Data Processing Addendum

This Data Processing Addendum ("DPA") is between Arcjet Labs, Inc ("Arcjet") and the person or entity that expressly agrees in writing with Arcjet to this DPA ("Customer"). Arcjet and Customer are each a "Party" and together the "Parties". This DPA supplements the Agreement with respect to the Processing of Covered Data in connection with the Services.

This DPA takes effect only when authorized representatives of both Parties expressly agree in writing to apply it, whether by signing this DPA, executing an agreement or Order Form that expressly incorporates it, or exchanging written confirmations, including by email, identifying this DPA and the Customer. Merely visiting this page, using the Services, or accepting Arcjet's Terms of Service does not constitute agreement to this DPA. To request written opt-in, contact support@arcjet.com.

1. DEFINITIONS

1.1 The following definitions apply to this DPA, including its Schedules, regardless of whether Customer uses the Services under a separately signed services agreement or Arcjet's Terms of Service:

"Agreement" means the separately signed services agreement governing Customer's use of the Services, together with any applicable Order Forms, or, if there is no such agreement, Arcjet's Terms of Service together with any applicable Service Orders.

"Applicable Data Protection Laws" means all applicable laws, rules, regulations, and governmental requirements relating to the privacy, confidentiality, or security of Personal Data, as they may be amended or otherwise updated from time to time, including (without limitation) the GDPR.

"Authorized Users" means individual employees, contractors, or agents of Customer who are authorized by Customer to access and use the Services on Customer's behalf and who have been provided with unique login credentials. "Org Users" has the same meaning as Authorized Users for purposes of this DPA.

"BAA" means a separate business associate agreement entered into between the Parties governing the Processing of Protected Health Information.

"Communications Data" means email and message contents, sender and recipient information, and associated metadata that the Services access from Customer's systems.

"Controller" has the meaning given to the term "controller", "business" or any equivalent term under Applicable Data Protection Laws.

"Controller Purposes" means: (a) undertaking internal research and development to develop, test, improve and alter the functionality of the Services; (b) creating anonymised datasets for training or evaluation of Services; and (c) administering the Customer’s relationship with Arcjet under the Agreement.

"Covered Data" means, save as set out in paragraph 2.2, Personal Data that is: (a) provided by or on behalf of Customer to Arcjet in connection with the Services; or (b) obtained, developed, produced or otherwise Processed by Arcjet, or its agents or subcontractors, for purposes of providing the Services, in each case as further described in Schedule 1.

"Customer Code" means source code, configurations, and related materials that Customer submits to or makes accessible through the Services.

"Data Subject" means a natural person whose Personal Data is Processed.

"Deidentified Data" means data that cannot reasonably be used to identify, infer information about, or otherwise be linked to a particular Data Subject, and that meets any additional requirements for deidentified or anonymous data under Applicable Data Protection Laws. The requirements of paragraph 13 apply to such data.

"Effective Date" means the date specified in the Parties' written agreement to apply this DPA or, if no date is specified, the date on which both Parties have expressly agreed in writing to apply it.

"GDPR" means Regulation (EU) 2016/679 (the "EU GDPR") or, where applicable, the "UK GDPR" as defined in section 3 of the Data Protection Act 2018.

"Input" or "Inputs" means any data, information, text, files, prompts, queries, source code, or other content submitted by Customer or its Authorized Users, or collected by the Services from Customer's systems at Customer's direction, for processing by the Services or their artificial intelligence and machine learning features, including Customer Code and Communications Data.

"Order Form" means an ordering document agreed between the Parties for the Services, including a "Service Order" under Arcjet's Terms of Service, if any. An Order Form is not required for this DPA to apply where the Parties otherwise expressly agree in writing to apply it.

"Personal Data" means any data or information that: (a) is linked or reasonably linkable to an identified or identifiable natural person; or (b) is otherwise "personal data," "personal information," "personally identifiable information," or similarly defined data or information under Applicable Data Protection Laws.

"Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means. "Process", "Processes" and "Processed" will be interpreted accordingly.

"Processor" has the meaning given to the term "processor", "service provider" or any equivalent term under Applicable Data Protection Laws.

"Protected Health Information" or "PHI" means protected health information as defined under the United States Health Insurance Portability and Accountability Act of 1996 and its implementing regulations.

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to (including unauthorized internal access to), Covered Data.

"Services" means the services to be provided by Arcjet pursuant to the Agreement.

"Special Category Data" means genetic data, data concerning health, data concerning a natural person's sex life or sexual orientation, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or any other data treated as sensitive or special category data under Applicable Data Protection Laws.

"Standard Contractual Clauses" or "SCCs" means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914.

"Sub-processor" means an entity appointed by a Processor to Process Covered Data on its behalf.

"Usage and Administration Data" means:

1. diagnostic, usage and performance information collected by Arcjet in relation to the Customer's and its Authorized Users’ or Org Users’ use of the Services, including metadata relating to content and information that Customer uploads to, or otherwise authorizes to be processed through the Services;
2. contact details relating to, and the content of correspondence with the Customer's main account holder or administrator;
3. support enquiries and feedback submitted by the Customer's Authorized Users or Org Users in relation to the Services.

"Zero Data Retention" means a configuration enabled by Arcjet if elected in an Order Form or upon Customer's written request, under which Input and content-bearing results generated from that Input for an individual request, capture, integration import, or agent event are Processed only for real-time service delivery or configured policy decisions, are not stored beyond the applicable session, and are deleted no later than twenty-four (24) hours after Processing, except to the minimum extent required by applicable law. This configuration excludes policies, rule definitions, account settings, integration configuration, and credentials that Customer intentionally saves for continued use of the Services, but those exclusions do not include PHI, request or agent-event data, policy input values, prompts, or transcript content. Arcjet may retain operational metadata for debugging, performance, and billing, such as decision outcomes, rule identifiers, timestamps, latency and error metrics, and usage counts, but not the contents of Input or content-bearing results. Features requiring historical content may be unavailable under this configuration.

2. INTERACTION WITH THE AGREEMENT

2.1 From the Effective Date, this DPA is incorporated into and forms an integral part of the Agreement. This DPA supplements and (in case of contradictions) supersedes the Agreement with respect to any Processing of Covered Data.

2.2 To the extent that the Parties have entered into a BAA in respect of the Processing of Protected Health Information, this DPA shall not apply to the Processing of such Protected Health Information.

3. ROLE OF THE PARTIES

The Parties acknowledge that:

1. save as set out in paragraph 3(b), Arcjet acts as a Processor in the performance of its obligations under the Agreement and this DPA and Customer acts as a Controller; and
2. for the purposes of the GDPR or otherwise to the extent required under Applicable Data Protection Laws, Arcjet acts as a Controller with respect to the Processing of Usage and Administration Data for the Controller Purposes.

4. DETAILS OF DATA PROCESSING

4.1 The details of the Processing of Personal Data under the Agreement and this DPA (including subject matter, nature and purpose of the Processing, categories of Personal Data and Data Subjects) are described in the Agreement and in Schedule 1 to this DPA.

4.2 Arcjet shall comply with Applicable Data Protection Laws. Save with respect to any Processing of Usage and Administration Data for the Controller Purposes, Arcjet shall only Process Covered Data on behalf of and under the instructions of Customer, unless Processing is required to comply with applicable law.

4.3 The Agreement and this DPA shall constitute Customer’s instructions for the Processing of Covered Data. Customer may issue further written instructions in accordance with this DPA. Without limiting the foregoing, Arcjet is prohibited from:

1. selling Covered Data or otherwise making Covered Data available to any third party for monetary or other valuable consideration;
2. sharing Covered Data with any third party for cross-context behavioural advertising;
3. retaining, using, or disclosing Covered Data for any purpose other than for the business purposes specified in the Agreement or as otherwise permitted by Applicable Data Protection Laws;
4. retaining, using, or disclosing Covered Data outside of the direct business relationship between the Parties; and
5. except as otherwise permitted by Applicable Data Protection Laws, combining Covered Data with Personal Data that Arcjet receives from or on behalf of another person or persons, or collects from its own interaction with the Data Subject.

4.4 Arcjet shall:

1. provide Customer with information to enable Customer to conduct and document any data protection assessments, audits and consultations with supervisory authorities as may be required under Applicable Data Protection Laws;
2. promptly inform Customer if, in Arcjet’s opinion, an instruction from Customer breaches Applicable Data Protection Laws.

4.5 Customer must not submit Special Category Data to the Services unless Arcjet has expressly agreed in writing in advance to Process that data. This requirement applies to all Customers, including self-serve Customers using the Services under Arcjet's Terms of Service, and also applies where Special Category Data would be incidentally contained in Communications Data or Customer Code. The Parties' agreement to this DPA alone does not constitute that consent. Before submitting Protected Health Information, Customer must also enter into a separate BAA with Arcjet and enable Zero Data Retention. Any additional restrictions in the Agreement continue to apply.

5. CONFIDENTIALITY AND DISCLOSURE

Arcjet shall:

1. limit access to Covered Data to personnel who have a business need to have access to such Covered Data; and
2. ensure that such personnel are subject to obligations at least as protective of the Covered Data as the terms of this DPA and the Agreement, including duties of confidentiality with respect to any Covered Data to which they have access.

6. SUB-PROCESSORS

6.1 Arcjet may Process Covered Data anywhere that Arcjet or its Sub-processors maintain facilities, subject to the remainder of this paragraph 6.

6.2 Customer grants Arcjet the general authorisation to engage the Sub-processors listed at https://trust.arcjet.com/subprocessors ("Authorized Sub-processors") to Process Covered Data.

6.3 Arcjet shall:

1. enter into a written agreement with each Sub-processor imposing data protection obligations that, in substance, are no less protective of Covered Data than Arcjet’s obligations under this DPA; and
2. remain liable for each Authorized Sub-processor’s compliance with the obligations under this DPA.

6.4 Arcjet will provide Customer with at least fifteen (15) days’ notice of any proposed changes to the Authorized Sub-processors. Customer may object to Arcjet’s use of a new Sub-processor (including when exercising its right to object under clause 9(a) of the SCCs if applicable) by providing Arcjet with written notice of the objection within ten (10) days after Arcjet has provided notice to Customer of such proposed change (an "Objection").

6.5 In the event Customer objects to Arcjet’s use of a new Sub-processor, Customer and Arcjet will work together in good faith to find a mutually acceptable resolution to address such Objection. If the Parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, which shall not exceed thirty (30) days, Customer may terminate the portion of the Agreement relating to the Services affected by such change by providing written notice to Arcjet. During any such Objection period, Arcjet may suspend the affected portion of the Services.

7. DATA SUBJECT RIGHTS REQUESTS

7.1 Arcjet will notify Customer without undue delay of any request received by Arcjet or any Authorised Sub-processor from a Data Subject to assert their rights in relation to Covered Data under Applicable Data Protection Laws (a "Data Subject Request").

7.2 Other than in respect of any Processing of Usage and Administration Data for the Controller Purposes, Customer will have sole discretion in responding to the Data Subject Request, and Arcjet shall not respond to the Data Subject Request, save that Arcjet may advise the Data Subject that their request has been forwarded to Customer.

7.3 Taking into account the nature of the Processing and the information available to Arcjet, Arcjet shall provide Customer with reasonable assistance as necessary for Customer to fulfil its obligation under Applicable Data Protection Laws to respond to Data Subject Requests.

8. SECURITY AND AUDITS

8.1 Arcjet shall implement and maintain appropriate technical and organizational data protection and security measures designed to ensure security of Covered Data, including, without limitation, protection against unauthorized or unlawful Processing and against accidental loss, destruction, or damage of or to Covered Data.

8.2 When assessing the appropriate level of security, Arcjet shall take into account the nature, scope, context and purpose of the Processing as well as the risks that are presented by the Processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Covered Data.

8.3 Arcjet shall implement and maintain as a minimum standard the measures set out in Schedule 2.

9. INFORMATION AND AUDITS

9.1 Arcjet shall notify Customer promptly if Arcjet determines that it can no longer meet its obligations under Applicable Data Protection Laws.

9.2 Customer may take reasonable and appropriate steps to:

1. ensure that Arcjet uses Covered Data in a manner consistent with Customer’s obligations under Applicable Data Protection Laws; and
2. upon reasonable notice, stop and remediate unauthorized use of Covered Data.

9.3 Customer shall have the right to audit Arcjet’s compliance with this DPA. The Parties agree that all such audits will be conducted:

1. upon reasonable written notice to Arcjet;
2. only once per year, or more frequently if any audit indicates that Arcjet is in non-compliance with this DPA;
3. only during Arcjet’s normal business hours; and
4. in a manner that does not materially disrupt Arcjet's business or operations.

9.4 With respect to any audits conducted in accordance with paragraph 9.3:

1. Customer may engage a third-party auditor to conduct the audit on its behalf;
2. Arcjet shall not be required to facilitate any such audit unless and until the Parties have agreed in writing the scope and timing of such audit.

9.5 Customer shall promptly notify Arcjet of any non-compliance discovered during an audit.

9.6 The results of the audit shall be Arcjet's confidential information.

9.7 Arcjet shall provide to Customer upon request, or may provide to Customer in response to any audit request submitted by Customer to Arcjet, either of the following:

1. data protection compliance certifications issued by a commonly accepted certification issuer which has been audited by a data security expert, or by a publicly certified auditing company; or
2. such other documentation reasonably evidencing the implementation of the technical and organisational data security measures in accordance with industry standards.

9.8 If an audit requested by Customer is addressed in the documents or certification provided by Arcjet in accordance with paragraph 9.7, and:

1. the certification or documentation is dated within twelve (12) months of Customer’s audit request; and
2. Arcjet confirms that there are no known material changes in the controls audited,

Customer agrees to accept that certification or documentation in lieu of conducting a physical audit of the controls covered by the relevant certification or documentation.

10. SECURITY INCIDENTS

10.1 Arcjet shall notify Customer in writing without undue delay, and in any event within seventy-two (72) hours, after becoming aware of any Security Incident.

10.2 Arcjet shall take reasonable steps to contain, investigate, and mitigate any Security Incident, and will send Customer timely information about the Security Incident, to the extent known to Arcjet or as the information becomes available to Arcjet, including, but not limited to, the nature of the Security Incident, the measures taken to mitigate or contain the Security Incident, and the status of the investigation.

10.3 Arcjet shall reasonably cooperate and assist with Customer’s investigation of the Security Incident and provide such reasonably assistance as Customer may request in relation to any obligation of Customer under Applicable Data Protection Laws, including any obligation to notify individuals or supervisory authorities.

10.4 Arcjet's notification of or response to a Security Incident under this paragraph 10 shall not be construed as an acknowledgement by Arcjet of any fault or liability with respect to the Security Incident.

11. DELETION AND RETURN

11.1 This DPA shall commence on the Effective Date and, notwithstanding any termination of the Agreement, will remain in effect until, and automatically expire upon, Arcjet's deletion of all Covered Data as described in this DPA.

11.2 Unless otherwise required by applicable law, Arcjet shall:

1. if requested to do so by Customer within thirty (30) days of expiry of the Agreement (the "Retention Period"), provide a copy of all Covered Data in such commonly used format as requested by Customer, or provide a self-service functionality allowing Customer to download such Covered Data; and
2. on expiry of the Retention Period, delete all copies of Covered Data Processed by Arcjet or any Authorised Sub-processors, other than any Usage and Administration Data Processed for the Controller Purposes.

12. STANDARD CONTRACTUAL CLAUSES

12.1 The Standard Contractual Clauses shall, as further set out in Schedule 3, apply to the transfer of any Covered Data from Customer to Arcjet, and form part of this DPA, to the extent that:

1. the GDPR applies to Customer when making that transfer; or
2. the Applicable Data Protection Laws that apply to Customer when making that transfer (the "Exporter Data Protection Laws") prohibit the transfer of Covered Data to Arcjet under this DPA in the absence of a transfer mechanism implementing adequate safeguards in respect of the Processing of that Covered Data, and entering into standard contractual clauses approved by the European Commission would reasonably satisfy any requirement under the Exporter Data Protection Laws to implement adequate safeguards in respect of that transfer; or
3. the transfer is an "onward transfer" (as defined in the applicable module of the SCCs).

12.2 The Parties agree that their express written agreement to apply this DPA shall have the same effect as signing the SCCs. In the event of any conflict between the Agreement, this DPA and the SCCs, the SCCs shall prevail.

13. DEIDENTIFIED DATA

If Arcjet receives Deidentified Data from or on behalf of Customer, or creates Deidentified Data, Arcjet shall:

1. take reasonable measures to ensure the information cannot be associated with a Data Subject;
2. publicly commit to Process the Deidentified Data solely in deidentified form and not to attempt to reidentify the information; and
3. contractually obligate any recipients of the Deidentified Data to comply with the foregoing requirements and Applicable Data Protection Laws.

14. GENERAL

14.1 The Parties hereby certify that they understand the requirements in this DPA and will comply with them.

14.2 The Parties agree to negotiate in good faith any amendments to this DPA as may be required in connection with changes in Applicable Data Protection Laws.

Schedule 1: DETAILS OF PROCESSING

1. List of Parties

2. Description of Processing and Transfer (where applicable)

Schedule 2: TECHNICAL AND ORGANIZATIONAL MEASURES

Arcjet's technical and organizational measures are described at https://trust.arcjet.com/controls.

Schedule 3: STANDARD CONTRACTUAL CLAUSES

1. EU SCCS

The Standard Contractual Clauses shall be completed as follows:

Modules and options

Appendix Information

2. UK ADDENDUM

2.1 This paragraph 2 (UK Addendum) shall apply to any transfer of Covered Data from Customer (as data exporter) to Arcjet (as data importer), to the extent that:

1. the UK Data Protection Laws apply to Customer when making that transfer; or
2. the transfer is an "onward transfer" as defined in the Approved Addendum.

2.2 As used in this paragraph 2:

"Approved Addendum" means the template addendum, version B.1.0 issued by the UK Information Commissioner under S119A(1) Data Protection Act 2018 and laid before the UK Parliament on 2 February 2022, as it may be revised according to Section 18 of the Approved Addendum.

"UK Data Protection Laws" means all laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018.

2.3 The Approved Addendum will form part of this DPA with respect to any transfers referred to in paragraph 2.1, and the Parties' express written agreement to apply this DPA shall have the same effect as signing the Approved Addendum.

2.4 The Approved Addendum shall be deemed completed as follows:

1. the "Addendum EU SCCs" shall refer to the SCCs as they are incorporated into this Agreement in accordance with paragraph 12 of this DPA and this Schedule 3;
2. Table 1 of the Approved Addendum shall be completed with the details in paragraph 1 of Schedule 1;
3. the "Appendix Information" shall refer to the information set out in Schedule 1 and Schedule 2; and
4. for the purposes of Table 4 of the Approved Addendum, both parties may end this DPA, to the extent the Approved Addendum applies, in accordance with Section ‎19 of the Approved Addendum.

3. TRANSFERS UNDER THE LAWS OF OTHER JURISDICTIONS

3.1 With respect to any transfers of Personal Data referred to in clause 12.1(b) (each a "Global Transfer"), the SCCs shall not be interpreted in a way that conflicts with rights and obligations provided for in the Exporter Data Protection Laws.

3.2 For the purposes of any Global Transfers, the SCCs shall be deemed to be amended to the extent necessary so that they operate:

1. for transfers made by the applicable data exporter to the data importer, to the extent the Exporter Data Protection Laws apply to that data exporter's Processing when making that transfer; and
2. to provide appropriate safeguards for the transfers in accordance with the Exporter Data Protection Laws.

3.3 The amendments referred to in paragraph 3.2 include (without limitation) the following:

1. references to the "GDPR" and to specific Articles of the GDPR are replaced with the equivalent provisions under the Exporter Data Protection Laws;
2. reference to the "Union", "EU" and "EU Member State" are all replaced with reference to the jurisdiction in which the Exporter Data Protection Laws were issued (the "Exporter Jurisdiction");
3. the "competent supervisory authority" shall be the applicable supervisory in the Exporter Jurisdiction; and
4. Clauses 17 and 18 of the SCCs shall refer to the laws and courts of the Exporter Jurisdiction respectively.

3.4 Where, at any time during Arcjet's Processing of Covered Data under this DPA, a transfer mechanism other than the SCCs is approved under the Exporter Data Protection Laws with respect to transfers of Covered Data by Customer to Arcjet, the Parties shall promptly enter into a supplementary agreement that:

1. incorporates any standard data protection clauses or another transfer mechanism formally adopted by the relevant authority in the Exporter Jurisdiction;
2. incorporates the details of Processing set out in Schedule 1; and
3. shall, with respect to the transfer of Personal Data subject to the Exporter Data Protection Laws, take precedence over this DPA in the event of any conflict.

3.5 Where required under the Exporter Data Protection Laws, the relevant data exporter shall file a copy of the agreement entered into in accordance with paragraph 3.4 with the relevant national authority