Data Processing Addendum

This DPA reflects the parties' agreement regarding the processing of personal data carried out by Ultron on behalf of the customer in the course of providing the service. It supplements the Terms of Service. In the event of a conflict between this DPA and the Terms of Service, this DPA controls for matters of personal data processing.

Terms that are capitalised but undefined here have the meaning given by the General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR). The terms controller, processor, data subject, personal data, processing, and personal data breach carry their GDPR meanings.

Customer Personal Data means personal data that the customer or its authorised users submit to or generate through the service. Subprocessor means a third party engaged by Ultron to process Customer Personal Data on its behalf in connection with the service.

The customer acts as the data controller for Customer Personal Data. Ultron acts as the processor of Customer Personal Data and processes it only on the customer's documented instructions. Where Ultron processes personal data for its own purposes (for example, billing records, telemetry, account information), Ultron acts as a separate data controller and the Privacy Policy describes that processing.

Ultron processes Customer Personal Data only on the customer's documented instructions, including with regard to international transfers, unless required to act otherwise by Romanian or Union law to which Ultron is subject. In the latter case, Ultron will inform the customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

The customer's instructions are reflected in this DPA, in the Terms of Service, and in the customer's documented use of the service. The customer can issue further instructions by writing to privacy@51ultron.com. Ultron will inform the customer if, in its opinion, an instruction infringes the GDPR or other applicable data protection law.

Ultron ensures that personnel authorised to process Customer Personal Data are bound by appropriate obligations of confidentiality, whether through written agreements or under a statutory duty of confidence. Access is granted on a need-to-know basis and audited.

The customer authorises Ultron to engage subprocessors to process Customer Personal Data, subject to the conditions below. The current list of subprocessors is published on the Subprocessors page.

• Ultron imposes on each subprocessor data protection obligations no less protective than those in this DPA.
• Ultron remains liable to the customer for the performance of its subprocessors.
• Ultron gives at least thirty days notice of the addition or replacement of a subprocessor by updating the Subprocessors page and, on request, by emailing customers who have signed up for the notification list.
• The customer may object to a new subprocessor on reasonable data protection grounds within the notice period. If the parties cannot reach a resolution, the customer may terminate the affected portion of the service and receive a prorated refund of pre-paid fees for that portion.

A copy of the executed clauses for a specific transfer is available on request to privacy@51ultron.com.

This section applies where Ultron processes personal information of California residents that is subject to the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the CCPA). For that personal information, the customer is the business and Ultron is a service provider as those terms are defined in the CCPA.

• Ultron processes the personal information only to perform the service under the Terms of Service, or as otherwise permitted by the CCPA for a service provider.
• Ultron does not sell or share the personal information, and does not retain, use, or disclose it for any purpose other than the business purposes specified in the agreement, including outside the direct business relationship with the customer.
• Ultron does not combine the personal information with personal information it receives from other sources, except as permitted by the CCPA for a service provider.
• Ultron certifies that it understands the restrictions in this section and will comply with them.
• Ultron notifies the customer if it determines it can no longer meet its obligations under the CCPA, and the customer may take reasonable steps to stop and remediate unauthorised use.

Ultron notifies the customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notification describes, to the extent the information is available, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address the breach.

Ultron does not notify the relevant supervisory authority or data subjects on the customer's behalf for breaches involving Customer Personal Data. That obligation sits with the customer as controller. Ultron provides the information the customer needs to comply with that obligation.

Ultron makes available to the customer all information reasonably necessary to demonstrate compliance with this DPA, including by providing the Security page, summaries of independent audits where they exist, and answers to a reasonable security questionnaire on request.

The customer may, at its own cost, audit Ultron's compliance with this DPA no more than once per calendar year, subject to thirty days written notice, during regular business hours, in a manner that does not interfere with Ultron's operations or compromise the security of other customers. The parties cooperate in good faith on the scope and conduct of the audit. The customer may also rely on the most recent independent third-party audit reports Ultron provides under non-disclosure terms.

Ultron retains records of its processing activities carried out on behalf of the customer for three years after the end of the agreement, or longer where a law to which Ultron is subject requires it, so that the customer can demonstrate compliance to a supervisory authority.

Upon termination or expiration of the service, the customer can export Customer Personal Data from the platform until the end of the retention window described in the Privacy Policy. After that window, Ultron deletes Customer Personal Data from its systems, except where retention is required by Union or Romanian law, in which case Ultron isolates the retained data and continues to process it only to the extent and for the period required by that law.

If there is a conflict between the documents that govern the processing of Customer Personal Data, the following order of precedence applies, from highest to lowest: first, the Standard Contractual Clauses and any country-specific addendum incorporated under the International transfers section; second, this DPA; third, the Terms of Service; fourth, any other agreement between the parties. A more specific term controls over a more general one on the same subject.

Each party's liability arising out of or related to this DPA, whether in contract, tort, or any other theory, is subject to the limitations and exclusions of liability set out in the Terms of Service. Any reference in those limitations to the liability of a party means the aggregate liability of that party and its affiliates under the Terms of Service and all DPAs together. Nothing in this DPA limits a data subject's rights under the GDPR or the Standard Contractual Clauses.

For most customers, the published DPA is automatically incorporated into the Terms of Service. No separate signature is required. Enterprise customers who need a signed counterpart can request one by writing to legal@51ultron.com. We can also execute the European Commission's Standard Contractual Clauses separately on request.

The technical and organisational measures Ultron applies to protect Customer Personal Data are documented in full on the Security page, which is incorporated into this DPA and into Annex II of the Standard Contractual Clauses by reference. The summary below lists the measures by category; the Security page is the controlling description.

The authorised subprocessors engaged to process Customer Personal Data, their location, the categories of data they touch, and the function they perform are listed in full on the Subprocessors page, which is incorporated into this DPA and into Annex III of the Standard Contractual Clauses by reference. The customer authorises these subprocessors under Clause 9 of the EU SCCs (option 2, general written authorisation), with the notice period and objection right set out in the Subprocessors section above.