Data Processing Addendum

1. Scope and roles

Customer Personal Data means personal data in Customer Materials, Inputs, Outputs and Workflows that Velanir processes on Customer's behalf. Data Protection Law means the privacy and data protection laws applicable to that processing, including the EU GDPR, UK GDPR and California Consumer Privacy Act as amended, where applicable.

Customer acts as controller, or as a processor authorized by its controller. Velanir acts as processor, or as Customer's subprocessor, respectively. A Provider that instructs Velanir for a Client must have that Client's authorization. These roles depend on the actual processing and do not give a Provider access beyond its authorized workspace and service permissions.

Velanir separately determines the purposes of processing necessary business contact, account administration, security and financial records for its own obligations. Those activities are subject to applicable law, the Privacy Policy and the limited retention rules in the retention schedule. This exception does not permit Velanir to retain unrelated Customer Personal Data or reuse it for a new purpose.

2. Details of processing

Subject matter and purpose. Providing, operating, supporting and securing Customer's configured Agents, digital coworkers, workspaces, workflows and integrations. Processing includes receiving, organizing, storing, retrieving, analyzing, generating, transmitting, exporting and deleting data as needed for those Services and Customer's instructions.

Duration and frequency. Processing occurs as Customer uses the Services and runs its workflows, for the service term and the limited return, deletion and retention periods described below.

People and data. Depending on Customer's use, data subjects include Customer's and its Clients' employees, contractors, customers, prospects, suppliers and other people represented in submitted content. Data may include names, business contact details, account and workspace identifiers, roles, messages, files, prompts, outputs, workflow records and integration data that Customer chooses to process.

Sensitive data. Customer must not submit special-category data, criminal-offence data or other specially regulated information unless the applicable service agreement expressly permits it and the parties have agreed the necessary safeguards. Customer controls the content and lawful scope of its instructions.

3. Customer instructions and responsibilities

Customer instructs Velanir through the services agreement, this DPA, authorized service configuration and use, and additional documented instructions accepted by Velanir. Customer is responsible for its lawful basis, required notices, permissions and authority to provide the data and instructions. Customer may request access, correction, restriction, export or deletion through the Services or support@velanir.ai.

Velanir will process Customer Personal Data only on those documented instructions, including instructions concerning transfers, unless applicable law requires otherwise. Where legally permitted, Velanir will inform Customer before processing required by law. Velanir will promptly tell Customer if it considers an instruction to infringe Data Protection Law and suspend the affected instruction while the parties resolve it.

A general license to improve the Services does not authorize Velanir to use Customer Personal Data to train a general-purpose model or for a separate purpose outside these instructions. Any such processing requires a separate lawful, documented arrangement. Customer remains responsible for the third-party services it connects directly under its own agreements.

4. Confidentiality and security

Velanir will ensure that people authorized to process Customer Personal Data are bound by confidentiality obligations and receive access only as needed for their responsibilities.

Velanir will maintain technical and organizational measures appropriate to the nature of the data and the risks of processing. These include access controls based on authenticated identities and workspace permissions, tenant separation, encryption in transit and at rest, restricted handling of service credentials, security logging, backup and recovery procedures, and procedures to evaluate the effectiveness of these protections.

Velanir will maintain measures to protect confidentiality, integrity, availability and resilience, and to restore access following an incident. Security measures may evolve as the Services change, without materially reducing the overall protection of Customer Personal Data during the service term. Velanir will provide further relevant security information to Customer on request, subject to protections for confidential information and other customers.

5. Subprocessors

Customer gives general written authorization for Velanir to use subprocessors needed to provide the Services, including infrastructure, storage, authentication, communications, inference, and product analytics and session recording providers. Velanir will provide the current subprocessor identities, purposes and processing locations on request to support@velanir.ai, including before Customer begins the affected processing.

Velanir will notify Customer of an intended addition or replacement at least 30 days before the new subprocessor processes Customer Personal Data, giving Customer an opportunity to object on reasonable data protection grounds. The parties will work to resolve an objection through an alternative provider, configuration or other reasonable measure. If no resolution is available, Customer may discontinue the affected processing and terminate the affected Service before the change takes effect.

Velanir will impose written data protection obligations on each subprocessor that provide at least the protection required for its processing under this DPA. Velanir remains responsible to Customer for the subprocessor's performance of those obligations. A Customer-elected integration operating under Customer's own contract is not made a Velanir subprocessor solely because Customer connects it to the Services.

Tool-provider copies. Providers engaged by Velanir may hold execution logs or other copies subject to the specific retention disclosures in the schedule. They are not customer-owned integrations merely because they support a connected service. Velanir will communicate applicable deletion instructions, seek confirmation and disclose any remaining retention or limitation. A provider's published policy is not permission to process contrary to Data Protection Law or this DPA, and these disclosures do not remove Velanir's responsibility for its subprocessors. Read the tool-provider retention disclosures.

6. Rights requests and compliance assistance

Taking account of the processing and the information available to it, Velanir will provide reasonable assistance so Customer can respond to individuals' requests and meet its obligations concerning security, breach notification, data protection impact assessments and consultation with supervisory authorities.

If Velanir receives a request concerning Customer Personal Data directly from an individual or an authority, it will promptly inform Customer unless legally prohibited. Velanir will not answer on Customer's behalf except on Customer's instructions or as required by law. Velanir may independently handle requests concerning personal data for which it is the controller.

7. Personal data breaches

Velanir will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Notice will be sent to Customer's designated security contact or, if none is designated, its account contact.

As information becomes available, Velanir will describe the nature of the breach, affected data and individuals, likely consequences, measures taken or proposed to address it, and a contact for further information. Velanir will provide updates and cooperate with Customer's response. Customer determines any notices it must give to individuals or authorities, except where law independently requires Velanir to notify them.

8. Information and audits

Velanir will make available information needed to demonstrate compliance with this DPA and applicable processor obligations. It will allow and contribute to audits and inspections by Customer or an independent auditor appointed by Customer.

The parties will coordinate reasonable notice, scope and safeguards to avoid unnecessary disruption and protect security, confidential information and other customers' data. Existing reports and remote review may be used where sufficient, but do not replace an inspection where needed to verify compliance. These arrangements do not restrict a supervisory authority's powers or Customer's mandatory rights.

9. International transfers

The Services may involve processing in the United States and other countries. Velanir will make a restricted international transfer only where the applicable legal requirements are met, including any required adequacy decision, contractual safeguards and supplementary measures.

Where standard contractual clauses are required, the parties will put the applicable clauses and completed annexes in place before that transfer. These may include the European Commission's Decision 2021/914, using the module appropriate to the parties' roles, and the UK International Data Transfer Addendum where applicable. This DPA alone does not establish that a particular transfer mechanism is in place. Customers may request the safeguards applicable to their processing at support@velanir.ai.

10. California service-provider terms

Where the CCPA applies to Customer Personal Data, Velanir processes it as a service provider or contractor for the specific business purposes in Section 2. Velanir will not sell or share that information, retain, use or disclose it outside those purposes or the direct business relationship, or combine it with personal information from other sources except as the CCPA permits.

Velanir will provide the level of privacy protection required by the CCPA, notify Customer if it can no longer meet these obligations, and permit Customer to take reasonable and appropriate steps to verify compliant use and to stop and remediate unauthorized use. Velanir certifies that it understands and will comply with these restrictions.

11. Return, deletion and limited retention

At the end of the affected Services, Customer may choose return or deletion of Customer Personal Data. Customer has 30 days after termination to request an export through support@velanir.ai. Unless Customer requests earlier deletion, Velanir will delete the remaining production copies in its application databases and managed storage within the following 30 days. Residual backups of those systems are put beyond ordinary use and age out within 30 days after production deletion. Restoring a backup for recovery does not restore permission to use erased data; applicable deletion records are reapplied. These deadlines do not describe separate copies retained in tool-provider systems, which are disclosed in the retention schedule and remain subject to Section 5.

Retention is limited to the purposes and periods disclosed in the schedule. Beyond those periods, Velanir will retain data only where applicable law permits or requires a specific exception, limited to that purpose and period. Financial, security-audit and request-handling records are subject to the separate limits below. Those record-specific exceptions do not extend to unrelated messages, files or workflow content. Retained identifiers are personal data, not anonymous data merely because a name or email has been removed.

Retention schedule. The schedule is part of this DPA and explains account deletion, Organization closure, backups and restricted records. Read the data retention and deletion schedule.

This DPA continues to protect any Customer Personal Data held after the Services end until it is returned or deleted. On request, Velanir will report the scope of completed deletion, any provider confirmation received and any copies or retention limits still outstanding. Deleting a provider project, connection or key does not by itself confirm erasure of the provider's logs. Contact support@velanir.ai for instructions, exports, privacy requests or a copy of this DPA.