Data Processing Addendum

1. 1. Definitions

Data Protection Laws means all laws applicable to the processing of Customer Personal Data under the Terms, including the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection and US state privacy laws such as the California Consumer Privacy Act as amended (CCPA).

Customer Personal Data means personal data that DataSeller AI processes on behalf of Customer through the Service. Controller, processor, data subject, personal data, processing and personal data breach have the meanings given in Data Protection Laws. Service provider and contractor have the meanings given in the CCPA.

2. 2. Roles and scope

Customer is the controller (or a processor acting for its own controller) and DataSeller AI is the processor (or sub-processor) of Customer Personal Data. For the CCPA, DataSeller AI acts as a service provider.

The subject matter of processing is the provision of the Service. Processing includes storage, ingestion, aggregation, anonymization, transformation, packaging and delivery of data products, and related support. Categories of data subjects and personal data are determined by Customer and may include Customer's end users, customers, employees and business contacts. Processing continues for the term of the Terms plus the deletion period described below.

3. 3. Processing instructions

DataSeller AI will process Customer Personal Data only on Customer's documented instructions, which include the Terms, this DPA and Customer's configuration of the Service, unless law requires otherwise. We will inform Customer if we believe an instruction violates Data Protection Laws.

DataSeller AI will not sell or share Customer Personal Data, retain, use or disclose it for any purpose other than providing the Service, or combine it with personal data received from other sources except as permitted by Data Protection Laws.

Customer is responsible for ensuring that it has a lawful basis and any necessary notices and consents for the processing, including making data products available to Buyers.

4. 4. Confidentiality and personnel

DataSeller AI will ensure that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and receive security and privacy training. Access is limited to personnel who need it to provide the Service.

5. 5. Security measures

DataSeller AI will implement appropriate technical and organizational measures to protect Customer Personal Data, including encryption in transit and at rest, role-based access controls, multi-factor authentication for administrative access, network segmentation, logging and monitoring, vulnerability management, backups and business continuity planning, and secure development practices.

We may update these measures over time, provided that updates do not materially reduce the overall level of protection.

6. 6. Sub-processors

Customer grants general authorization for DataSeller AI to engage sub-processors. Our current categories of sub-processors are described on our Sub-processors page. We will impose data protection obligations on each sub-processor that are no less protective than those in this DPA and remain responsible for their performance.

We will give at least 30 days notice of a new sub-processor. Customer may object on reasonable data protection grounds within that period. If we cannot reasonably address the objection, Customer may terminate the affected part of the Service and receive a refund of any prepaid fees for the remaining term.

7. 7. Data subject requests and assistance

Taking into account the nature of processing, DataSeller AI will provide reasonable assistance to Customer in responding to data subject requests, and in carrying out data protection impact assessments and prior consultations with authorities. If we receive a request directly from a data subject relating to Customer Personal Data, we will refer them to Customer.

8. 8. Personal data breaches

DataSeller AI will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the nature of the breach, the likely consequences and the measures taken or proposed, to the extent known, and we will provide updates as more information becomes available.

9. 9. International transfers

Where Customer Personal Data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the parties agree that the applicable standard contractual clauses (and the UK addendum, where relevant) are incorporated into this DPA by reference, with DataSeller AI as data importer.

10. 10. Audits

On written request no more than once per year, DataSeller AI will provide information reasonably necessary to demonstrate compliance with this DPA, such as summaries of third-party audit reports or completed security questionnaires. Where this is insufficient or required by an authority, Customer may conduct an audit on reasonable notice, during business hours, at its own cost and subject to confidentiality obligations.

11. 11. Return and deletion

After the Terms end, Customer may export its data for 30 days. DataSeller AI will then delete Customer Personal Data within 60 days, including from active systems, with backups overwritten in the normal course, unless law requires retention. Questions about this DPA can be sent to privacy@dataseller.ai.