Data Processing Addendum

• "Controller" means the customer organisation that determines the purposes and means of processing personal data.
• "Processor" means NextGen Intelligence LLC, which processes personal data on behalf of the Controller.
• "Data Subject" means an identified or identifiable natural person whose personal data is processed.
• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on personal data.
• "Sub-processor" means any third party engaged by the Processor to process personal data on behalf of the Controller.
• "Applicable Data Protection Law" means all data protection and privacy laws applicable to the processing of personal data under this DPA.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission (Decision 2021/914).

This DPA applies to all personal data processed by the Processor on behalf of the Controller in connection with the Services. The Controller is the data controller and the Processor is the data processor for the purposes of Applicable Data Protection Law.

Where the Processor processes personal data for its own purposes (for example, account management, billing, and service improvement using aggregated data), it does so as a data controller and its Privacy Policy applies.

The Processor shall:

• Process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country, unless required to do so by applicable law.
• Ensure that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk (see Annex 2).
• Respect the conditions for engaging sub-processors (Section 5).
• Assist the Controller in responding to requests from Data Subjects exercising their rights.
• Assist the Controller in ensuring compliance with security, breach notification, data protection impact assessment, and prior consultation obligations.
• Delete or return all personal data to the Controller after the end of the provision of Services, and delete existing copies unless applicable law requires storage.
• Make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits.

The Controller shall:

• Ensure that it has a lawful basis for processing personal data and for instructing the Processor.
• Ensure that Data Subjects have been informed of the processing in accordance with Applicable Data Protection Law.
• Ensure that personal data provided to the Processor is accurate and up to date.
• Comply with its obligations under Applicable Data Protection Law.
• Not instruct the Processor to process personal data in a manner that would violate Applicable Data Protection Law.

The Controller provides general authorisation for the Processor to engage sub-processors, subject to the following conditions:

• The Processor shall impose data protection obligations on sub-processors equivalent to those in this DPA.
• The Processor shall remain liable to the Controller for the performance of sub-processors.
• The Processor shall maintain and make available a list of current sub-processors (Annex 3).
• The Processor shall notify the Controller of any intended changes to sub-processors (additions or replacements) at least 14 days in advance, giving the Controller the opportunity to object.

Where the Processor transfers personal data to a third country, it shall ensure that appropriate safeguards are in place:

• For transfers from the EU/EEA: the European Commission's Standard Contractual Clauses (Module 2: Controller to Processor) are incorporated by reference.
• For transfers from the UK: the UK International Data Transfer Addendum to the SCCs is incorporated by reference.
• For transfers from Switzerland: the Swiss adaptation of the SCCs is incorporated by reference.
• For other transfers: the Processor shall implement appropriate safeguards as required by Applicable Data Protection Law.

The SCCs are incorporated into this DPA and, in case of conflict, the SCCs take precedence over this DPA to the extent of the conflict.

The Processor shall implement and maintain the technical and organisational security measures described in Annex 2. These measures are designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

The Processor shall notify the Controller without undue delay (and in any event within 72 hours of becoming aware) of any personal data breach affecting personal data processed on behalf of the Controller.

The notification shall include, to the extent available: the nature of the breach; categories and approximate number of Data Subjects and records concerned; likely consequences; and measures taken or proposed to address the breach.

The Processor shall assist the Controller in fulfilling its obligations to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law. The Processor shall promptly notify the Controller of any Data Subject requests received directly by the Processor and shall not respond to such requests without the Controller’s authorisation, except to confirm that the request has been received.

On termination of the Services, the Processor shall, at the Controller’s choice, delete or return all personal data and delete existing copies, unless applicable law requires storage. The Processor shall make personal data available for export for 30 days after termination.

The Controller may audit the Processor’s compliance with this DPA no more than once per year (unless required by a supervisory authority), on 30 days’ written notice, at the Controller’s expense. The Processor may satisfy audit requests by providing relevant certifications, third-party audit reports, or by facilitating an on-site audit subject to reasonable confidentiality protections.

This DPA is governed by the laws of the State of Delaware, USA, subject to any mandatory provisions of Applicable Data Protection Law. Disputes are subject to the dispute resolution provisions in the Terms of Service.

• Subject matter: Provision of the Services as described in the Terms of Service.
• Duration: For the term of the Services agreement.
• Nature and purpose: Processing necessary to provide, maintain, and improve the Services.
• Types of personal data: Account data, usage data, Content submitted by users, and other data as described in the Privacy Policy.
• Categories of Data Subjects: Employees, contractors, and other individuals whose data is submitted to the Services by the Controller.

• Encryption: Data encrypted in transit (TLS 1.2+) and at rest (AES-256 or equivalent).
• Access controls: Role-based access controls; principle of least privilege; multi-factor authentication for administrative access.
• Logging and monitoring: Access logs, audit trails, and anomaly detection.
• Vulnerability management: Regular security assessments and penetration testing.
• Incident response: Documented incident response procedures.
• Business continuity: Regular backups; tested recovery procedures.
• Vendor due diligence: Security assessments of sub-processors.
• Privacy Wall: Where applicable, technical separation between individual and organisational administrator access as described in the Privacy Policy, Section 5.

The current list of sub-processors is maintained at nxtgen-intel.com/legal/subprocessors and updated with 14 days’ advance notice of changes. Key sub-processors include:

• Cloud infrastructure providers (hosting, storage, compute).
• Anthropic — AI model provider (Claude models) for AI features.
• OpenAI — AI model provider (GPT models) for AI features.
• Payment processors — for billing and subscription management.
• Communications providers — for email and notification delivery.
• Analytics providers — for aggregated usage analytics.

All sub-processors are contractually prohibited from using personal data for any purpose other than providing the contracted service, and AI model providers are specifically prohibited from using data to train AI models.

• Data Protection Officer: [email protected]
• Legal: [email protected]
• General: [email protected]