Data Processing Addendum

This Data Processing Addendum (this “DPA”) forms part of the Master Customer Agreement, or other written agreement, between Omni Systems, Inc., a Delaware corporation (the “Company”), and Customer (the “Agreement”).

Capitalized terms not defined in this DPA have the meanings given in the Agreement.

1. Scope and Roles

1.1 Roles of the Parties

“Customer Personal Data” means personal data that the Company processes on Customer’s behalf under the Agreement. It includes personal data in:

• Customer Data;
• the content of support cases, including attachments, screenshots and recordings; and
• Customer’s systems that the Company accesses to provide support or Professional Services.

“Personal data” includes “personal information,” “personally identifiable information” and any similar term under applicable Data Protection Law.

“Data Protection Law” means all privacy and data protection laws that apply to the processing of Customer Personal Data under the Agreement. These include:

• the EU General Data Protection Regulation 2016/679 (“GDPR”);
• the GDPR as it forms part of UK law (“UK GDPR”);
• the Swiss Federal Act on Data Protection;
• the California Consumer Privacy Act (“CCPA”);
• other US state privacy laws.

For Customer Personal Data:

• Customer is the “controller” and “business,” and the Company is the “processor” and “service provider,” as those terms are defined under Data Protection Law.
• Where Customer acts as a processor on behalf of a third-party controller, the Company is Customer’s subprocessor. In that case, Customer confirms that the controller has authorized its instructions, including the engagement of the Company and its Subprocessors.

Each Party will comply with its obligations under Data Protection Law.

1.2 Scope of Processing

This DPA applies to the Company’s processing of Customer Personal Data:

• (a) in the Hosted Services; and
• (b) when the Company accesses Customer’s systems or data to provide support or Professional Services.

Production runtimes that Customer runs in its own environments can run fully offline and send no data to the Company. Data reaches the Company only if Customer connects a deployment to the Hosted Services, or gives the Company access to personal data in those environments. This DPA applies to that data.

Schedule I describes the subject matter, nature and purpose of the processing, the types of Customer Personal Data and the categories of data subjects.

1.3 Conflicts

If this DPA conflicts with the rest of the Agreement, this DPA controls to the extent of the conflict. If the EU SCCs or the UK Addendum (Section 6) conflict with this DPA, they control.

1.4 Independent Controller Data

The Company processes some data as an independent controller, under its Privacy Policy. This DPA does not apply to that processing. The data covered is:

• Customer Users’ account and contact details;
• billing information;
• Telemetry;
• the Company’s communications with Customer’s personnel.

2. Processing of Customer Personal Data

2.1 Documented Instructions

The Company will process Customer Personal Data only to provide the Services, and only in accordance with Customer’s documented instructions (“Documented Instructions”). Documented Instructions are those set out in this DPA and the Agreement, the settings Customer selects in the Services, and other written instructions that Customer gives and the Company accepts.

Unless prohibited by law, the Company will inform Customer in either of these cases:

• a legal obligation requires the Company to process Customer Personal Data other than in accordance with the Documented Instructions;
• the Company believes an instruction infringes Data Protection Law.

2.2 CCPA Commitments

The Company will not:

• (a) “sell” or “share” Customer Personal Data, as those terms are defined in the CCPA;
• (b) retain, use or disclose Customer Personal Data for any purpose other than performing the Services in accordance with the Documented Instructions;
• (c) retain, use or disclose Customer Personal Data outside the direct business relationship between Customer and the Company; or
• (d) combine Customer Personal Data with personal data it receives from or on behalf of third parties, except as Data Protection Law permits.

The business purposes for which the Company processes Customer Personal Data are those described in Schedule I (Nature of the processing and Purposes of the processing). The Company will provide the same level of privacy protection as the CCPA requires of businesses. On notice, Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

The Company will notify Customer if it determines that it can no longer meet its obligations under the CCPA. The Company certifies that it understands and will comply with the restrictions in this Section 2.2.

2.3 Confidentiality of Personnel

The Company will make sure that the people it authorizes to process Customer Personal Data:

• are bound by appropriate obligations of confidentiality; and
• access Customer Personal Data only as needed to provide the Services.

2.4 Customer’s Responsibilities

Customer is responsible for:

• having a lawful basis for the processing it instructs;
• providing the notices and obtaining the consents that Data Protection Law requires;
• making sure its instructions comply with Data Protection Law.

Customer will not provide special categories of personal data, or other sensitive data described in Section 8.7 of the Master Customer Agreement (or the equivalent provision of the Agreement), unless the Parties have agreed in writing to additional terms for that data.

3. Subprocessors

3.1 Authorization

Customer gives the Company general authorization to engage the subprocessors listed at https://omnitep.io/subprocessors.html (“Subprocessors”).

For each Subprocessor, the Company will:

• (a) enter into a written agreement that imposes data protection obligations substantially as protective as those in this DPA, to the extent they apply to the services the Subprocessor provides; and
• (b) remain responsible for the Subprocessor’s processing of Customer Personal Data under this DPA, consistent with the limitations of liability in the Agreement.

3.2 New Subprocessors

The Company will give Customer notice at least fifteen (15) days before a new Subprocessor begins processing Customer Personal Data. It will do this by updating the Subprocessor page and notifying Customer by email or in My Account.

Customer may object to a new Subprocessor on reasonable data protection grounds by giving the Company written notice within that fifteen-day period. The Parties will then work together in good faith to address the objection.

If they cannot resolve it within thirty (30) days after Customer’s objection, Customer may terminate the affected Services by written notice. The Company will then refund the prepaid Fees for the unused portion of the terminated Services.

3.3 Third Parties That Customer Enables

Some third parties are enabled by Customer rather than engaged by the Company. Examples are providers of Customer-Provided Models and other Third-Party Platforms. These third parties are not Subprocessors.

The Company sends Customer Personal Data to them only on Customer’s Documented Instructions. Customer is responsible for its agreements with them and for any transfer safeguards.

4. Assistance

4.1 Data Subject Requests

The Company will:

• (a) promptly forward to Customer any request it receives from a data subject or consumer to exercise rights under Data Protection Law with respect to Customer Personal Data;
• (b) advise the requester to submit the request to Customer; and
• (c) give Customer reasonable assistance, taking into account the nature of the processing, so that Customer can respond to such requests.

4.2 Cooperation

Taking into account the nature of the processing and the information available to it, the Company will give Customer reasonable assistance with Customer’s obligations under Data Protection Law. This includes data protection impact assessments and, where required, prior consultations with supervisory authorities.

The Company may charge a reasonable fee for assistance under this Section 4.2 that goes beyond the standard features of the Services.

5. Security

5.1 Security Measures

The Company has implemented, and will maintain, technical and organizational measures designed to protect Customer Personal Data, as described in Annex II (the “Security Measures”).

The Parties agree that the Security Measures provide an appropriate level of security for the risks of the processing under the Agreement.

The Company may update the Security Measures, as long as the updates do not materially decrease the overall security of the Hosted Services.

5.2 Security Incidents

A “Security Incident” is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data that the Company or its Subprocessors process.

The Company will notify Customer of a Security Incident without undue delay, and in any case within seventy-two (72) hours after becoming aware of it. The Company will:

• give Customer the information it reasonably needs to meet its own obligations under Data Protection Law, as that information becomes available;
• take reasonable steps to investigate the Security Incident, mitigate its effects and remediate its causes.

Notifying Customer of a Security Incident is not an acknowledgment of fault or liability.

5.3 Audits

The Company will make available to Customer the information reasonably necessary to demonstrate its compliance with this DPA. This includes responses to reasonable security questionnaires.

Customer may request an audit of the Company’s controls that apply to the processing of Customer Personal Data (an “Audit”) in either of these cases:

• that information does not reasonably demonstrate compliance; or
• a supervisory authority requires an Audit.

Customer may request an Audit no more than once in any twelve-month period, on at least thirty (30) days’ written notice. This frequency limit does not apply after a Security Incident, or where a supervisory authority requires an Audit. For the infrastructure that Amazon Web Services operates, AWS’s own audit reports satisfy the Audit. Each Audit must be:

• (a) carried out by Customer, or by an independent auditor that Customer designates and that has signed an appropriate confidentiality agreement with the Company;
• (b) at Customer’s sole cost;
• (c) during normal business hours;
• (d) conducted in a way that minimizes disruption to the Company’s business; and
• (e) conducted in accordance with a scope, start date, duration and security and confidentiality controls agreed in advance.

Customer may use the results of an Audit only to meet its regulatory audit requirements or to confirm compliance with this DPA.

6. International Data Transfers

6.1 Processing Locations

The Company processes Customer Personal Data in the United States and the European Union:

• the Hosted Services run in Amazon Web Services regions in the United States and the European Union; and
• the Company’s personnel and Subprocessors who support the Hosted Services are located in those regions; and
• Company-Provided Models are invoked only in AWS regions, or cross-region inference profiles, in the United States or the European Union.

Customer authorizes the Company to transfer Customer Personal Data to those locations for the purposes of the Agreement. The Company will make such transfers in accordance with Data Protection Law, including on the basis of:

• (a) the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced from time to time (the “EU SCCs”); or
• (b) the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, Version B1.0, in force 21 March 2022, as amended or replaced from time to time (the “UK Addendum”).

6.2 EU Transfers

For transfers of Customer Personal Data from the European Economic Area to the Company that are not covered by an adequacy decision, the Parties conclude the following modules of the EU SCCs, which are incorporated into this DPA:

• Module 2 (controller to processor); and
• Module 3 (processor to processor), where Customer is a processor on behalf of a third-party controller.

The EU SCCs are completed as follows:

• (a) Customer is the “data exporter,” and the Company is the “data importer”;
• (b) the optional docking clause in Clause 7 applies;
• (c) Option 2 of Clause 9(a) applies, and the notice period is the period set out in Section 3.2 of this DPA;
• (d) the optional language in Clause 11(a) does not apply;
• (e) for Clause 13(a), the competent supervisory authority is the one determined in accordance with that Clause;
• (f) for Clause 17, Option 2 applies. The EU SCCs are governed by the law of the EU Member State in which the data exporter is established. Where the data exporter is not established in an EU Member State, or where that law does not allow for third-party beneficiary rights, they are governed by the law of an EU Member State that allows such rights, which the Parties will agree in writing on request;
• (g) for Clause 18(b), disputes will be resolved before the courts of the EU Member State whose law governs the EU SCCs under paragraph (f); and
• (h) Annex I of the EU SCCs is completed with the information in Schedule I, Annex II with the Security Measures, and Annex III with the Subprocessor list.

For transfers of Customer Personal Data from Switzerland:

• references to the GDPR in the EU SCCs are to the Swiss Federal Act on Data Protection;
• the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner;
• the EU SCCs are governed by Swiss law, and disputes are resolved by the courts of Switzerland;
• data subjects who have their habitual residence in Switzerland may bring claims under the EU SCCs before the courts of Switzerland.

6.3 UK Transfers

For transfers of Customer Personal Data from the United Kingdom, the Parties conclude the UK Addendum, which is incorporated into this DPA and completed as follows:

• (a) in Table 1, the “Exporter” is Customer and the “Importer” is the Company. Their details are set out in this DPA and the Agreement;
• (b) in Table 2, the first option is selected, and the “Approved EU SCCs” are the EU SCCs referred to in Section 6.2;
• (c) in Table 3, Annexes 1A and 1B are Schedule I, Annex II is the Security Measures, and Annex III is the Subprocessor list; and
• (d) in Table 4, both the Importer and the Exporter may end the UK Addendum.

6.4 Alternative Transfer Mechanisms

If the Company adopts another lawful transfer mechanism recognized under Data Protection Law, that mechanism will apply to the extent it covers the relevant transfers.

7. Return and Deletion

When the Services end, the Company will make Customer Personal Data in the Hosted Services available for export, and then delete it, as described in Section 8.6 of the Master Customer Agreement (or the equivalent provision of the Agreement).

Customer Personal Data held outside the Hosted Services, such as in support cases or Professional Services materials, is deleted within ninety (90) days after the relevant Services end, subject to the same exceptions.

The Company may keep Customer Personal Data where law requires it. Copies in routine backups are deleted in the normal backup cycle. Until deletion, the Company will continue to protect retained data in accordance with this DPA.

On Customer’s written request, the Company will confirm deletion in writing.

8. General

This DPA stays in effect for as long as the Company processes Customer Personal Data under the Agreement.

Each Party’s liability under this DPA is subject to the limitations of liability in the Agreement. However, those limitations do not restrict a Party’s liability to data subjects under the EU SCCs or the UK Addendum where Data Protection Law does not allow them to.

Except as the EU SCCs or the UK Addendum require, this DPA is governed by the law that governs the Agreement.

Schedule I: Description of Processing

A. List of Parties

Data exporter

• Name: Customer, as identified in the Agreement or Order.
• Contact: the account contact in the Order or in My Account.
• Activities relevant to the transfer: Customer receives the Services described in the Agreement and provides Customer Personal Data to the Company in that context.
• Role: controller, or processor on behalf of its own controllers.
• Signature and date: by accepting the Agreement, or an Order that references this DPA, on the date of acceptance.

Data importer

• Name: Omni Systems, Inc., 2501 Chatham Rd, Ste R, Springfield, IL 62704, USA.
• Contact: privacy@…Show.
• Activities relevant to the transfer: the Company provides the Services described in the Agreement and processes Customer Personal Data on Customer’s behalf in that context.
• Role: processor, or subprocessor where Customer is a processor.
• Signature and date: by accepting the Agreement, or an Order that references this DPA, on the date of acceptance.

B. Description of the Processing

Categories of data subjects

• Customer Users: Customer’s personnel, and the personnel of its Partners, who use the Services.
• End Users, and other individuals whose personal data Customer includes in Customer Data. Examples include individuals appearing in test data, tickets, documents, screenshots, session recordings, prompts, outputs and agent memory.
• Customer’s contacts at its Clients.

Categories of personal data

• Identification and contact data that appear in Customer Data, such as names, email addresses and roles in projects, tickets and documents.
• Activity logs and audit records that form part of Customer Data, such as the history of work items and approvals in the SDLC Portal.
• Personal data that Customer includes in support cases, attachments, screenshots and recordings.
• Any other personal data that Customer includes in Customer Data. Customer determines and controls this content.

Account, billing and Telemetry data that the Company processes as an independent controller is outside this DPA (Section 1.4).

Sensitive data

None is intended. Customer will not provide special categories of personal data unless the Parties have agreed in writing to additional terms and safeguards (Section 8.7 of the Master Customer Agreement, or the equivalent provision of the Agreement).

Frequency of the transfer

Continuous, for the duration of the Agreement.

Nature of the processing

The processing consists of:

• hosting and storage;
• retrieval, transmission and display;
• backup;
• processing of Input through Company-Provided Models (Amazon Bedrock);
• transmission of Input to Customer-Provided Models, on Customer’s instructions (Section 3.3);
• support and troubleshooting;
• deletion.

Purposes of the processing

To provide, secure and support the Services in accordance with the Agreement and Customer’s Documented Instructions.

Duration and retention

For the term of the Agreement, plus the export period in Section 8.6 of the Master Customer Agreement (or the equivalent provision of the Agreement). The data is then deleted as described in Section 7, and backups are deleted in the normal backup cycle.

Transfers to Subprocessors

The subject matter and nature of the processing are as described above. The processing lasts for the duration of the Agreement. The Subprocessors are listed at https://omnitep.io/subprocessors.html.

C. Competent Supervisory Authority

• For data subjects in the European Economic Area: the supervisory authority determined in accordance with Clause 13 of the EU SCCs.
• For data subjects in the United Kingdom: the UK Information Commissioner.
• For data subjects in Switzerland: the Swiss Federal Data Protection and Information Commissioner.

Annex II: Technical and Organizational Security Measures

The Company maintains the following measures for the Hosted Services.

1. Hosting and physical security. The Hosted Services run in Amazon Web Services data centers. AWS provides the physical and environmental security controls for those facilities.
2. Access control. Access to production systems and Customer Personal Data is limited to authorized personnel with a business need. It is granted through individual accounts, reviewed periodically and removed promptly when no longer needed.
3. Authentication. Administrative access to production infrastructure requires multi-factor authentication.
4. Encryption. Customer Personal Data is encrypted in transit over public networks using TLS. It is encrypted at rest in databases and storage where the AWS services used support it.
5. Customer separation. Each customer’s data is logically separated from other customers’ data in the Hosted Services.
6. Logging and monitoring. Security-relevant events in the production environment are logged and monitored, and access to logs is restricted.
7. Secure development and change management. Changes to the Hosted Services go through code review and automated analysis, including detection of high-risk code patterns, before release. Security patches are applied in a timely manner.
8. Backups and resilience. Customer Data is backed up regularly, and restore procedures are maintained.
9. Incident response. The Company maintains an incident response process that includes the notification obligations in Section 5.2.
10. Personnel. Personnel with access to Customer Personal Data are bound by confidentiality obligations and receive security awareness guidance.
11. Subprocessor management. The Company assesses Subprocessors before engaging them and binds them by written data protection terms (Section 3.1).
12. Deletion. Customer Personal Data is deleted in accordance with Section 7.
13. Security features available to Customer. The Services provide features that Customer controls:
    • role-based access control;
    • single sign-on;
    • an audit trail;
    • approval (human-in-the-loop) controls for AI agents.