Data Processing Agreement

The following terms have the meanings set forth below for purposes of this Data Processing Agreement:

This Agreement governs the Processor's handling of Personal Data on behalf of the Controller in connection with the provision of ModernRelay's AI-native knowledge management platform and related services.

The Processor shall process Personal Data solely for the purpose of providing the agreed-upon services and as necessary to fulfill its contractual obligations to the Controller.

The Processor shall assist the Controller in responding to requests from Data Subjects exercising their rights under applicable data protection law, including requests for:

• Access — Right to obtain confirmation and access to their data
• Rectification — Right to correct inaccurate data
• Erasure — Right to be forgotten (right to erasure)
• Data Portability — Right to receive data in a portable format
• Restriction — Right to restrict processing
• Objection — Right to object to processing

The Processor shall respond to Data Subject requests within 30 days, or as otherwise required by applicable law.

The Processor shall notify the Controller without undue delay (and in any event within 24 hours) upon becoming aware of a Personal Data breach. Such notification shall include:

• Description of the nature of the breach
• Categories and approximate number of Data Subjects affected
• Categories and approximate number of Personal Data records affected
• Name and contact details of the data protection officer or other contact
• Description of likely consequences of the breach
• Description of measures taken or proposed to address the breach

International transfers of Personal Data to countries outside the European Economic Area (EEA) must comply with GDPR Chapter V requirements. The Processor ensures appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Binding Corporate Rules where applicable
• Adequacy decisions for recipient countries
• Supplementary measures as required by the Schrems II decision

Data transfers are documented per the Controller's Binding Corporate Rules and applicable data protection impact assessments.

The Controller reserves the right to conduct audits and security assessments of the Processor's data processing activities. The Processor shall:

• Make available all information necessary to demonstrate compliance
• Allow for and contribute to audits, including inspections
• Provide access to relevant facilities, equipment, and records
• Cooperate with the Controller or its designated auditor

Upon termination of the service agreement or upon the Controller's request, the Processor shall, at the choice of the Controller:

• Delete all Personal Data and certify such deletion in writing
• Return all Personal Data to the Controller in a commonly used format
• Delete existing copies unless Union or Member State law requires storage

Deletion shall be completed within 30 days of termination or request, unless legal retention requirements apply.

The Processor shall maintain records of all processing activities carried out on behalf of the Controller as required by Article 30 of the GDPR. These records shall include:

• Name and contact details of the Processor and Controller
• Categories of processing carried out on behalf of the Controller
• Transfers of Personal Data to third countries and documentation of safeguards
• General description of technical and organizational security measures

Each party shall be liable for damages caused by processing that infringes this Agreement or applicable data protection law in accordance with the allocation of responsibilities set forth herein.

This Data Processing Agreement shall remain in effect for the duration of the service relationship between the Controller and Processor. The obligations regarding data protection, security, and confidentiality shall survive termination.

Upon termination, the Processor shall comply with the data deletion or return requirements specified in Section 8, unless applicable law requires continued retention of the data.