Get in touch

Thank you! Your submission has been received!
Close Form
Oops! Something went wrong while submitting the form.

Data Processing Addendum

Last updated March 3, 2026.

RunLLM, Inc, with a principal place of business located at 16 N San Mateo Drive, San Mateo, CA 94401 (“Company”) and the Customer enter into this Data Processing Addendum (including the Schedules and Annexes attached hereto, together “DPA”) as of the date signed by both parties. This DPA forms part of the Agreement executed in writing between the parties (collectively, the “Agreement”) between the parties under which Company will provide the Service to Customer which involves the Processing of Personal Data subject to Applicable Data Protection Laws (each as defined below). The purpose of this DPA is to set forth the terms under which Company Processes Personal Data on behalf of Customer.

This DPA consists of the main body and Schedules 1 through 4. Execution of this DPA shall include signature and acceptance of the Standard Contractual Clauses (defined below) and its Annexes (see Schedule 2 below).

  1. Definitions. Capitalized terms used but not defined in this DPA have the meanings set forth in the Agreement. The terms controller, data subject, processor and supervisory authority have the meanings set forth in the Applicable Data Protection Laws.
  1. “Authorized Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity, where “control” refers to the power to direct or cause the direction of the subject entity, whether through ownership of voting securities, by contract or otherwise.
  2. “Applicable Data Protection Laws” means the privacy, data protection and data security laws and regulations of any jurisdiction applicable to the Processing of Personal Data under the Agreement, which may include without limitation, European Data Protection Laws, UK GDPR and the United States including the CCPA.
  3. “CCPA” means the California Consumer Privacy Act of 2018 and any regulations promulgated thereunder, in each case, as amended from time to time, including the California Privacy Rights Act of 2020, and any regulations promulgated thereunder.
  4. “EEA” means the European Economic Area.
  5. “European Data Protection Laws” means the GDPR and other data protection laws and regulations of the EEA and European Union, and the Member States of each of the foregoing, to the extent applicable to the Processing of Personal Data under the Agreement.
  6. “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
  7. “Information Security Incident” means a confirmed breach of Company’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in Company’s possession, custody or control. Information Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.
  8. “Personal Data” means Customer Data that constitutes “personal data,” “personal information,” or “personally identifiable information” defined in Applicable Data Protection Laws, or information of a similar character regulated thereby,” provided that such data is electronic data and information submitted by or for Customer to the Services.
  9. “Public Authority” means a government agency or law enforcement authority, including judicial authorities.
  10. “Processing” or “Process” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
  11. “Security Measures” are Company’s security measures implemented and maintained as administrative, technical and physical safeguards designed to protect the security and integrity of Personal Data and prevent Information Security Incidents, further described in Schedule 2 Annex III hereto and any other measures required by Applicable Data Protection Laws.
  12. “Standard Contractual Clauses” means Standard Contractual Clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and the Council approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, currently located here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
  13. “Subprocessors” or “Sub-processor” means any third party processor that Company engages to Process Personal Data in relation to the Services. 
  14. “UK GDPR” means the GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 ("UK GDPR") and the Data Protection Act 2019. 
  1. Duration and Scope of DPA. This DPA will remain in effect so long as Company Processes Personal Data, notwithstanding the expiration or termination of the Agreement. Schedules 1 and 2 to this DPA apply solely to Processing subject to European Data Protection Laws. Schedule 3 to this DPA applies solely to Processing subject to the UK GDPR. Schedule 4 to this DPA applies solely to Processing subject to the CCPA to the extent Customer is a “business” (as defined in CCPA) with respect to such Processing.
  2. Customer Instructions. Company will Process Personal Data only in accordance with Customer’s instructions to Company. This DPA is a complete expression of such instructions, and Customer’s additional instructions will be binding on Company only pursuant to an amendment to this DPA signed by both parties. Customer instructs Company to Process Personal Data via the Services and as authorized by the Agreement. Company shall inform Customer immediately: (a) if, in its opinion, an instruction from Customer constitutes a breach of any Applicable Data Protection Laws; (b) if Company is unable to follow Customer’s instructions for the Processing of Personal Data; or (c) if Company has reason to believe that Company is subject to changes in Applicable Data Protection Laws contrary to any Customer instructions or terms or requirements of this DPA.
  3. Security of Personal Data.
  1. Company Security Measures. Company may update the Security Measures from time to time, so long as the updated measures do not materially decrease the overall protection of Personal Data.
  2. Information Security Incidents. Company will notify Customer without undue delay of any Information Security Incident of which Company becomes aware. Such notifications will describe available details of the Information Security Incident, including steps taken to mitigate the potential risks and steps Company recommends the Customer take to address the Information Security Incident. Company’s notification of or response to an Information Security Incident will not be construed as Company’s acknowledgement of any fault or liability with respect to the Information Security Incident.
  3. Audits of Compliance & DPIAs. 
    1. Customer may audit Company’s compliance with its obligations under this DPA only if specifically required by European Data Protection Laws, including if mandated by Customer’s supervisory authority, at Customer’s sole cost, on no less than 15 days advanced written notice. Such audit must be conducted at Company’s principal place of business, during regular business hours, and may not unreasonably interfere with Company’s business activities.
    2. Company will contribute to each audit by providing Customer or Customer’s supervisory authority with the information and assistance reasonably necessary to conduct the audit. If a third party is to conduct the audit, Company may object to the auditor if the auditor is, in Company’s reasonable opinion, not independent, a competitor of Company, or otherwise manifestly unsuitable. Such objection by Company will require the Customer to appoint another auditor or conduct the audit itself.
    3. If the controls or measures to be assessed in the requested audit are addressed in a Company SOC 2 Type 2, or similar audit report, performed by a qualified third party auditor within twelve (12) months of Customer’s audit request and Company has confirmed there have been no known material changes in the controls audited since the date of such report, Customer agrees to accept such report in lieu of requesting an audit of such controls or measures.
    4. Customer shall reimburse Company for any time expended by Company and any third parties in connection with any audits or inspections under this Section 4(c) at Company’s then-current professional services rates, which shall be made available to Customer upon request. For clarity, Customer will be responsible for any fees charged by any auditor appointed by Customer to execute any such audit.
  4. Data Protection Impact Assessments (DPIAs). Upon Customer’s written request, Company will provide Customer with reasonable cooperation and assistance needed to fulfil Customer’s obligation under Applicable Data Protection Laws to carry out a data protection impact assessment related to Customer’s use of the Services, to the extent Customer does not otherwise have access to the relevant information, and to the extent such information is available to Company.
  1. Customer’s Responsibilities.
  1. Customer Obligations. Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data. Customer specifically acknowledges and agrees that its use of the Services will not violate the rights of any data subject, including those that have opted-out from sales or other disclosures of personal data, to the extent applicable under Applicable Data Protection Laws. Without limitation of Customer’s obligations under the Agreement, Customer: (a) agrees that Customer is solely responsible for its use of the Services, including (1) making appropriate use of the Services to ensure a level of security appropriate to the risk in respect of the Personal Data, (2) securing the account authentication credentials, systems and devices Customer uses to access the Services, (3) securing Customer’s systems and devices that Company uses to provide the Services, and (4) backing up Personal Data; and (b) has given all notices to, and has obtained all consents from, including where the Customer is a processor by ensuring that the ultimate controller does so, individuals to whom Personal Data pertains and all other parties as required by applicable laws or regulations for Company to Process Personal Data as contemplated by the Agreement.
  2. Prohibited Data. Customer represents and warrants to Company that Customer Data does not and will not, without Company’s prior written consent, contain any social security numbers or other government-issued identification numbers, protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA) or other information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; health insurance information; biometric information; passwords for online accounts; credentials to any financial accounts; tax return data; credit reports or consumer reports; any payment card information subject to the Payment Card Industry Data Security Standard; information subject to the Gramm-Leach-Bliley Act, Fair Credit Reporting Act or the regulations promulgated under either such law; information subject to restrictions under Applicable Data Protection Laws governing Personal Data of children, including, without limitation, all information about children under 16 years of age; or any information that falls within any special categories of data (as defined in GDPR).
  1. Compliance with Laws & Data Subject Rights.
  1. Compliance with Laws. Each party will comply with all Applicable Data Protection Laws. In particular, Customer will comply with its obligations as controller (or on behalf of controller) and Company will comply with its obligations as processor.
  2. Personal Data Disclosures & Government Requests. Company will not disclose Personal Data to any third party, including any Public Authority, except: (i) as otherwise permitted under the Agreement including this DPA; or (ii) as necessary to comply with Applicable Data Protection Laws including with respect to any valid and/or binding Public Authority court order (e.g., a law enforcement subpoena). If Company receives a binding order from a Public Authority requesting access to or disclosure of Personal Data, Company will notify Customer of the request unless otherwise legally prohibited.
  3. Data Subject Request Assistance. Company will (taking into account the nature of the Processing of Personal Data) provide Customer with assistance reasonably necessary for Customer to perform its obligations under Applicable Data Protection Laws to fulfill requests by data subjects to exercise their rights under Applicable Data Protection Laws (“Data Subject Requests”) with respect to Personal Data in Company’s possession or control. Where permitted under Applicable Data Protection Laws, Customer will compensate Company for any such assistance at Company’s then-current professional services rates, which will be made available to Customer upon request. 
  4. Customer’s Responsibility for Requests. Company will not respond to a Data Subject Request itself, except where Customer authorizes Company to redirect the Data Subject Request as necessary to allow Customer to respond directly. If Company receives a Data Subject Request, Company will advise the data subject to submit the request to Customer and Customer will be responsible for responding to the request.
  1. European & UK Data Protection Laws Specific Provisions. 
  1. GDPR. Company will Process Personal Data in accordance with GDPR directly applicable to Company’s provision of its Services and as provided for in Schedules 1 and 2 hereto.
  1. UK GDPR. Company will Process Personal Data in accordance with UK GDPR directly applicable to Company’s provision of its Services and as provided for in Schedule 3 hereto.
  1. Subprocessors.
  1. Consent to Subprocessor Engagement. Customer authorizes the following Subprocessors to Process Personal Data: (i) Company’s Affiliates; and (ii) the Subprocessors set forth in Schedule 2 Annex III hereto (also located here: runllm.com/subprocessors) as updated by Company from time to time, or such other website address as Company may provide to Customer from time to time) (“Subprocessor Site”).
  2. Requirements for Subprocessor Engagement. When engaging any Subprocessor, Company will enter into a written contract with such Subprocessor containing data protection obligations not less protective than those in this DPA with respect to Personal Data to the extent applicable to the nature of the services provided by such Subprocessor.  Company shall be liable for all obligations under the Agreement subcontracted to, the Subprocessor or its actions and omissions related thereto.
  3. Subprocessor Changes. When Company engages any new Subprocessor after the Effective Date of the Agreement, Company will update the Subprocessor Site and notify Customer including the name and location of the relevant Subprocessor and the activities it will perform. This Section 7(c) will not apply with respect to GDPR but instead will be replaced by the requirements of the Standard Contractual Clauses set forth in Section 4(g) and 4(h) of Schedule 1 hereto.
  4. Opportunity to Object to Subprocessor Changes. If Customer objects to such engagement in a written notice to Company on reasonable grounds relating to the protection of Personal Data, Customer and Company will work together in good faith to find a mutually acceptable resolution to address such objection. If the parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, Customer may, as its sole and exclusive remedy, terminate the Agreement by providing written notice to Company. 
  1. Miscellaneous. Except as expressly modified by the DPA, the terms of the Agreement remain in full force and effect.  In the event of any conflict or inconsistency between this DPA and the other terms of the Agreement, this DPA will govern. Notwithstanding anything in the Agreement or any order form entered in connection therewith to the contrary, the parties acknowledge and agree that Company’s access to Personal Data does not constitute part of the consideration exchanged by the parties in respect of the Agreement. Notwithstanding anything to the contrary in the Agreement, any notices required or permitted to be given by Company to Customer under this DPA may be given: (a) in accordance with any notice clause of the Agreement; (b) to Company’s primary points of contact with Customer; or (c) to any email provided by Customer for the purpose of providing it with Services-related communications or alerts.  Customer is solely responsible for ensuring that such email addresses are valid.

‍

SCHEDULE 1
TRANSFER MECHANISMS FOR STANDARD CONTRACTUAL CLAUSES DATA TRANSFERS

‍

  1. Definitions. For the purposes of this Schedules 1 and 2, these terms shall be defined as follows: 
  1. "EU C-to-P Transfer Clauses" means Standard Contractual Clauses sections I, II, III and IV (as applicable) to the extent they reference Module Two (Controller-to-Processor).
  2. "EU P-to-P Transfer Clauses" means Standard Contractual Clauses sections I, II III and IV (as applicable) to the extent they reference Module Three (Processor-to-Processor).
  1. International Transfer Mechanisms. If, in the performance of the Services, Personal Data that is subject to GDPR, or any other law relating to the protection or privacy of individuals under European Data Protection Laws, is transferred to countries which do not ensure an adequate level of data protection within the meaning of the European Data Protection Laws, the transfer mechanisms listed below shall apply to such transfers and can be directly enforced by the parties to the extent such transfers are subject to the European Data Protection Laws:
  1. The EU C-to-P Transfer Clauses. Where Customer and/or its Authorized Affiliate is a Controller and a data exporter of Personal Data and Company is a Processor and data importer in respect of that Personal Data, then the parties shall comply with the EU C-to-P Transfer Clauses, subject to the additional terms in Schedule 1; and/or
  2. The EU P-to-P Transfer Clauses. Where Customer and/or its Authorized Affiliate is a Processor acting on behalf of a Controller and a data exporter of Personal Data and Company is a Processor and data importer in respect of that Personal Data, the parties shall comply with the terms of the EU P-to-P Transfer Clauses, subject to the additional terms in Schedule 1.
  1. Roles. For the purposes of the EU C-to-P Transfer Clauses and the EU P-to-P Transfer Clauses, Customer is the data exporter and Company is the data importer and the parties agree to the following. If and to the extent an Authorized Affiliate relies on the EU C-to-P Transfer Clauses or the EU P-to-P Transfer Clauses for the transfer of Personal Data, any references to Customer in this Schedule includes such Authorized Affiliate. Where this Schedule 1 does not explicitly mention EU C-to-P Transfer Clauses or EU P-to-P Transfer Clauses it applies to both of them.
  2. Standard Contractual Clauses Operative Provisions and Additional Terms.
  1. Reference to the Standard Contractual Clauses. The relevant provisions contained in the Standard Contractual Clauses are incorporated by reference and are an integral part of this DPA. The information required for the purposes of the Annexes to the Standard Contractual Clauses are set out in Schedule 2.
  2. Docking Clause. The option under clause 7 shall not apply.
  3. Instructions. This DPA and the Agreement are Customer’s complete and final documented instructions at the time of signature of the Agreement to Company for the Processing of Personal Data. Any additional or alternate instructions must be consistent with the terms of this DPA and the Agreement. For the purposes of clause 8.1(a), the instructions by Customer to Process Personal Data include onward transfers to a third party located outside the EEA for the purpose of the performance of the Services.
  4. Certification of Deletion. The parties agree that the certification of deletion of Personal Data that is described in clauses 8.5 and 16(d) of the Standard Contractual Clauses shall be provided by Company to Customer only upon Customer's written request.
  5. Security of Processing. For the purposes of clause 8.6(a), Customer is solely responsible for making an independent determination as to whether the technical and organisational measures set forth herein meet Customer’s requirements and agrees that (taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing of its Personal Data as well as the risks to individuals) the security measures and policies implemented and maintained by Company provide a level of security appropriate to the risk with respect to its Personal Data. For the purposes of clause 8.6(c), personal data breaches (i.e., Information Security Incidents) will be handled in accordance with Section 4(b) of this DPA.
  6. Audits of the SCCs. The parties agree that the audits described in clause 8.9 of the Standard Contractual Clauses shall be carried out in accordance with Section 4(c) of this DPA.
  7. General Authorization for Use of Subprocessors. Option 2 under clause 9 shall apply. The data importer has the data exporter’s general authorization for the engagement of Subprocessor(s) from those set forth in Annex III (see Schedule 2 below). The data importer shall inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors. The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object.Where Company enters into the EU P-to-P Transfer Clauses with a Subprocessor in connection with the provision of the Services, Customer hereby grants Company and Company’s Affiliates authority to provide a general authorization on Controller's behalf for the engagement of subprocessors by Subprocessors engaged in the provision of the Services, as well as decision making and approval authority for the addition or replacement of any such subprocessors. 
  1. Notification of New Subprocessors and Objection Right. Pursuant to clause 9(a), Customer acknowledges and expressly agrees that Company may engage new Subprocessors as described in Section 4(g) above. Company shall inform Customer of any changes to Subprocessors following the procedure provided for in Section 4(g) above. Customer may object to new Subprocessors as described in Section 7(d) of the DPA.
  2. Redress. The option under clause 11 shall not apply. Company shall inform Customer if it receives a Data Subject Request with respect to Personal Data and shall without undue delay communicate the complaint or dispute to Customer. Company shall not otherwise have any obligation to handle the request (unless otherwise agreed with Customer). 
  3. Liability. Company's liability under clause 12(b) shall be limited to any damage caused by its Processing where Company has not complied with its obligations under the GDPR specifically directed to Processors, or where it has acted outside of or contrary to lawful instructions of Customer, as specified in Article 82 GDPR.
  4. Supervision. Clause 13 shall apply as follows: 
  1. Where Customer is established in an EU Member State, the supervisory authority with responsibility for ensuring compliance by Customer with Regulation (EU) 2016/679 as regards the data transfer shall act as competent supervisory authority. 
  2. Where Customer is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679, the supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established shall act as competent supervisory authority. 
  3. Where Customer is established in the United Kingdom or falls within the territorial scope of application of UK GDPR, the Information Commissioner's Office shall act as competent supervisory authority.
  1. Notification of Government Access Requests. For the purposes of clause 15(1)(a), Company shall notify Customer (only) and not the Data Subject(s) in case of government access requests. Customer shall be solely responsible for promptly notifying the Data Subject as necessary.
  2. Governing Law. The governing law for the purposes of clause 17 shall be the law that is designated in the section of the Agreement. If the Agreement is not governed by an EU Member State law, the Standard Contractual Clauses will be governed by either: (i) the laws of Ireland; or (ii) where the Agreement is governed by the laws of the United Kingdom, the laws of the United Kingdom.
  3. Choice of Forum and Jurisdiction. The courts under clause 18 shall be those designated in the Agreement. If the Agreement does not designate an EU Member State court as having exclusive jurisdiction to resolve any dispute or lawsuit arising out of or in connection with this Agreement, the parties agree that the courts of either: (i) Ireland; or (ii) where the Agreement designates the United Kingdom as having exclusive jurisdiction, the United Kingdom, shall have exclusive jurisdiction to resolve any dispute arising from the Standard Contractual Clauses.
  4. Data Exports from the United Kingdom under the Standard Contractual Clauses. In case of any transfers of Personal Data from the United Kingdom subject exclusively to the UK GDPR, except where such Processing is subject to Schedule 3 hereto: (i) general and specific references in the Standard Contractual Clauses to GDPR or EU or Member State Law shall have the same meaning as the equivalent reference in the Applicable Data Protection Laws of the United Kingdom (i.e., UK GDPR); and (ii) any other obligation in the Standard Contractual Clauses determined by the Member State in which the data exporter or Data Subject is established shall refer to an obligation under UK GDPR.
  5. Conflict. The Standard Contractual Clauses are subject to this DPA and the additional safeguards set out hereunder. The rights and obligations afforded by the Standard Contractual Clauses will be exercised in accordance with this DPA, unless stated otherwise. In the event of any conflict or inconsistency between the body of this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail. 
  1. Additional Terms for the EU P-to-P Transfer Clauses. For the purposes of the EU P-to-P Transfer Clauses (only), the parties agree the following:
  1. Instructions and notifications. For the purposes of clause 8.1(a), Customer hereby informs Company that it acts as Processor under the instructions of the relevant Controller in respect of Personal Data. Customer warrants that its Processing instructions as set out in the Agreement and this DPA, including its authorizations to Company for the appointment of Subprocessors in accordance with this DPA, have been authorized by the relevant Controller. Customer shall be solely responsible for forwarding any notifications received from Company to the relevant Controller where appropriate.
  2. Security of Processing. For the purposes of clause 8.6(c) and (d), Company shall provide notification of a personal data breach (i.e., an Information Security Incident) concerning Personal Data Processed by Company to Customer. 
  3. Documentation and Compliance. For the purposes of clause 8.9, all enquiries from the relevant Controller shall be provided to Company by Customer. If Company receives an enquiry directly from a Controller, it shall forward the enquiry to Customer and Customer shall be solely responsible for responding to any such enquiry from the relevant Controller where appropriate. 
  4. Data Subject Rights. For the purposes of clause 10 and subject to section 3 of this DPA, Company shall notify Customer about any request it has received directly from a Data Subject without obligation to handle it (unless otherwise agreed) but shall not notify the relevant Controller. Customer shall be solely responsible for cooperating with the relevant Controller in fulfilling the relevant obligations to respond to any such request. 

‍

SCHEDULE 2
ANNEX I THROUGH III TO THE STANDARD CONTRACTUAL CLAUSES

‍

This Schedule 2 contains Annex I through III to the Standard Contractual Clauses and and must be completed and signed by each party below where indicated.

‍

ANNEX I

‍

  1. LIST OF PARTIES

‍

Data exporter(s):

  1. Customer, as defined in the order form

‍

Data importer(s):

  1. Name: RunLLM, Inc.

‍

  1. DESCRIPTION OF THE TRANSFER

‍

The Processing activities carried out by Company under the Agreement may be described as follows:

‍

Categories of data subjects whose personal data is transferred

Customer, its employees, and its customers

Categories of personal data transferred

Contact information of employees and customers

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

Sensitive data transferred to processor by a controller, or on its behalf as permitted under the DPA, via the Services (e.g., racial or ethnic origin, social security number, religion, etc.). Processor expects none.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

On a continuous basis as determined by a controller or on its behalf as permitted under the Agreement.

Nature of the processing

The service analyzes and processes the provided data (including by third-party generative AI services) for the purposes of providing advanced technical support.

Purpose(s) of the data transfer and further processing

For processor/subprocessor to provide the Services to a controller (or on their behalf) as required under the Agreement

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

For the term of the Agreement

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

For the term of the Agreement

‍

  1. COMPETENT SUPERVISORY AUTHORITY

‍

The competent supervisory authority in accordance with Clause 13 of the Standard Contractual Clauses as identified in Schedule 1 Section 4(k) of this DPA.

‍

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

‍

Company processes all Personal Data received from Controller under this DPA in conformity with the following technical and organizational measures:

‍

Technical and Organizational Security Measure

Evidence of Technical and Organizational Security Measure

Measures of pseudonymisation and encryption of personal data

  • All data sent to or from Company is encrypted in transit using TLS 1.2.
  • Customer Personal Data is encrypted at rest using 256-bit encryption
  • All Company datastores used to process Customer Data are configured and patched using commercially reasonable methods according to industry-recognized system-hardening standards.

Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services

  • Company has implemented a formal procedure for handling security events. When security events are detected, they are escalated to an emergency alias, relevant parties are paged, notified, and assembled to rapidly address the event. After a security event is contained and mitigated, relevant teams write up a post-mortem analysis, which is reviewed in person and distributed across the company and includes action items that will make the detection and prevention of a similar event easier in the future.
  • Company relies on Google Cloud Platform (“GCP”). Company leverages their portfolio of globally redundant services to ensure Services run reliably. Company benefits from the ability to dynamically scale up, or completely re-provision its infrastructure resources on an as-needed basis, across multiple geographical areas, using the same vendor, tools, and APIs. Company’s infrastructure scales up and down on demand as part of day-to-day operations and does so in response to any changes in our customers’ needs. This includes not just compute resources, but storage and database resources, networking, security, and DNS. Every component in Company’s infrastructure is designed and built for high availability.
  • Company’s data security, high availability, and data protection strategy are designed to ensure application availability and protect information from accidental loss or destruction. Subscription Service restoration is within commercially reasonable efforts and is performed in conjunction with GCP’s ability to effectively restore backups. All of Company’s recovery and resilience mechanisms are tested regularly and processes are updated as required.
  • Company operates a dedicated on-call incident management function, ready to immediately respond to, and mitigate, any Customer impacting issues.
  • Company has no direct reliance on specific office locations to sustain operations. All operational access to production resources can be exercised at any location on the Internet. Company leverages a range of best-of- breed technologies and other critical cloud tools to deliver uninterrupted remote work for all employees.
  • All Customer Data deleted by Company is deleted from GCP and other datastores in accordance with the NIST Special Publication 800-88 Revision 1, Guidelines for Media Sanitation December 18, 2014 (available at http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf). 

Processes for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures in order to ensure the security of the processing

  • Company regularly tests their security systems and processes to ensure they meet the requirements of this security policy and ensures that the physical and environmental security controls are audited for SOC 2 Type II compliance, among other certifications.
  • Application Scans. Company performs periodic (but no less than once per year) application vulnerability scans. Vulnerabilities shall be remediated on a risk basis.
  • Third party penetration tests. Company employs an independent third-party vendor to conduct periodic (but no less than once per year) penetration tests on their web properties.

Measures for user identification and authorisation

  • Single Sign-On (SSO)
  • Logical Access Controls. Company leverages an Identity Provider to manage access to systems processing Customer Data.
  • All access to systems processing Customer Data is protected by Multi Factor Authentication (MFA).
  • Company restricts access to Customer Data to only those people with a “need-to-know” for a Permitted Purpose and following least privileges principles.
  • Company regularly reviews at least every quarter the list of people and systems with access to Customer Data and removes accounts upon termination of employment or a change in job status that results in employees no longer requiring access to Customer Data.
  • Company mandates and ensures the use of system-enforced “strong passwords” in accordance with the best practices (described below) on all systems hosting, storing, processing, or that have or control access to Customer Data and will require that all passwords and access credentials are kept confidential and not shared among personnel.
  • Password best practices implemented by Company’s Identity Provider. Passwords must meet the following criteria: a. contain at least 10 characters; b. must contain lowercase and uppercase letters, numbers, and a special character; c. cannot be part of a vendor provided list of common passwords.
  • Company does not operate any internal corporate network. All access to Company resources is protected by strong passwords and MFA.
  • Company monitors their production systems and implements and maintains security controls and procedures designed to prevent, detect, and respond to identified threats and risks.
  • Strict privacy controls exist in the application code that are designed to ensure data privacy and to prevent one customer from accessing another customer’s data (i.e., logical separation).

Measures for the protection of data during transmission

  • See “Measures of pseudonymisation and encryption of personal data” above.
  • All of our services run in the cloud. Company does not run our own routers, load balancers, DNS servers, or physical servers.
  • All of our services and data are hosted in GCP facilities and protected by GCP security. Company services have been built with disaster recovery in mind.
  • All of our servers are within our own virtual private cloud (VPC) with network access control lists (ACLs) that prevent unauthorized requests getting to our internal network.
  • Company uses a backup solution for datastores that contain customer data.

Measures for the protection of data during storage

  • Intrusion Prevention. Company implements and maintains a working network firewall to protect data accessible via the Internet and will keep all Customer Data protected by the firewall at all times.
  • Company keeps its systems and software up to date with the latest upgrades, updates, bug fixes, new versions, and other modifications necessary to ensure security of the Customer Data.
  • Security Awareness Training. Company requires annual security and privacy training for all employees with access to Customer Data.
  • Company uses anti-malware software and keeps the anti-malware software up to date. Customer instances are logically separated and attempts to access data outside allowed domain boundaries are prevented and logged.
  • Endpoint security software
  • System inputs recorded via log files
  • Access Control Lists (ACL)
  • Multi-factor Authentication (MFA)

Measures for ensuring physical security of locations at which personal data are processed

  • Company’s services and data are hosted in GCP’s facilities and protected by GCP in accordance with their security protocols.
  • Access only to approved personnel.

Measures for ensuring system configuration, including default configuration

  • Change and Configuration Management. Company uses continuous automation for application and operating systems deployment for new releases. Integration testing and unit testing are done upon every build with safeguards in place for availability and reliability. Company has a process for critical emergency fixes that can be deployed to Customers within minutes. As such Company can roll out security updates as required based on criticality.
  • Access Control Policy and Procedures
  • Change Management Procedures

Measures for ensuring data minimization

  • Data collection is limited to the purposes of processing (or the data that the Customer chooses to provide).
  • Security measures are in place to provide only the minimum amount of access (least privilege) necessary to perform required functions.

Measures for ensuring data quality

  • Company has a process that allows data subjects to exercise their privacy rights (including a right to amend and update their Personal Data)
  • See “Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services” above.

Measures for ensuring accountability

  • Company has implemented data protection policies
  • Company adheres to relevant codes of conduct and signing up to certification schemes (see “Measures for certification/assurance of processes and products” above).

Incident Response Plan

  • We have implemented a formal procedure for security events and have educated all our staff on our policies.
  • When security events are detected they are escalated to a Slack channel, teams are paged, notified and assembled to rapidly address the event.
  • After a security event is fixed we write up a post-mortem analysis.
  • The analysis is reviewed in person, distributed across the company and includes action items that will make the detection and prevention of a similar event easier in the future.
  • Company will promptly notify you in writing upon verification of a security breach of the Company Service that affects your data. Notification will describe the breach and the status of Company’s investigation.

Build Process Automation

  • We have functioning, frequently used automation in place so that we can safely and reliably rollout changes to both our application and operating platform within minutes.
  • We typically deploy code dozens of times a week, so we have high confidence that we can get a security fix out quickly when required.

Authentication

  • Company is served 100% over https.
  • There are no corporate resources or additional privileges from being on Company’s network.
  • We have two-factor authentication (2FA) and strong password policies on GitHub, Google, GCP, and Company to ensure access to cloud services are protected.

Permissions and Admin Controls

  • Permissions and access can be set to include app settings, billing, user data, or the ability to send/edit manual messages and auto messages.

Application Monitoring

  • On an application level, we produce audit logs for all activity, ship logs to our service providers for analysis, and use S3 for archival purposes.
  • All access to Company applications are logged and audited.
  • Bastion hosts are used to login to devices.
  • All actions taken on production consoles or in the Company application are logged.

ANNEX III

LIST OF SUB-PROCESSORS

The Controller has authorized the use of the following Subprocessors: https://www.runllm.com/subprocessors

SCHEDULE 3
TRANSFER MECHANISMS FOR UK GDPR

‍

  1. Definitions. For the purposes of this Schedule 3, these terms shall be defined as follows: 
  1. “UK GDPR IDTA” means the terms of the “International Data Transfer Agreement” (located here: https://ico.org.uk/media/for-organisations/documents/4019538/international-data-transfer-agreement.pdf) and issued pursuant to Section 119A of the Data Protection Act 2018. 
  2. “UK GDPR Addendum” or “UK Addendum” means the terms of the “International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses for International Data Transfers” (located here: https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf) and issued pursuant to Section 119A of the Data Protection Act 2018.
  1. International Transfer Mechanisms. If, in the performance of the Services, Personal Data that is subject to UK GDPR or any other law relating to the protection or privacy of individuals that applies in the United Kingdom is transferred out of the United Kingdom to countries which do not ensure an adequate level of data protection within the meaning of the European Data Protection Laws, the UK GDPR IDTA and/or UK Addendum shall apply to such transfers and can be directly enforced by the Parties to the extent such transfers are subject to the UK GDPR.
  2. Appendix Information. Annex I through III, set forth in Schedule 2 to this DPA, contain Appendix Information for the UK IDTA and UK Addendum and are incorporated therein by reference.

‍

SCHEDULE 4

UNITED STATES SCHEDULE

‍

  1. The parties acknowledge that Customer discloses Personal Data to Company for the limited and specified purposes set forth in the Agreement and DPA, and as instructed by Customer. 
  2. Customer shall have the right to take the reasonable and appropriate steps set forth in the Agreement designed to stop and remediate unauthorized use of Personal Data.
  3. Company will not retain, use, disclose, sell, or share the Personal Data other than providing the Services specified by Customer’s documented instructions. Company will not combine Personal Data with information received from, or on behalf of other entities, except to perform the purpose of providing the Services specified by Customer’s documented instructions. Company shall Process Personal Data in accordance with Data Protection Laws applicable to Company’s provision of the Services to its customers generally (i.e., without regard for Customer’s particular use of the Services), when the Services are used according to this DPA, the Agreement, the Documentation, and the applicable Order Form. Company shall inform Customer if Company determines it is unable to meet its obligations under the CCPA.
  4. The parties acknowledge that Company’s retention, use and disclosure of personal information authorized by Customer’s instructions documented in the DPA are integral to Company’s provision of the Services and the business relationship between the parties. 

‍