Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between CogniWork, Inc. (“Processor”, “we”) and the customer (“Controller”, “you”). It applies where we process personal data on your behalf in providing the service.

If you need this executed as a signed document, write to [email protected] and we will countersign this text.

Definitions

“Data Protection Laws” means all laws applicable to the processing of personal data under this DPA, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss FADP, and US state privacy laws including the California Consumer Privacy Act as amended (“CCPA”).

“Controller”, “Processor”, “Data Subject”, “Personal Data”, “Processing” and “Supervisory Authority” have the meanings given in the GDPR. Where the CCPA applies, “Business” means Controller and “Service Provider” means Processor.

“Customer Personal Data” means personal data contained in Customer Content that we process on your behalf.

Roles

You are the Controller of Customer Personal Data. We are the Processor. You determine the purposes and means of processing; we act on your documented instructions.

Where we process data as a Controller in our own right — your account details, our security logs, our billing records — that processing is governed by our Privacy Policy, not this DPA.

Scope of processing

Subject matter. Provision of the CogniWork workspace platform.

Duration. For as long as we provide the service to you, plus the retention periods below.

Nature and purpose. Hosting, storage, retrieval, structuring, analysis and transmission of Customer Content; execution of automated processes you configure; submission of content to model providers to generate the outputs you request.

Types of Personal Data. Whatever you choose to put into your workspaces. Typically: names, contact details, employment details, correspondence, and any other identifiers or attributes contained in the records, files and messages you submit.

Categories of Data Subject. Your personnel, your customers and prospects, your suppliers, and any other individual described in Customer Content.

Your instructions

We process Customer Personal Data only:

1. on your documented instructions — which include your use of the service’s features, the automations you configure, and the integrations you connect;
2. as necessary to provide, secure and support the service; and
3. as required by law, in which case we will notify you first unless the law prohibits it.

We will tell you if, in our opinion, an instruction infringes Data Protection Laws.

Our commitments

Confidentiality. Personnel authorised to process Customer Personal Data are bound by confidentiality obligations and access it only where necessary.

Security. We implement appropriate technical and organisational measures under Article 32 GDPR, described in the Security overview. We may update these measures provided security is not materially reduced.

No sale, no secondary use. We do not sell Customer Personal Data, do not share it for cross-context behavioural advertising, and do not retain, use or disclose it for any purpose other than performing the service. Under the CCPA, we are a Service Provider and certify that we understand and will comply with these restrictions.

No training. We do not use Customer Personal Data to train foundation models, and our agreements with model providers prohibit them from doing so. See the AI Disclosure.

Subprocessors

You give general authorisation for us to engage subprocessors. Each is listed at Subprocessors with its role and processing location.

We will:

• impose data protection obligations on each subprocessor no less protective than this DPA;
• remain fully liable for each subprocessor’s performance;
• give at least 30 days’ notice before adding or replacing one, by updating that page and notifying workspace owners.

You may object on reasonable data-protection grounds within that period. If we cannot resolve the objection, you may terminate the affected service without penalty and receive a pro-rata refund of prepaid fees.

International transfers

Where we transfer Customer Personal Data out of the EEA, UK or Switzerland to a country without an adequacy decision, the transfer is governed by the European Commission’s Standard Contractual Clauses (Decision 2021/914), Module Two (Controller to Processor), incorporated by reference, with:

• Clause 7 (docking) included;
• Clause 9(a) Option 2, general authorisation, with 30 days’ notice;
• Clause 11 optional redress body not included;
• Clause 17: governed by the law of Ireland;
• Clause 18(b): courts of Ireland;
• Annexes I, II and III populated by the “Scope of processing” and “Our commitments” sections above and the Subprocessors page.

For UK transfers, the UK International Data Transfer Addendum (version B1.0) applies to those Clauses, with Tables 1–4 populated as above. For Switzerland, references to the GDPR are read as references to the FADP and the Swiss Federal Data Protection and Information Commissioner is a competent authority.

Assistance to you

Data subject requests. If we receive a request from a Data Subject relating to your workspace, we will not respond to it substantively; we will forward it to you promptly. Taking into account the nature of the processing, we will assist you in responding — though most requests you can satisfy yourself, since you can search, export, correct and delete content in your workspaces directly.

DPIAs and consultation. We will provide reasonable assistance with data protection impact assessments and prior consultation with Supervisory Authorities, taking into account the information available to us.

Personal data breach. We will notify you without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting Customer Personal Data, with the information available to us at the time and updates as the investigation progresses. See Security.

Audit

We will make available the information necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits conducted by you or an independent auditor you mandate.

In the first instance we will respond to reasonable written questionnaires and provide current third-party reports and certifications where we hold them. Where that is insufficient, an on-site audit may be conducted once per year, on 30 days’ notice, during business hours, subject to confidentiality, without unreasonable disruption, and at your cost — unless the audit reveals material non-compliance, in which case we bear it.

Deletion and return

On termination, you may export Customer Content from the service at any time before termination and for 30 days afterwards. After that period we delete it from live systems, and from backups as those backups expire on their normal rolling schedule (currently within 35 days), unless retention is required by law.

We will certify deletion in writing on request.

Order of precedence

Where this DPA conflicts with the Terms of Service in relation to the processing of Personal Data, this DPA prevails. Where this DPA conflicts with the Standard Contractual Clauses, the Clauses prevail.

Contact

Data protection enquiries: [email protected]

CogniWork, Inc. {{REGISTERED_ADDRESS}}