Data Processing Addendum

2.1Scope

This DPA applies only to Elastix’ Processing of Customer Personal Data on behalf of Customer in connection with the Services. The subject matter, duration, nature, and purposes of Processing, categories of Customer Personal Data, and categories of Data Subjects are described in Schedule 1 (Details of Processing).

2.2Controller Data

This DPA does not apply to Personal Data in Account information or Usage Data that Elastix Processes as an independent controller for account administration, billing, security, abuse prevention, service analytics and improvement, legal compliance, or management of the business relationship. Elastix will Process that Personal Data in accordance with its privacy notice available at https://elastix.ai/legal/privacy. To the extent Elastix Processes any such Personal Data on Customer’s behalf, it is Customer Personal Data and this DPA applies.

2.3Roles

Customer is a controller or processor of Customer Personal Data, as applicable, and Elastix is Customer’s processor or subprocessor. If Customer is a processor, Customer represents that the relevant controller has authorized Customer’s instructions, Customer’s engagement of Elastix, and Elastix’ engagement of Subprocessors as contemplated by this DPA.

2.4Compliance

Each Party will comply with the obligations applicable to it under Applicable Data Protection Laws in connection with the Processing of Customer Personal Data.

3.1Documented Instructions

The Agreement, this DPA, each applicable Order Form, Customer’s use and configuration of the Services (including through the Account, administrative console, APIs, technical settings, and other controls made available by Elastix), and any additional written instructions accepted by Elastix constitute Customer’s documented instructions for Processing Customer Personal Data (“Instructions”). Any instruction that is not contemplated by the Agreement or the then-current functionality of the Services, or that would require Elastix to implement material additional technical, organizational, or operational measures, will be subject to the prior written agreement by the parties’ duly authorized representatives regarding its scope, implementation, timing, and any reasonable additional fees. Except to the extent required by applicable Data Protection Laws, Elastix is not required to implement such an instruction unless and until the parties reach that agreement.

3.2Processing by Elastix

Elastix will Process Customer Personal Data only in accordance with the Instructions and only to provide, maintain, secure, support, and improve the operation and reliability of the Services for Customer; comply with Customer’s Instructions; prevent fraud, abuse, or security threats; and comply with applicable law or binding legal process. If applicable law requires Processing that is not described in the Instructions, Elastix will notify Customer before the Processing unless legally prohibited. To the extent required by Applicable Data Protection Laws, Elastix will notify Customer without undue delay if Elastix reasonably believes that a documented Instruction concerning the Processing of Customer Personal Data violates Applicable Data Protection Laws. Nothing in this Section requires Elastix to independently investigate or provide legal advice regarding Customer’s Instructions. Elastix may suspend the affected Processing until Customer modifies or withdraws the Instruction or provides reasonable confirmation that the Instruction is lawful.

3.3Customer Responsibilities

Customer is responsible for the lawfulness, accuracy, quality, and means of collection of Customer Personal Data and for providing all notices, obtaining all consents and authorizations, and establishing all legal bases required for Elastix to Process Customer Personal Data in accordance with the Agreement. Customer will not instruct Elastix to Process Customer Personal Data in violation of Applicable Data Protection Laws.

3.4Configurations and Retention

Customer is responsible for selecting and configuring retention periods, session behavior, deletion settings, Models, External Model Services, and other technical controls appropriate for Customer’s use case and legal obligations. A configuration or instruction submitted through Customer’s Account by an Authorized User with appropriate permissions constitutes an Instruction and applies prospectively when implemented by the Services. Elastix will apply retention and Zero Data Retention configurations in accordance with the Agreement.

3.5Model Training

Elastix will not use Customer Personal Data to train, retrain, or improve a shared Model or a Model made available to other customers unless Customer expressly opts in through an Order Form or another written Instruction. This restriction does not prevent Customer-specific tuning, optimization, compilation, testing, or deployment requested by Customer.

3.6Regulated and Sensitive Data

Customer will not submit Personal Data subject to heightened legal or contractual restrictions, including protected health information, payment card data, government-classified information, export-controlled technical data, biometric identifiers, or special categories of Personal Data, unless the applicable Order Form or Service-Specific Terms expressly identify the Services as approved for that category and Customer complies with all applicable requirements.

3.7External Model Services and Customer-Selected Providers

If Customer enables or uses an External Model Service, Customer instructs Elastix to transmit the applicable Customer Personal Data to the provider as necessary to provide the requested functionality. An External Model Service provider is a Subprocessor if Elastix engages that provider to Process Customer Personal Data on Elastix’ behalf. A provider with which Customer has a direct account or contractual relationship and to which Customer directs Elastix to transmit Customer Personal Data is not a Subprocessor solely because Elastix facilitates the transmission, unless the provider also Processes Customer Personal Data on Elastix’ behalf. Customer is responsible for its separate relationship and instructions to any provider that is not a Subprocessor.

4.1Personnel

Elastix will ensure that persons authorized to Process Customer Personal Data are subject to confidentiality obligations, receive appropriate privacy and security training, and access Customer Personal Data only as necessary to perform their responsibilities.

4.2Security Measures

Taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of Processing, as well as the risks to Data Subjects, Elastix will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, as described in Schedule 2 (Security Measures). Elastix may update those measures from time to time, provided that the updates do not materially reduce the overall security of the Services during a current paid Order Form term.

4.3Personal Data Breach

Elastix will notify Customer without undue delay after becoming aware of a Personal Data Breach. Elastix will provide information reasonably available to Elastix regarding the nature of the Personal Data Breach, the categories and approximate number of affected Data Subjects and records, the likely consequences, and the measures taken or proposed to address the Personal Data Breach. Elastix may provide information in phases as it becomes available and will take commercially reasonable steps to contain, investigate, and remediate the Personal Data Breach to the extent within Elastix’ reasonable control.

4.4Communications

Elastix’ notification of or response to a Personal Data Breach is not an admission of fault or liability. Unless required by applicable law, Elastix will not notify a Data Subject or other third party of a Personal Data Breach involving Customer Personal Data without first consulting Customer. This Section does not restrict disclosures to Elastix’ personnel, professional advisers, insurers, Subprocessors, or incident-response providers that have a need to know and are subject to appropriate confidentiality obligations. Customer is responsible for determining whether and how to notify Data Subjects, regulators, or other third parties.

5.1General Authorization

Customer provides general written authorization for Elastix to engage the Subprocessors identified on the Subprocessor List and to permit those Subprocessors to engage further processors (“Downstream Subprocessors”) as necessary to provide the Services, subject to this Section 5. The Subprocessor List may identify a Downstream Subprocessor directly or by reference to a published subprocessor list maintained by the applicable direct Subprocessor. The Subprocessor List is incorporated as Schedule 3 (Subprocessor List).

5.2Notice of Changes

Elastix will provide at least thirty (30) days’ prior notice before authorizing a new direct Subprocessor to Process Customer Personal Data, by email to the Account administrator, an in-Service notice, or another reasonable notification method. For a Downstream Subprocessor, Elastix may provide notice by forwarding or making available the notice provided by the applicable direct Subprocessor, including through a link or subscription mechanism identified on the Subprocessor List. Customer is responsible for maintaining current notification contact information.

5.3Objections

Customer may object to a new Subprocessor on reasonable grounds relating to the protection of Customer Personal Data by notifying Elastix in writing within thirty (30) days after receiving notice. The Parties will work in good faith to address the objection, including through a commercially reasonable alternative where available. If the objection cannot be resolved and Elastix cannot provide the affected Services without the new Subprocessor, either Party may terminate the affected Service upon written notice. Elastix will refund prepaid fees allocable to the terminated portion of the remaining term, and termination is Customer’s sole and exclusive remedy for the objection.

5.4Subprocessor Obligations

Elastix will enter into a written agreement with each Subprocessor it engages directly that imposes data protection obligations substantially equivalent to those imposed on Elastix under this DPA to the extent applicable to the Subprocessor’s Processing and requires that Subprocessor to impose substantially equivalent obligations on each Downstream Subprocessor it engages. Subject to the limitations and exclusions of liability in the Agreement, Elastix remains responsible to Customer for the performance of those obligations throughout the Subprocessor chain to the extent required by Applicable Data Protection Laws.

6.1Data Subject Requests

If Elastix receives a request from a Data Subject to exercise rights under Applicable Data Protection Laws regarding Customer Personal Data, Elastix will, to the extent legally permitted, notify Customer and direct the Data Subject to Customer. Elastix will not respond to the request except on Customer’s documented Instruction or as required by applicable law.

6.2Assistance

Taking into account the nature of the Processing, Elastix will provide reasonable assistance through the functionality of the Services and, where reasonably necessary, additional technical and organizational measures to help Customer respond to Data Subject requests. Customer is responsible for responding to each request and for costs incurred by Elastix in providing assistance beyond the standard functionality of the Services, except to the extent the assistance is required because of Elastix’ breach of this DPA.

6.3Impact Assessments and Consultations

Taking into account the nature of the Processing and the information available to Elastix, Elastix will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities that Customer is required to conduct under Applicable Data Protection Laws and that relate to Elastix’ Processing of Customer Personal Data. Customer will reimburse Elastix’ reasonable costs for assistance that is unusually burdensome or outside the ordinary provision of the Services.

7.1Deletion During the Term

The Services may permit Customer to delete Customer Personal Data or configure retention and deletion settings. Customer’s use of those controls constitutes an Instruction to Elastix to apply the selected configuration when implemented by the Services.

7.2Expiration or Termination

Following expiration or termination of the applicable Service, Elastix will, at Customer’s choice, return or delete Customer Personal Data in accordance with the Agreement, Customer’s applicable retention configuration, and this DPA, unless applicable law requires continued retention. Elastix may satisfy its return obligation by making Customer Personal Data available through export functionality provided as part of the Services or another commercially reasonable method. Customer must exercise any available export functionality before access to the affected Service ends or within any transition period stated in an Order Form. If Customer does not request return before the applicable deadline, Customer instructs Elastix to delete the Customer Personal Data. Elastix may retain Customer Personal Data in inaccessible backup systems maintained in the ordinary course until overwritten under its standard retention cycle. Inputs and Outputs subject to Zero Data Retention will not be retained in backup systems.

7.3Required Retention

If applicable law prohibits deletion or requires continued retention, Elastix will isolate and protect the retained Customer Personal Data from further Processing except as required by applicable law.

7.4Government and Law-Enforcement Requests

If Elastix receives a legally binding request from a governmental or law-enforcement authority for Customer Personal Data, Elastix will, to the extent legally permitted, redirect the authority to Customer or promptly notify Customer so Customer may seek protective relief. Elastix will challenge a request that it reasonably believes is unlawful or overbroad where a challenge is legally available and commercially reasonable, and will disclose only the Customer Personal Data legally required.

8.1Compliance Information

Upon Customer’s reasonable written request and subject to appropriate confidentiality obligations, Elastix will make available information reasonably necessary to demonstrate compliance with this DPA, which may include then-current third-party audit reports, certifications, summaries of penetration tests, security questionnaires, and the security information described in Schedule 2. Customer will use that information only to assess Elastix’ compliance with this DPA.

8.2Audits

If the information made available under Section 8.1 is not reasonably sufficient to satisfy Customer’s audit rights under Applicable Data Protection Laws, Customer may conduct an audit no more than once in any twelve-month period, except following a Personal Data Breach or where required by a supervisory authority. An audit must be conducted by an independent qualified auditor that is not a competitor of Elastix and is bound by written confidentiality obligations no less protective than those in the Agreement, on at least thirty (30) days’ prior written notice, during normal business hours, subject to Elastix’ reasonable security and confidentiality requirements, and in a manner that does not unreasonably interfere with Elastix’ business or compromise the security, confidentiality, or rights of other customers.

8.3Audit Costs and Scope

Customer is responsible for its audit costs and will reimburse Elastix for reasonable costs incurred in supporting an audit, except to the extent the audit identifies a material breach of this DPA by Elastix. An audit will not include access to (a) systems or facilities not controlled by Elastix; (b) systems, records, or information unrelated to Elastix’ Processing of Customer Personal Data; (c) Customer Personal Data or other information relating to another customer; (d) source code, information subject to legal privilege, or information that Elastix is prohibited from disclosing under an obligation to another customer or third party. All materials disclosed by Elastix in connection with an audit and all audit findings, reports, and results are Elastix Confidential Information.

9.1Transfer Safeguards

Elastix may Process Customer Personal Data in the United States and other countries in which Elastix or its Subprocessors operate. For each Restricted Transfer, the Parties will rely on an applicable adequacy decision or another valid transfer mechanism. If no other valid transfer mechanism applies, the SCCs and, for transfers governed by UK Data Protection Laws, the UK Addendum are incorporated into this DPA by reference.

9.2EU SCCs

For a Restricted Transfer governed by the GDPR: (a) Module Two applies where Customer is a controller and Elastix is a processor; (b) Module Three applies where Customer is a processor and Elastix is a subprocessor; (c) Clause 7 (docking) applies; (d) in Clause 9, Option 2 applies and the notice period is the period stated in Section 5.2; (e) the optional language in Clause 11 does not apply; (f) in Clause 17, Option 1 applies and the SCCs are governed by the laws of Ireland; (g) in Clause 18(b), disputes will be resolved by the courts of Ireland; (h) Schedule 1 contains the information required by Annex I; (i) Schedule 2 contains the information required by Annex II; and (j) Schedule 3 identifies Elastix’ Subprocessor list maintained under Section 5 for purposes of Clause 9.

9.3UK Transfers

For a Restricted Transfer governed by UK Data Protection Laws, the SCCs as completed under Section 9.2 apply as modified by the UK Addendum. Tables 1 through 3 of the UK Addendum are completed using the information in this DPA and Schedules 1 through 3. For Table 4, either Party may end the UK Addendum as permitted by Section 19 of the UK Addendum. The optional liability language in the UK Addendum does not apply.

9.4Swiss Transfers

For a Restricted Transfer governed by Swiss Data Protection Laws, the SCCs apply with the following modifications: references to the GDPR include Swiss Data Protection Laws; references to a “Member State” will be interpreted to permit Data Subjects in Switzerland to exercise their rights in Switzerland; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; and the SCCs will be governed by and construed in accordance with the laws of Switzerland to the extent required by Swiss Data Protection Laws.

9.5Alternative Mechanisms and Supplementary Measures

If a transfer mechanism used by the Parties is invalidated or replaced, the Parties will cooperate in good faith to implement another valid mechanism. Elastix will provide information reasonably available to it regarding its Processing and security measures to support Customer’s transfer impact assessment and will implement supplementary measures required by Applicable Data Protection Laws where appropriate to the risks of the transfer.

10.1Processor and Service Provider Status

To the extent U.S. privacy laws apply to Customer Personal Data, Elastix acts as Customer’s processor, service provider, or contractor, as applicable, and will provide at least the level of privacy protection required by those laws.

10.2Restricted Processing

Elastix will not: (a) sell Customer Personal Data or share it for cross-context behavioral advertising; (b) retain, use, disclose, or otherwise Process Customer Personal Data outside the direct business relationship with Customer or for any purpose other than the limited and specified purposes described in the Agreement, this DPA, or Customer’s Instructions, except as otherwise permitted by applicable law; or (c) combine Customer Personal Data with Personal Data received from or on behalf of another person or collected from Elastix’ own interactions with a Data Subject, except as directed by Customer or otherwise permitted by applicable law.

10.3Compliance and Remediation

Elastix certifies that it understands and will comply with the restrictions in this Section 10. Elastix will notify Customer if it determines that it can no longer meet its obligations under applicable U.S. privacy laws. Upon reasonable notice of suspected unauthorized Processing of Customer Personal Data, Customer may take reasonable and appropriate steps to stop and remediate such unauthorized use, and the Parties will work in good faith to remediate any unauthorized Processing consistent with Applicable Data Protection Laws.

10.4Deidentified Data

To the extent Customer instructs Elastix to Process Customer Personal Data in deidentified form as part of the Services, Elastix will take reasonable measures to prevent the information from being associated with a Data Subject or household, maintain and use the information in deidentified form, not attempt to reidentify it except as permitted by applicable law to test the effectiveness of deidentification, and contractually require any recipient to comply with comparable restrictions.

11.1Term

This DPA remains in effect for so long as Elastix Processes Customer Personal Data on behalf of Customer. Provisions that by their nature should survive will continue to apply until Elastix has deleted all Customer Personal Data subject to this DPA.

11.2Order of Precedence

If there is a conflict concerning the Processing of Customer Personal Data, the following order of precedence applies: (a) an applicable transfer mechanism, including the SCCs or UK Addendum; (b) an Order Form, but only to the extent it expressly identifies the provision of this DPA being modified and the modification is permitted by Applicable Data Protection Laws; (c) this DPA; and (d) the remainder of the Agreement.

11.3Liability

Each Party’s and its Affiliates’ aggregate liability arising out of or relating to this DPA is subject to the exclusions and limitations of liability in the Agreement, and any liability under this DPA will be aggregated with liability under the Agreement for purposes of applying those limitations.

11.4Updates

Elastix may update this DPA in accordance with the Agreement’s provisions governing changes to online terms. No update will materially reduce the protection of Customer Personal Data during a current paid Order Form term except where reasonably required to comply with applicable law, address an urgent security risk, or reflect a change to the Services requested or enabled by Customer.

11.5Notices

Notices to Elastix under this DPA must be sent to privacy@elastix.ai. Elastix may provide notices under this DPA to the Account administrator email, through the Services, or by another method permitted under the Agreement. Customer is responsible for maintaining current contact information.

A.Parties

B.Processing Details

C.Competent Supervisory Authority

The competent supervisory authority will be determined in accordance with Clause 13 of the SCCs. To the extent Clause 13 permits a choice among more than one competent supervisory authority, the Parties designate the Irish Data Protection Commission, provided that the Irish Data Protection Commission is competent under Clause 13. For UK Data, the competent supervisory authority is the United Kingdom Information Commissioner’s Office. For Swiss Data, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner.

1Security Governance and Risk Management

Policies and processes addressing information security, privacy, risk assessment, asset management, personnel responsibilities, and periodic review of security controls.

2Access Control

Role-based access controls, least-privilege principles, unique user identifiers, authentication controls, access approval and revocation procedures, and multi-factor authentication for privileged or administrative access where supported.

3Personnel Security

Confidentiality obligations, appropriate background or reference checks where lawful and appropriate to role, security awareness training, and procedures for onboarding, role changes, and termination.

4Encryption

Industry-standard encryption for Customer Personal Data transmitted over public networks and for Customer Personal Data durably stored by Elastix, together with appropriate key-management practices.

5Infrastructure and Network Security

Logical separation, network controls, secure configuration, malware protection, firewalls or equivalent controls, and use of reputable cloud and data-center providers with physical and environmental safeguards.

6Secure Development and Change Management

Development and change-control processes appropriate to the Services, including code review, dependency management, testing, and controls designed to prevent unauthorized changes to production environments.

7Vulnerability Management

Processes for identifying, assessing, prioritizing, and remediating vulnerabilities; periodic security testing; and penetration testing or equivalent assessment appropriate to the Services and risks.

8Logging, Monitoring, and Detection

Logging and monitoring designed to detect anomalous activity, unauthorized access, and security events, with access to logs restricted to authorized personnel and retention appropriate to operational and security needs.

9Incident Response

Documented procedures for identifying, escalating, containing, investigating, remediating, and communicating security incidents, together with periodic review or testing of those procedures.

10Availability and Resilience

Measures designed to support the availability and resilience of systems used to Process Customer Personal Data, including redundancy, capacity management, disaster recovery, and business continuity procedures appropriate to the Services.

11Backups and Recovery

Backup and recovery procedures appropriate to applicable retention configurations. Inputs and Outputs subject to Zero Data Retention are not retained in backups.

12Data Retention and Disposal

Controls designed to implement applicable retention configurations and delete or render Customer Personal Data inaccessible when no longer required, subject to legal retention obligations and ordinary-course backup cycles.

13Subprocessor Management

Risk-based due diligence, written data protection and security obligations, and ongoing management appropriate to each Subprocessor’s Processing and associated risks.

14Testing and Assurance

Periodic internal or independent assessments of security controls and, where available, third-party certifications or audit reports relevant to the Services. Current assurance materials may be made available upon request, subject to confidentiality restrictions.