Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Alphie Terms of Service (the "Terms") between AI Recruitment Technologies Inc. ("Company") and the customer that accepts the Terms ("Customer"). It applies whenever Company processes Personal Data on Customer's behalf to provide the Service. Capitalized terms not defined here have the meaning given in the Terms. If this DPA conflicts with the Terms on a data-protection matter, this DPA controls. A data processing agreement signed by both parties controls over this DPA.

1. Definitions

• "Data Protection Laws" means the laws that apply to the processing of Personal Data under the Terms, including the CCPA, the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection ("FADP").
• "GDPR" means Regulation (EU) 2016/679. "UK GDPR" means the GDPR as it forms part of the law of the United Kingdom.
• "Personal Data" means information about an identified or identifiable natural person, including "personal information" under the CCPA, that Company processes on Customer's behalf.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Personal Data.
• "Sub-processor" means a third party Company engages to process Personal Data.
• "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
• "Controller", "processor", "data subject" and "processing" have the meanings given in the GDPR. "Business", "service provider", "sell" and "share" have the meanings given in the CCPA.

2. Roles and Instructions

2.1 Roles. Customer is the controller (and the business under the CCPA) and Company is the processor (and the service provider). If Customer acts as a processor for someone else, Company is its sub-processor.

2.2 Instructions. Company processes Personal Data only on Customer's documented instructions. The Terms, this DPA and Customer's configuration of the Service are those instructions. Company will tell Customer if it believes an instruction breaks Data Protection Laws, and may suspend the affected processing until the instruction is changed.

2.3 Details. Annex 1 describes the processing.

2.4 Customer's Responsibilities. Customer is responsible for: (a) having a lawful basis for the processing; (b) giving visitors and other data subjects the notices Data Protection Laws require, including notice of the Service and of any transfer of their data outside their country; (c) obtaining and recording consent where the law requires it, including consent to store or read information on visitors' devices; and (d) running a consent tool that covers the Service where Section 4 or the Terms require one.

2.5 CCPA. Company's service-provider commitments in Section 8 of the Terms apply to all Personal Data covered by this DPA.

3. Company's Obligations

3.1 Confidentiality. Company ensures that everyone it authorizes to process Personal Data is bound by confidentiality.

3.2 Security. Company maintains the technical and organizational measures in Annex 2. Company may update them as long as the overall level of protection does not decrease.

3.3 Sub-processors. Customer authorizes Company to use the Sub-processors listed at meetalphie.com/sub-processors. Company will tell Customer about a new Sub-processor at least 30 days before it starts processing Personal Data, by updating that page and emailing Customer's Administrators. Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it. Company binds each Sub-processor to data-protection terms no less protective than this DPA and remains liable for its Sub-processors.

3.4 Data Subject Requests. Company will pass on to Customer any request it receives from a data subject about Personal Data processed for Customer, and will help Customer respond, including through the Service's deletion features, taking into account the nature of the processing.

3.5 Assistance. Company will give Customer reasonable help with data protection impact assessments and consultations with supervisory authorities, where Data Protection Laws require them and they relate to the Service.

3.6 Security Incidents. Company will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident, and will give Customer the information it reasonably needs to meet its own notification duties.

3.7 Retention and Deletion. Company keeps Personal Data while Customer's account is open. Customer can delete individual records at any time through the Service and can export its data before closing its account. Company deletes Customer's Personal Data when Customer deletes its account, or within 30 days of Customer's written request after the Terms end, except for data Company must keep by law. Copies in backups are deleted as the backups expire in the normal cycle.

3.8 Demonstrating Compliance. Company will make available the information reasonably needed to demonstrate compliance with this DPA, including answers to a reasonable security questionnaire once a year, after a Security Incident, or when a supervisory authority requires it. Where Data Protection Laws require an audit and that information is not enough, Customer may carry out one, at its own cost, on at least 30 days' notice, during business hours, under confidentiality, and no more than once a year.

4. Geographic Scope and Consent

4.1 Country Rules. The Service applies the rules in Annex 3 according to the visitor's location, as determined from the visitor's IP address. IP geolocation is approximate.

4.2 Providers Outside the United States. For visitors outside the United States, Company uses only the EU-based Sub-processor named for this purpose on the Sub-processors page.

4.3 Declines and Opt-Outs. In every country, Company does not identify a visitor who declines through Customer's consent tool, opts out, or sends a Global Privacy Control signal.

4.4 Customers in Europe. If Customer is established in the European Economic Area, the United Kingdom or Switzerland, Customer will tell Company, and the Service will identify a visitor, wherever located, only after that visitor gives affirmative consent through Customer's consent tool.

4.5 Outreach. Outreach to contacts at identified companies is available only for contacts in the United States and, using business email addresses only, the United Kingdom.

4.6 Changes. Company may make Annex 3 more restrictive at any time, and less restrictive on 30 days' notice to Customer.

5. International Transfers

5.1 Locations. Company processes Personal Data in the United States. Its Sub-processors process Personal Data in the United States and the European Union.

5.2 European Economic Area. Where Data Protection Laws require a transfer mechanism for Personal Data that Customer transfers to Company from the European Economic Area, the SCCs apply and are incorporated into this DPA: Module 2 where Customer is a controller and Module 3 where Customer is a processor. Clause 7 does not apply. Under Clause 9, option 2 applies with the notice period in Section 3.3. The optional language in Clause 11 does not apply. Under Clause 13, the competent supervisory authority is the one competent for Customer. Under Clauses 17 and 18, the law and courts of Ireland apply. Annexes 1 and 2 of this DPA complete Annexes I and II of the SCCs, and the Sub-processors page completes Annex III.

5.3 United Kingdom. For transfers from the United Kingdom, the UK Addendum applies and is incorporated into this DPA. Tables 1 to 3 are completed with the information in this DPA, and either party may end the UK Addendum as its Section 19 allows.

5.4 Switzerland. For transfers from Switzerland, the SCCs apply as described in Section 5.2, with the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, references to the GDPR read as references to the FADP, and the term "member state" read so that data subjects in Switzerland can bring claims where they habitually reside.

5.5 Other Countries. Where the law of another country requires a transfer mechanism, the SCCs apply with the minimum changes that law requires.

5.6 Onward Transfers. Company puts an appropriate transfer mechanism in place with each Sub-processor that receives Personal Data from the European Economic Area, the United Kingdom or Switzerland in a country without an adequacy decision.

6. Liability

Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Laws do not allow it.

7. Term and Acceptance

This DPA applies for as long as Company processes Personal Data for Customer. Customer accepts this DPA by accepting the Terms, including through the Service. Company may update this DPA under Section 17 of the Terms.

Annex 1 -- Details of Processing

Parties

• Controller (data exporter): Customer, as identified in its account. Contact: the account's Administrators.
• Processor (data importer): AI Recruitment Technologies Inc., a Delaware corporation. Contact: legal@meetalphie.com.

Data subjects

• Visitors to Customer's websites where the Alphie script is installed
• People who chat with Customer through the Service
• Customer's users of the Service
• People at identified companies whom Customer contacts through the Service's outreach features (United States and United Kingdom only)

Categories of Personal Data

• Online identifiers: IP address (used in memory during the visit, never stored) and Alphie session and client identifiers
• Activity on Customer's website: pages viewed, referrer, time on page, device and browser information, and country
• Chat messages and anything a visitor types or uploads in the chat
• Contact details a visitor provides, such as name, email address and phone number
• Resolved company data: the company the visitor appears to work for and its firmographics
• For visitors in the United States who share their email address: professional profile data from identity resolution providers
• For outreach contacts: name, job title, work email address and professional profile URL
• For Customer's users: name, email address, and login and usage data

Special categories of data: none intended. Section 8.3.6 of the Terms applies.

Frequency: continuous, while the Service is in use.

Nature and purpose: providing the Service to Customer -- identifying visiting companies, running the AI chat, qualifying and routing leads, sending alerts, supporting outreach, and reporting.

Retention: as set out in Section 3.7.

Sub-processors: as listed on the Sub-processors page, for the purposes stated there.

Annex 2 -- Security Measures

• Encryption in transit: TLS on all connections and HSTS on Company's domains.
• Encryption at rest: the database and file storage are encrypted by the hosting providers. OAuth tokens, integration credentials and two-factor secrets are also encrypted with AES-256-GCM.
• Access control: role-based access in the Service, multi-factor authentication for Company's internal admin access, and staff access limited to what each role needs.
• Passwords: stored as bcrypt hashes only.
• Data minimization: visitor IP addresses are used in memory only, removed from logs before export, and never stored together with a company. Visitor chat content is summarized out of request logs.
• Backups: daily backups by the hosting provider.
• Deletion: per-record deletion in the Service and through the API.
• Monitoring: application logging and error alerting.
• Sub-processors: written data-protection terms with each Sub-processor.

Annex 3 -- Country Rules

The European Economic Area means the member states of the European Union, Iceland, Liechtenstein and Norway.

For Customers established in the European Economic Area, the United Kingdom or Switzerland, Section 4.4 also applies: the Service waits for affirmative consent from every visitor, and the rest of each row still applies.