Data Processing Addendum

This annex is included in the Terms of Service.

This Annex applies where OverAI processes Personal Data on behalf of Customer. Capitalized terms not defined here have the meanings given in the Terms.

A.1 Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person that Customer submits to or through the Services, as further described in Section A.3.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, use, disclosure, or deletion.
• "Data Subject" means the individual to whom Personal Data relates.
• "Privacy Laws" means all applicable laws and regulations governing the processing of Personal Data, including CCPA, HIPAA (to the extent applicable), and any other applicable state or federal privacy laws.
• "Security Incident" means any unauthorized or unlawful access to, disclosure, alteration, loss, or destruction of Personal Data.

A.2 Roles and Responsibilities

The parties acknowledge that Customer is the Controller and OverAI is the Processor with respect to Personal Data processed under the Terms. Where Customer processes Personal Data for another Controller, Customer is a Processor and OverAI is a Subprocessor.

Where the California Consumer Privacy Act or a similar US state law applies, Customer is a Business or Controller and OverAI is a Service Provider, Contractor, or Processor.

OverAI shall process Personal Data only on behalf of and in accordance with Customer's documented instructions, including as set forth in the Terms and this Annex.

OverAI acts as an independent Controller for account administration, billing, security, fraud prevention, support, and the product and website analytics described in the Privacy Notice. This Annex does not govern that Processing.

A.3 Details of Processing

• Subject matter: providing the OverAI Services.
• Nature and purpose: hosting, transmitting, securing, supporting, and operating the Services on Customer's behalf.
• Categories of Personal Data: names, email addresses, account identifiers, usage records, and other Personal Data Customer submits.
• Data Subjects: Customer's personnel, contractors, customers, and end users.
• Duration: the term of the Terms, and thereafter as set forth in Section A.12.

A.4 OverAI Obligations

OverAI shall:

• Process Personal Data only on documented instructions from Customer, including as authorized under the Terms, unless required to do so by applicable law.
• Ensure that persons authorized to process Personal Data are subject to appropriate confidentiality obligations.
• Implement and maintain technical and organizational measures appropriate to the risk, as further described in Section A.6.
• Engage sub-processors only as set forth in Section A.7.
• Assist Customer in responding to Data Subject requests and in meeting Customer's obligations under applicable Privacy Laws, taking into account the nature of the processing.
• Make available to Customer information reasonably necessary to demonstrate compliance with this Annex. OverAI's then-current SOC 2 Type II report and written responses to reasonable security questionnaires satisfy this obligation. Where Privacy Laws require more, Customer may conduct one audit in any 12-month period, on at least 30 days' written notice, during business hours, at Customer's expense, subject to confidentiality, and without unreasonable disruption to OverAI's operations.
• Upon termination of the Terms, at Customer's election, delete or return all Personal Data in accordance with Section A.12.
• Promptly notify Customer if, in OverAI's opinion, an instruction from Customer infringes applicable Privacy Laws.
• Not sell or share Personal Data, retain, use, or disclose it outside the business purposes described in this Annex and the Terms or outside the direct business relationship with Customer, or combine it with personal data from another source except as permitted by Privacy Laws. OverAI will provide the level of privacy protection required of Customer by applicable Privacy Laws and will notify Customer if it determines it can no longer meet these obligations.

A.5 Customer Obligations

Customer shall:

• Ensure that its instructions to OverAI comply with applicable Privacy Laws.
• Provide all required notices and obtain all necessary consents from Data Subjects to permit OverAI to process Personal Data in accordance with this Annex.
• Be responsible for the accuracy, quality, and legality of Personal Data submitted to the Services.

A.6 Security

OverAI shall implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized access, disclosure, alteration, or destruction, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to Data Subjects. Such measures include at a minimum:

• Encryption of Personal Data in transit and at rest.
• Access controls limiting Personal Data access to authorized personnel on a need-to-know basis.
• Regular security assessments and testing.
• Incident detection, response, and recovery procedures.
• Maintenance of an annual SOC 2 Type II audit. On request, OverAI will provide the current report to Customers on a paid plan, subject to Section 5 of the Terms.

A.7 Sub-Processors

Customer provides general written authorization for OverAI to engage sub-processors to assist in providing the Services, subject to the following conditions. OverAI shall: (a) enter into a written agreement with each sub-processor imposing data protection obligations no less protective than those in this Annex; (b) maintain an up-to-date Subprocessor List, which is incorporated into this Annex; and (c) remain liable to Customer for the acts and omissions of its sub-processors to the same extent as if OverAI had performed the processing directly.

OverAI shall email Customer's organization administrators at least 30 days before authorizing a new sub-processor that processes Personal Data for all Customers, unless an emergency or security need requires shorter notice, and Customer may reasonably object to such changes within that notice period.

OverAI may add a sub-processor at any time where it processes Personal Data only after Customer's organization opts in, for example by selecting a model, feature, or integration served by that provider. Customer's selection is its instruction to use that sub-processor. Third-party integrations and destinations Customer connects or directs OverAI to use are Customer's instructions, not OverAI sub-processors.

A.8 Security Incidents

OverAI shall notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Security Incident affecting Personal Data. Such notice shall include, to the extent known at the time: (a) a description of the nature of the Security Incident; (b) the categories and approximate number of Data Subjects and Personal Data records affected; (c) the likely consequences of the Security Incident; and (d) measures taken or proposed to address the Security Incident. OverAI shall cooperate with Customer and take such steps as Customer reasonably requests to investigate, contain, and remediate the Security Incident.

A.9 Data Subject Rights

OverAI shall promptly notify Customer if it receives a request from a Data Subject to exercise any right under applicable Privacy Laws (including rights of access, correction, deletion, or portability). OverAI shall not respond to such requests directly except as instructed by Customer or as required by law, and shall provide Customer with reasonable assistance to respond to such requests within applicable legal timeframes.

A.10 HIPAA

OverAI will process Protected Health Information ("PHI") as defined under HIPAA only if the parties have executed a mutually agreed business associate agreement ("BAA"), in which case OverAI will comply with all applicable HIPAA requirements as a Business Associate. In the event of any conflict between this Annex and any such BAA with respect to PHI, the BAA will control.

A.11 Data Transfers

OverAI primarily hosts and processes Personal Data in the United States and shall not transfer Personal Data outside of the United States without Customer's prior written consent, except as required by applicable law.

If any such transfer is required, OverAI shall ensure appropriate safeguards are in place in accordance with applicable Privacy Laws, including the Standard Contractual Clauses or another transfer mechanism where Privacy Laws require one. Transfers through an integration, automation, or destination Customer configures are made on Customer's instructions.

A.12 Term and Termination

This Annex shall remain in effect for the duration of the Terms and for as long as OverAI retains Personal Data.

Upon expiration or termination of the Terms, OverAI shall, at Customer's written direction, delete or return all Personal Data within sixty (60) days.

OverAI shall delete all remaining Personal Data within thirty (30) days thereafter and shall certify such deletion in writing upon Customer's request, excluding backup copies which are deleted in the ordinary course of OverAI's backup cycle and remain subject to the confidentiality obligations of the Terms, and except as applicable law requires retention.

In the absence of Customer's written direction, the retrieval and deletion periods in Section 7 of the Terms apply.

A.13 Limitation of Liability

Each party's liability under this Annex shall be subject to the limitations of liability set forth in the Terms, except to the extent that applicable Privacy Laws require otherwise.

A.14 Order of Precedence

In the event of any conflict between this Annex and the Terms with respect to the processing of Personal Data, this Annex shall control. In the event of any conflict between this Annex and any business associate agreement executed by the parties with respect to PHI, that agreement will control.

Questions, objections, and audit requests may be sent to hello@overai.com.