Data Processing Addendum

1. Scope

This DPA applies when EB processes Personal Data on behalf of Customer in connection with the EverythingBusiness.ai Services.

2. Roles

Where Customer determines the purposes and means of processing Personal Data, Customer acts as controller or business and EB generally acts as processor, service provider, or contractor, as applicable.

Where Customer itself processes Personal Data on behalf of another entity, EB may act as Customer's subprocessor.

3. Processing Instructions

EB processes Customer Personal Data only:

• as necessary to provide the Services;
• through Customer's documented configurations and instructions;
• as described in the governing agreement and this DPA;
• to protect and secure the Services; or
• where required by applicable law.

4. Customer Responsibilities

Customer represents that it possesses the rights and lawful authority required to provide Personal Data to EB and instruct EB to process it.

Customer remains responsible for any notices, permissions, consents, legal bases, or other obligations applicable to Customer's collection and use of Personal Data.

5. Processing Description

Subject matter

Operation of EverythingBusiness.ai.

Duration

The duration of the applicable Services plus applicable retention and deletion periods.

Nature of processing

Retrieval, collection, organization, transmission, storage, analysis, transformation, workflow execution, AI inference, audit recording, authentication, access control, and deletion.

Purposes

Providing customer-authorized workflows, connected-system access, AI functionality, governance, permissions, security, administration, and support.

Potential data subjects

Customer personnel, users, prospects, customers, business contacts, and persons represented within authorized connected systems.

Potential Personal Data

Identifiers, names, email addresses, telephone numbers, business contact information, organization information, authentication identifiers, workflow content, workspace input, connected-system records, technical records, and audit information.

6. Confidentiality

EB will require personnel authorized to process Customer Personal Data to maintain appropriate confidentiality obligations.

7. Security

EB will maintain technical and organizational measures reasonably designed to protect Customer Personal Data taking into account the nature of the Services.

Current measures include, as applicable:

• TLS at the public service boundary;
• tenant isolation;
• row-level security;
• role and permission controls;
• AWS Secrets Manager;
• KMS-backed encryption for designated protected execution information;
• authentication through WorkOS;
• input validation;
• audit-event recording;
• security headers;
• rate limiting;
• restricted runtime containers; and
• backup mechanisms.

8. Subprocessors

Customer grants EB general authorization to use subprocessors reasonably necessary to provide the Services.

EB maintains its current list at its Subprocessors page.

EB will impose legally required data-protection obligations upon subprocessors where applicable.

9. Data Subject Requests

Taking into account the nature of processing, EB will provide reasonable assistance to Customer concerning legally required requests by data subjects.

Where EB receives a request concerning Personal Data controlled by Customer, EB may direct the requester to Customer where legally permitted.

10. Security Incidents

EB will notify Customer without undue delay after becoming aware of a confirmed security breach involving Customer Personal Data where such notification is required by applicable law or the parties' agreement.

EB will provide reasonably available information necessary for Customer to fulfill applicable legal obligations.

11. Data Return and Deletion

Following termination or valid Customer instruction, EB will delete or return Customer Personal Data as required by applicable law and the parties' governing agreement, subject to:

• legal holds;
• security requirements;
• legally required records;
• audit obligations;
• applicable retention periods; and
• ordinary backup cycles.

Current system behavior retains some audit and operational records independently of active Customer access.

12. Customer Credentials

Connector and customer-supplied AI credentials are protected through EB's credential-management infrastructure.

Upon organization containment, credential references are revoked so the application cannot resolve them.

Current architecture does not automatically delete the underlying AWS Secrets Manager value when an organization is archived.

EB therefore does not promise instantaneous physical destruction of every credential copy immediately upon termination.

13. Compliance Information

Upon reasonable written request, and subject to appropriate confidentiality and security limitations, EB will make information reasonably necessary to demonstrate compliance with applicable processor obligations available to Customer.

EB does not currently provide direct in-application customer access to its complete audit database.

14. California Personal Information

Where the California Consumer Privacy Act applies and EB acts as a service provider or contractor, EB will process applicable Personal Information for the limited and specified purposes associated with providing the Services and as otherwise permitted by applicable law.

EB will not sell or share such Customer Personal Information for cross-context behavioral advertising.

California's current privacy regime requires qualifying businesses to provide disclosures concerning categories collected, purposes, rights, and methods for exercising those rights.

15. International Transfers

Where Personal Data subject to GDPR, UK GDPR, or another applicable cross-border transfer restriction is transferred in circumstances requiring a lawful transfer mechanism, the parties will cooperate to implement an applicable mechanism, including Standard Contractual Clauses or equivalent mechanisms where required.

16. Conflict

If this DPA conflicts with another governing agreement specifically regarding processing of Personal Data, this DPA controls regarding that subject unless the parties expressly agree otherwise.

17. Governing Law

Except where applicable privacy law requires otherwise, this DPA is governed by the laws of the State of Arizona.

Contact

Email: tech@everythingbusiness.ai