Data Processing Agreement

1. Definitions

2. Scope and Nature of Processing

3. Processor Obligations

The Processor agrees to:

• 3.1Process only on documented instructions. Process Personal Data solely for the purposes described in Section 2, or as otherwise instructed in writing by the Controller. Not process Personal Data for any other purpose, including the Processor's own commercial benefit.
• 3.2No sale or sharing. Not sell, rent, share, or otherwise disclose Personal Data to any third party for cross-context behavioral advertising, the Processor's own marketing, or any purpose outside the contracted service. This prohibition survives termination of the agreement.
• 3.3Confidentiality. Ensure that all personnel authorized to process Personal Data are bound by confidentiality obligations no less protective than those in this DPA.
• 3.4Security. Implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized access, disclosure, alteration, or destruction. Current measures include TLS 1.3 encryption in transit, AES-256 encryption at rest, row-level security, and role-based access control.
• 3.5Sub-processors. Not engage sub-processors without the Controller's general authorization. Current authorized sub-processors are listed in Section 7. The Processor will notify the Controller of any intended changes to sub-processors with reasonable advance notice, providing an opportunity to object.
• 3.6Data subject rights assistance. Assist the Controller in fulfilling obligations to respond to Data Subject rights requests (access, deletion, portability, correction) within the timeframes required by applicable law.
• 3.7Breach notification. Notify the Controller without undue delay (and in no event later than 72 hours) after becoming aware of a personal data breach affecting data processed under this DPA.
• 3.8Deletion on termination. Upon termination or expiration of the service agreement, delete or return all Personal Data within 30 days, at the Controller's election, unless applicable law requires continued retention.
• 3.9Audit rights. Provide the Controller with information reasonably necessary to demonstrate compliance with this DPA upon written request. The Processor may satisfy this obligation through security questionnaires, certifications, or documentation in lieu of on-site audits.

4. Controller Obligations

The Controller agrees to:

• 4.1Ensure there is a lawful basis for collecting and processing the Personal Data of their website visitors under applicable law.
• 4.2Maintain an accurate and current privacy policy on their website that discloses the use of AI chat and the collection of visitor contact information.
• 4.3Promptly notify the Processor of any Data Subject rights requests that require the Processor's assistance to fulfill.
• 4.4Not instruct the Processor to process Personal Data in a manner that would violate applicable law.

5. Data Retention and Deletion

6. CCPA Service Provider Provisions

For purposes of the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.), the Processor acts as a "service provider" to the Controller. The Processor certifies that it:

• ✓Processes Personal Data only for the business purpose of providing the contracted Seer service
• ✓Does not sell Personal Data
• ✓Does not retain, use, or disclose Personal Data for any commercial purpose other than providing the service
• ✓Does not combine Personal Data received from the Controller with Personal Data received from other sources, except as permitted by CCPA regulations
• ✓Will notify the Controller if it determines it can no longer meet its obligations under CCPA

7. Authorized Sub-processors

The Controller grants general authorization for the Processor to engage the following sub-processors. Each sub-processor is bound by data protection obligations no less protective than those in this DPA.

The Processor will provide at least 10 days' written notice of any intended addition or replacement of sub-processors. The Controller may object within that period by contacting legal@sentientiq.app. If the parties cannot resolve the objection, the Controller may terminate the service agreement without penalty.

8. International Data Transfers

All Personal Data processed under this DPA is stored and processed in the United States. For Controllers subject to GDPR who transfer Personal Data from the European Economic Area, the parties agree that the Standard Contractual Clauses (EU Commission Decision 2021/914, Module 2: Controller to Processor) are incorporated by reference and form part of this DPA. A copy of the applicable SCCs is available upon request at legal@sentientiq.app.

9. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set forth in the Seer Terms of Service. Where applicable law prohibits such limitations in the context of data protection obligations, those limitations shall not apply to the extent of the prohibition.

The Processor shall be liable to the Controller for damages caused by processing that does not comply with this DPA or applicable data protection law, except where the Processor can demonstrate that it is not in any way responsible for the event giving rise to the damage.

10. Governing Law

This DPA is governed by the laws of the State of Delaware, United States, consistent with the Seer Terms of Service. For matters specifically governed by GDPR or CCPA, the applicable statutory requirements shall control to the extent of any conflict with Delaware law.

11. Term and Termination

This DPA is effective upon acceptance of the Seer Terms of Service and remains in effect for the duration of the service agreement. Sections 3.2 (No sale or sharing), 3.3 (Confidentiality), 5 (Retention and Deletion), and 6 (CCPA) survive termination.

12. Amendments

The Processor may amend this DPA to reflect changes in applicable law or sub-processor arrangements. Material amendments will be communicated via email or dashboard notification with at least 30 days' advance notice. Continued use of the service after the notice period constitutes acceptance of the amended DPA.