Data Processing Addendum

This Data Processing Addendum ("DPA") applies where Syzygia processes personal data on behalf of a customer when providing the Syzygia platform (Hub, agent Marketplace and related services). It is entered into between the customer that uses the Services as a business (the "Controller" or "Customer") and Syzygia Technologies, Inc., a Delaware corporation with its address at 174 Main Street, Port Washington, NY 11050, United States (the "Processor" or "Syzygia").

It forms part of our Terms of Service or of the agreement signed with the Customer (the "Main Agreement") and prevails over it on data protection. An administrator accepts it on the Customer's behalf in the Hub, and the acceptance is recorded with its version and date. A signed copy is available on request at info@syzygia.io. It follows Article 28(3) of the GDPR.

1. Subject matter and duration

1.1. Syzygia processes, on behalf of the Customer, the personal data needed to provide the platform, as described in Annex I.

1.2. This DPA lasts as long as the Main Agreement and, afterwards, for as long as needed to comply with clause 11 (return and deletion).

2. Instructions (Art. 28(3)(a))

2.1. Syzygia processes the data only on the Customer's documented instructions, including with regard to international transfers. The instructions are this DPA, the Main Agreement and the configuration the Customer makes in the platform (installed agents, connections to third parties, user permissions and which agent actions need human confirmation).

2.2. If Union or Member State law requires other processing, Syzygia will inform the Customer beforehand, unless that law prohibits it.

2.3. Syzygia will immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other data protection law.

2.4. Syzygia does not use the data for its own purposes; in particular it does not use it to train AI models and does not allow its sub-processors to do so.

2.5. Integrations chosen by the Customer. When the Customer connects third-party services that it contracts itself (its Google or Microsoft accounts, its mail server, its ERP, its bank or other APIs), data is sent to them on the Customer's instructions and under its own contract with them; those third parties are not Syzygia's sub-processors.

3. Confidentiality (Art. 28(3)(b))

3.1. Syzygia ensures that the people authorized to process the data have committed to confidentiality or are under a statutory obligation of confidentiality, and receive data protection training.

3.2. Syzygia staff access the Customer's data only as needed to provide the Services, give support or resolve incidents, and such access is logged.

4. Security (Art. 28(3)(c) and Art. 32)

4.1. Syzygia applies the technical and organizational measures of Annex II, appropriate to the risk. It may update them provided the level of protection is not reduced.

5. Sub-processors (Art. 28(2), 28(4) and 28(3)(d))

5.1. The Customer gives Syzygia general written authorization to engage sub-processors. Their categories are set out in Annex III, and the current list is available to the Customer on request at info@syzygia.io.

5.2. Notice of changes. Syzygia will inform the Customer of any addition or replacement of a sub-processor, or of any change that extends the data it receives or its location, at least 30 days in advance, by email to the Customer's administrators and to anyone subscribed to change notices (see syzygia.io/subprocessors).

5.3. Objection. The Customer may object in writing, on reasonable data protection grounds, within that period. The parties will look in good faith for an alternative (for example, not using that sub-processor for the Customer). If there is none, the Customer may terminate the Main Agreement for the affected services, without penalty and with a refund of amounts paid in advance and not used.

5.4. Emergencies. If a sub-processor has to be replaced urgently (security incident, the provider ceasing its service), notice will be given as soon as possible and the right to object is kept.

5.5. Syzygia imposes on each sub-processor, by contract, the same data protection obligations as in this DPA, and remains fully liable to the Customer for their performance.

6. Data subject rights (Art. 28(3)(e))

6.1. Taking into account the nature of the processing, Syzygia assists the Customer with technical and organizational measures to respond to requests to exercise rights. The platform lets the Customer, without Syzygia's involvement, export, correct and delete its users' data and receive and resolve the privacy requests its users make in the Hub.

6.2. If a data subject contacts Syzygia directly, Syzygia will forward the request to the Customer within 5 business days and will not answer on its behalf unless instructed.

7. Assistance with other obligations (Art. 28(3)(f))

7.1. Syzygia helps the Customer, with the information available to it, to comply with Articles 32 to 36: security, breach notification (clause 8), data protection impact assessments (Syzygia can provide its own impact assessment of its AI processing) and prior consultation.

8. Personal data breaches (Art. 33(2))

8.1. Syzygia will notify the Customer without undue delay and in any case within 48 hours of becoming aware of a personal data breach affecting its data, by email to the Customer's administrators (and by phone if it is serious).

8.2. The notification includes, at least and as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, Syzygia's contact, the likely consequences and the measures taken or proposed. Information not yet available is provided in phases.

8.3. The Customer is responsible for notifying the supervisory authority and data subjects. Syzygia does not do so on its behalf unless instructed in writing.

9. Audits and information (Art. 28(3)(h))

9.1. Syzygia makes available to the Customer the information needed to demonstrate compliance with this DPA: this DPA, its security policies, the list of sub-processors, a summary of its impact assessment and, when they exist, independent audit reports. Syzygia does not currently hold a SOC 2 report.

9.2. The Customer may carry out, or have an independent auditor bound by confidentiality carry out, an audit or inspection once a year (or after a security breach or at the request of a supervisory authority), with 30 days' notice, during business hours and without access to other customers' data. Each party bears its own costs, except that Syzygia bears the reasonable costs of an audit that reveals a material breach of this DPA by Syzygia. Audits of sub-processors' facilities are replaced by the independent audit reports or certifications those sub-processors provide.

10. International transfers

10.1. The data is processed in the United States and other countries. Transfers outside the EEA, the United Kingdom or Switzerland rely on an adequacy decision (for example, the EU-U.S. Data Privacy Framework for certified recipients) or on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914, module 3, processor to processor, between Syzygia and each sub-processor), with the UK addendum or the Swiss amendments where applicable. Syzygia has carried out a transfer impact assessment. Copies of the safeguards are available on request at info@syzygia.io.

10.2. If the Customer is established outside the EEA, the parties will also sign the SCCs module 4 (processor to controller) where required.

10.3. Data residency in the EU is not currently available.

11. Return and deletion at the end of the service (Art. 28(3)(g))

11.1. When the Main Agreement ends, at the Customer's choice communicated within 30 days:

1. Return: Syzygia delivers an export of the data in a structured, commonly used format (JSON or CSV), by secure means; and then
2. Deletion: Syzygia deletes the data from its systems and keeps a dated record of what was deleted.

11.2. Backups. Data remaining in backups is not restored for production use and is deleted when those backups expire: up to 35 days for daily backups and up to 365 days for monthly backups. If a backup were restored, the deletions already made would be applied again.

11.3. Legal retention. Syzygia may keep, blocked, the data needed to comply with legal obligations or defend claims: invoices and the billing record of agent executions (without user identity once users are deleted), pseudonymized audit logs (365 days) and the record of the deletion (6 years).

11.4. Syzygia will issue a certificate of deletion on request.

12. Liability

12.1. Each party is liable for its own breaches under Article 82 GDPR. Limitations of liability are those of the Main Agreement.

13. Customer obligations

13.1. The Customer warrants that it has a legal basis for the processing it entrusts to Syzygia, that it has informed the data subjects (including about the use of AI providers, voice transcription, agent email and messaging channels such as WhatsApp where it uses them) and that it has carried out any impact assessments required.

13.2. The Customer will not use the agents to take decisions based solely on automated processing that produce legal or similarly significant effects on individuals (Art. 22) without meaningful human involvement, unless it has a basis for doing so and applies the safeguards of Art. 22(3).

13.3. The Customer will avoid uploading special categories of data (Art. 9) or criminal-offence data (Art. 10) unless necessary and lawful, and may not do so without Syzygia’s prior written agreement.

14. Governing law and jurisdiction

This DPA is governed by the laws of the State of Delaware, United States, and the courts located there have jurisdiction, except that the Standard Contractual Clauses, where they apply, are governed by the law of Ireland and disputes under them are resolved by the courts of Ireland.

Annex I — Description of the processing

Annex II — Technical and organizational measures

• Encryption: personal data encrypted in transit and at rest.
• Access control: role-based access on a least-privilege basis; multi-factor authentication for staff; periodic access reviews; staff access to customer data logged.
• Separation: each customer's data logically separated from other customers'.
• Backups and recovery: regular backups and recovery procedures.
• Logging and monitoring: security logging, monitoring and alerts.
• Vulnerability management: regular scanning and remediation; public vulnerability disclosure policy.
• Incident response: incident response plan; Customer notification as set out in clause 8.
• People: confidentiality commitments; data protection and security training; access removed promptly when someone leaves.
• Sub-processors: due diligence before engagement and periodically afterwards; a data processing agreement with each one.
• AI: AI model providers process prompts and context only to return a response and do not use them to train models (some may keep them for up to 30 days for abuse monitoring); human confirmation for the agent actions the Customer marks.
• Rights and deletion: user export and deletion in the platform; verifiable deletion when a customer leaves.

Annex III — Sub-processors

The Customer authorizes the sub-processors Syzygia uses on the date it accepts this DPA, as updated under clause 5. They belong to these categories: cloud hosting provider (servers in the United States); AI model providers; payment processor; email provider; messaging channel providers (for example WhatsApp, where the Customer chooses that channel); web search provider.

The current list, with each sub-processor's name, purpose and location, is available to the Customer on request at info@syzygia.io. Changes are notified as set out in clause 5. Anyone can subscribe to change notices by emailing info@syzygia.io.