.
• Customer Personal Data: Personal Data contained in Customer Data that Asyrx processes on behalf of Customer to provide the Services.
• Controller / Business: the party that determines the purposes and means of processing Personal Data or the analogous role under applicable law.
• Processor / Service Provider / Contractor: the party that processes Personal Data on behalf of a Controller or Business or the analogous role under applicable law.
• Personal Data: information relating to an identified or identifiable individual, personal information, or personal data as defined by Applicable Data Protection Laws.
• Personal Data Breach: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data where the applicable law treats the event as a reportable or regulated personal-data breach.
• Sub-processor: a third party engaged by Asyrx to process Customer Personal Data in connection with the Services.

Customer is the Controller or Business, and Asyrx is the Processor, Service Provider, or Contractor, to the extent Asyrx processes Customer Personal Data on Customer’s behalf. Each party remains responsible for its own compliance with Applicable Data Protection Laws for processing it performs as an independent controller or business.

Customer instructs Asyrx to process Customer Personal Data only as necessary to provide, secure, support, and maintain the Services; comply with documented Customer instructions consistent with the Agreement; and comply with applicable law.

• Customer will ensure that its instructions comply with Applicable Data Protection Laws.
• Customer will provide required notices and obtain required rights, consents, and lawful bases for Customer Personal Data.
• Customer will use reasonable data minimization and avoid submitting sensitive or regulated data not required for the Services.
• Customer will configure its own authorization, execution, human-review, and policy systems appropriately. Asyrx’s risk intelligence does not transfer final decision responsibility to Asyrx.

Asyrx will process Customer Personal Data only on documented instructions from Customer, including the Agreement, use of the Services, and Customer configuration, unless required by applicable law. If law requires processing beyond Customer instructions, Asyrx will inform Customer before processing unless legally prohibited.

Asyrx will ensure that personnel authorized to process Customer Personal Data are subject to confidentiality obligations and access Customer Personal Data only as necessary for their duties.

Taking into account the state of the art, implementation costs, nature, scope, context, and purposes of processing, and risks to individuals, Asyrx will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Measures are described in Annex II and may evolve so long as the overall level of protection is not materially reduced.

Asyrx will notify Customer without undue delay after confirming a Personal Data Breach affecting Customer Personal Data. The notice will provide information reasonably available to Asyrx that Customer may need to meet applicable notification obligations, including the nature of the incident, affected data or systems where known, likely consequences where reasonably assessable, and measures taken or proposed. Asyrx’s notice is not an admission of fault or liability.

Customer grants Asyrx general authorization to engage Sub-processors to provide the Services. Asyrx will maintain a current Sub-processors page and will enter into written terms requiring Sub-processors to protect Customer Personal Data in a manner appropriate to their role and the applicable law.

Where required by an Enterprise Agreement or Applicable Data Protection Laws, Asyrx will provide reasonable advance notice of a new Sub-processor. Customer may object on reasonable data-protection grounds within [15] days of notice. The parties will work in good faith to address the objection. If no reasonable alternative is available, either party may terminate the affected portion of the Services as provided in the Agreement.

Taking into account the nature of processing, Asyrx will provide reasonable assistance to Customer, through available product functionality or otherwise, to respond to requests by individuals to exercise privacy rights. If Asyrx receives a request that clearly relates to Customer Personal Data controlled by Customer, Asyrx may direct the requester to Customer and will not respond substantively unless authorized or legally required.

Taking into account the nature of processing and information available to Asyrx, Asyrx will provide reasonable assistance with Customer obligations concerning security, breach response, data-protection impact assessments, and prior consultation with regulators where required. Additional or extraordinary assistance may be subject to reasonable fees unless the need for assistance results from Asyrx’s breach of this DPA.

Upon termination or expiration of the Services, Asyrx will delete or return Customer Personal Data in accordance with the Agreement, Customer configuration, and applicable law. Asyrx may retain data where required by law or where contained in backups that are not reasonably capable of immediate deletion, provided retained data remains protected and is not used for other purposes.

Asyrx will make available information reasonably necessary to demonstrate compliance with this DPA. Where Asyrx maintains independent security reports or certifications, Asyrx may provide them under appropriate confidentiality restrictions. Subject to reasonable notice, confidentiality, scope limitations, and no unreasonable interference with operations, Customer may conduct an audit where required by Applicable Data Protection Laws and where available reports are insufficient. Unless required by law or caused by Asyrx’s material breach, Customer will bear its audit costs.

Where Customer Personal Data is transferred from the EEA to a country not covered by an adequacy decision and the GDPR requires a transfer mechanism, the applicable modules of the European Commission’s 2021 Standard Contractual Clauses (“EU SCCs”) are incorporated by reference. Where applicable, the UK International Data Transfer Addendum or other lawful UK mechanism will apply. Swiss-law adjustments will apply where required for transfers subject to Swiss data-protection law.

The parties will cooperate in good faith on transfer impact assessments and supplementary measures where legally required.

To the extent the CCPA/CPRA or analogous U.S. state privacy law applies and Asyrx acts as a service provider, contractor, or processor, Asyrx will process Customer Personal Data only for the specified business purposes in the Agreement; will not sell or share Customer Personal Data for cross-context behavioral advertising; will not retain, use, or disclose Customer Personal Data outside the direct business relationship except as permitted by law; and will provide the same level of privacy protection required of the applicable service-provider or processor role.

Where Canadian privacy law applies, Asyrx will process Customer Personal Data under Customer’s instructions and maintain safeguards appropriate to the sensitivity of the information. Customer remains accountable for determining lawful purposes, required notices and consent, and cross-border processing obligations applicable to Customer.

The Services are designed to operate primarily on structured action metadata and do not require broad ingestion of prompts or sensitive customer content for ordinary risk assessment. Unless expressly supported and agreed in writing, Customer will not submit payment-card data, passwords, authentication secrets, biometric identifiers, protected health information, children’s data, special-category data, or other highly sensitive data that is unnecessary for the Services.

This DPA remains in effect while Asyrx processes Customer Personal Data under the Agreement. If this DPA conflicts with the Agreement on data-protection matters, this DPA controls. If the EU SCCs apply and conflict with this DPA, the EU SCCs control.

Access control

• Role-based access and tenant-aware authorization appropriate to the Service architecture.
• Restricted administrative access and least-privilege principles.
• Secure management of API keys, secrets, and authentication materials.

Data protection

• Encrypted transport using industry-standard TLS for supported production interfaces.
• Private or access-controlled storage for Customer Data.
• Tenant isolation controls, including database access policies appropriate to the architecture.
• Data minimization and redaction of secrets from logs where practicable.

Operational security

• Logging and auditability for material security and administrative events.
• Input validation, rate limiting, request identifiers, and error handling for public APIs.
• Monitoring for service failures, authentication anomalies, and material operational issues.

Secure development

• Source control, change management, testing, and separation of demo/test/live environments.
• Dependency and vulnerability management appropriate to the size and maturity of the Services.
• Risk-engine and policy versioning to preserve historical assessment reproducibility.

Incident management

• Processes to investigate suspected security incidents and escalate confirmed Personal Data Breaches.
• Customer notification and cooperation as required by this DPA and Applicable Data Protection Laws.

Resilience and recovery

• Reasonable backups, recovery procedures, and service-continuity measures appropriate to the production architecture.
• Use of reputable infrastructure providers with security controls relevant to their services.

The current authorized Sub-processors are identified on the public Asyrx Sub-processors page, which is incorporated into this DPA by reference. Before signature or publication, confirm that the list accurately reflects production data flows.