Data Processing Addendum

1. Application and roles

1.1This DPA forms part of the Agreement when the Company processes personal data on behalf of Customer in delivering the Services (Customer Personal Data). Customer acts as controller or as a processor with authority from its controller; the Company acts as processor or subprocessor, and as holder where that terminology applies under Israeli law. Independent Company processing described in the Privacy Policy is outside this processor relationship.

1.2Applicable Data Protection Law means the data protection laws actually applicable to the relevant processing, including Israeli law and, where their territorial and material scope is met, GDPR or UK data protection law. This DPA does not assert that a foreign law applies solely because someone is a citizen of that country.

1.3Capitalized terms not defined in this DPA have the meanings given in the Terms of Service. Personal Data Breach means a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. Subprocessor means a person or entity engaged by the Company to process Customer Personal Data on Customer’s behalf. Customer Personal Data includes personal data in Inputs, Outputs, inferences and execution records processed on Customer’s behalf. Controller and processor roles are determined by the actual processing and applicable law.

2. Processing instructions and schedule

2.1The Agreement, Customer’s permitted configuration and documented lawful support requests constitute instructions. We will process Customer Personal Data only on those instructions, including for transfers, unless law requires otherwise; where lawful, we will inform Customer of that requirement. If we consider an instruction unlawful, we will inform Customer and may suspend the affected processing pending clarification.

2.2Before live processing, the parties must complete the processing schedule identifying the subject matter, duration, nature and purpose; data subjects and data categories; sensitive-data restrictions; locations; subprocessors; retention and deletion periods; security measures; and contact points. The completed service-specific schedule is incorporated into this DPA; processing outside its agreed scope requires any additional instruction or agreement required by this DPA and applicable law.

2.3Typical purposes can include Customer-configured communications, document processing and workflow execution. Processing can include collection, storage, retrieval, analysis, transmission and deletion. The actual permitted scope is the completed schedule and instructions, not every possible platform feature.

2.4An instruction to connect a tool authorizes only the processing reasonably necessary for the specified task and granted permissions. It does not authorize unrestricted disclosure, use for another customer, or processing for an independent training purpose. A material expansion of purpose, approved sensitive categories or processing locations requires an updated instruction and any necessary contractual safeguards.

2.5The Company will promptly notify Customer if it determines that it can no longer comply with this DPA in relation to the agreed processing. The parties will restrict the affected processing and cooperate on lawful remediation; Customer may suspend the affected instructions while the issue is resolved. This paragraph does not require disclosure prohibited by law.

3. Customer obligations

3.1Customer must have lawful authority to provide the data and instructions, give required notices, obtain required consents, respect data minimization and assess its use case. If it acts for another controller, it must have authority to appoint us and convey valid instructions. It must not submit unsupported regulated or sensitive categories.

3.2Customer is responsible for its access permissions, connected accounts and agent authorizations. Those responsibilities do not waive the Company’s processor obligations or excuse a security failure attributable to us.

4. Confidentiality and security

4.1We will ensure that persons authorized to process Customer Personal Data are bound by confidentiality and access only data needed for their role. We will implement appropriate technical and organizational measures considering the nature, scope and risk of processing and applicable law, including the relevant Israeli information-security obligations and GDPR Article 32 where applicable.

4.2The security schedule must document the measures for the contracted service, including access control, tenant separation, protection in transmission and storage, logging, incident handling, backup and restoration, personnel and vendor governance. We will not materially reduce the agreed level of protection during processing. Certifications and precise technical specifications require supporting evidence and are not inferred from this DPA.

5. Company subprocessors and Customer connections

5.1Customer authorizes only the Company subprocessors disclosed in the agreed schedule at commencement. Before adding or replacing a subprocessor, we will provide at least 30 days’ notice and an opportunity to raise reasonable data-protection objections. We will seek a suitable resolution; if none is reasonably available, Customer may terminate the affected service before the change and receive unused prepaid fees for that service.

5.2We will bind Company subprocessors to data-protection obligations no less protective in substance for their processing and remain responsible for their performance of those obligations as required by applicable law. A contractual disclaimer concerning external models does not override this paragraph.

5.3A provider independently engaged and instructed by Customer through its own account is not automatically our subprocessor. Its role depends on the actual processing relationship. Customer is responsible for its separate contract; we remain responsible for our own handling and transfer of data within Customer’s lawful instructions.

5.4Notices of a proposed Subprocessor appointment or replacement will be sent to Customer’s designated administrative or privacy contact and identify the proposed Subprocessor, affected processing, relevant locations and intended commencement date. Customer must send a reasoned objection to privacy@uniforce.work before that date. During resolution of a timely objection, Company will not disclose the objected-to Customer Personal Data to the proposed Subprocessor unless Customer authorizes it or applicable law requires it. If the issue cannot be resolved before commencement, the affected processing must remain suspended or end under this Section; unrelated Services may continue.

6. Assistance and requests

6.1We will provide reasonable assistance, considering the nature of processing, with requests by data subjects, security obligations, impact assessments and regulatory consultations required by applicable law. Company will promptly forward a request concerning Customer Personal Data to Customer and provide timely assistance necessary for Customer to meet its applicable response deadline, taking account of the nature of processing and information available to Company. Company will not substantively respond except on Customer’s instructions or as required by law.

6.2Additional assistance outside ordinary service scope may carry reasonable charges agreed in advance, but fees must not prevent performance of duties that law requires us to perform. Each party will maintain the records required for its role.

6.3Where Customer is itself a processor, it is responsible for conveying the relevant controller’s instructions and obtaining required authorization for the processing chain. The Company will reasonably cooperate with Customer in demonstrating the chain and responding to controller requests, while avoiding conflicting direct instructions. Authorized affiliates may exercise rights through Customer unless applicable law requires another arrangement.

7. Personal data incidents

7.1We will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Initial notice may be supplemented as facts become available and will describe the nature of the breach, affected categories and estimated scope where known, likely consequences, containment or remediation and a contact point.

7.2We will take reasonable steps to contain, investigate and remedy breaches within our responsibility and assist Customer with its notification duties. Customer directs notices to its data subjects or authorities except where law independently requires us to act. Any shorter or immediate statutory reporting duty remains applicable.

7.3The initial notice must not wait for a complete forensic investigation. The Company will provide available facts in stages, preserve relevant evidence proportionately and supply a contact for follow-up. Customer must keep incident contacts current and promptly share information about compromised credentials or instructions that may affect the investigation.

7.4A breach attributable to Customer does not cancel the Company’s mandatory notification, containment or cooperation duties for data it processes. Responsibility for costs and damages is determined separately under the Agreement and applicable law. Neither party needs the other’s permission to meet a legal reporting deadline or communicate with a competent authority.

7.5Company will also notify Customer of a security event affecting the outsourced processing where applicable Israeli information-security requirements require such notification, even if the event does not meet the definition of a Personal Data Breach. Notice and cooperation do not, by themselves, constitute an admission of liability.

8. International transfers

8.1Processing and remote access locations must be disclosed in the schedule. We will not transfer Customer Personal Data contrary to applicable transfer restrictions. The parties must identify a valid mechanism for each applicable transfer, including the relevant Israeli regulations and, where necessary, an adequacy decision, appropriate standard contractual clauses and any UK addendum.

8.2This document does not itself execute or reproduce EU standard contractual clauses. Where required, the correct clauses and modules, completed annexes, transfer assessment and supplementary safeguards must be put in place before the transfer. Customer acceptance of the service terms alone does not cure a missing transfer mechanism.

8.3Any validly executed mandatory transfer instrument prevails over conflicting provisions of this DPA to the extent required by that instrument. Company will provide information reasonably necessary to assess the relevant transfers and cooperate with Customer in implementing applicable transfer safeguards. A change in processing or remote-access location remains subject to the agreed instructions, Subprocessor procedure and required transfer safeguards.

9. Return, deletion and retention

9.1At the end of processing, we will, at Customer’s choice, return or delete Customer Personal Data and delete existing copies, except where law requires retention. The standard export-request window is 30 calendar days after effective termination under Section 11 of the Terms of Service; the processing schedule records the applicable formats and any agreed additional return arrangements. Closing that window does not extinguish mandatory return or deletion rights. During any lawful retention, the data remains protected and is processed only for the retention purpose.

9.2Backup copies awaiting scheduled deletion must be isolated from ordinary use; if restored for recovery, applicable deletion instructions must be reapplied. We will provide confirmation of completion on reasonable request. An unrelated billing dispute does not cancel these data-protection obligations.

9.3Company will require its Subprocessors to implement the applicable return, deletion and retention instructions and include their completion in any confirmation it provides. Where retention is required by law, Company will identify the applicable requirement and retained categories to Customer where legally permitted, restrict access and use to that requirement, and delete the information when it no longer applies.

9.4Unless a shorter period is required by a valid deletion instruction, applicable law or the agreed processing schedule, Customer workspace data is deleted from the active database no later than three months after termination. Isolated, encrypted backup copies are removed no later than nine months after termination, comprising the initial three months and up to six additional months. These periods are deletion ceilings, not a right to continue ordinary processing after termination. Any legally required retention is limited to the required data and purpose. The standard export procedure in Section 11 of the Terms applies. Data needed for a timely return request must be preserved for its fulfillment and a reasonable notified retrieval opportunity, subject to earlier lawful deletion instructions. Retention does not itself promise continuing account access.

9.5Security logs are retained for at least 24 months under the Company security policy and any applicable legal requirement. They are restricted to security, investigation and compliance purposes and reviewed for deletion when those purposes and required periods end. Security-log retention does not authorize retaining all Customer content or full prompts for that period. Ordinary action histories follow the workspace retention schedule; no indefinite retention of all activity records is promised.

10. Information, audit and precedence

10.1We will make available information reasonably necessary to demonstrate compliance and allow audits and inspections by Customer or its authorized independent auditor as required by applicable law. Parties will coordinate reasonable notice, confidentiality, scope and protection of other customers. Existing reports may reduce duplication but do not eliminate legally required audit rights.

10.2The DPA prevails over conflicting service disclaimers concerning personal data processing. Contractual liability limits apply only to the extent lawful; they do not limit data-subject rights, supervisory powers or mandatory processor responsibility. Obligations continue while we retain Customer Personal Data.

10.3Routine audits should first use reasonably sufficient documentation to reduce unnecessary access. Where further inspection is legally required or justified by a material concern, the parties will agree proportionate arrangements, including a qualified independent auditor and safeguards for other customers and trade secrets. Routine frequency and notice arrangements do not bar an urgent regulatory inspection or an audit required after a material incident.

10.4Each party bears its ordinary compliance costs. Additional bespoke assistance may be charged only as agreed in advance and where lawful; fees and confidentiality arrangements cannot obstruct required cooperation with a competent authority. Any audit findings must be addressed according to their significance and the Company’s applicable obligations.

10.5Where Regulation 15 of the Israeli Privacy Protection Regulations (Data Security), 2017 applies to the engagement, Company will provide Customer, at least annually, a report on its performance of the applicable security obligations under those regulations and this DPA. The parties will cooperate with the oversight arrangements required for the engagement. The report is not a representation of independent certification.

11. Schedule A. Required service-specific details

11.1Before activation, record the contracting Customer and Company contacts; controller/processor chain; enabled Agents and modules; processing purposes and operations; categories of individuals and personal data; frequency and duration; any approved sensitive categories and safeguards; Company subprocessors and processing/access countries; transfer instruments; and the agreed technical and organizational measures.

11.2Also record operational log and conversation retention; return format and export window; deletion deadlines for active data and backups; incident contacts; the objection notification channel; and any approved support access. Uncompleted fields must not be treated as unrestricted permission or as evidence of a compliance certification.

11.3The service-specific schedule will also identify the systems Company may access, the permitted operations within those systems, applicable information-security duties, reporting and oversight arrangements, and how data will be returned or destroyed at the end of the engagement.

12. Purpose limitation and use restrictions

12.1Company will not sell Customer Personal Data, use it to market independently to Customer’s contacts, or combine it with unrelated customer datasets for an independent purpose inconsistent with the documented instructions. Service delivery, security, troubleshooting and authorized support are permitted only within the Agreement and applicable law. A general reference to improving services does not create unrestricted rights over identifiable content.

12.2Company may generate genuinely anonymous aggregate measures only where the process and subsequent use comply with applicable law and the Agreement. Information that can reasonably be linked back to a person remains protected personal data. Company must not attempt reidentification or publicly attribute an aggregate finding to Customer without permission.

12.3Where a service-provider or contractor restriction under applicable US state privacy law applies, processing must remain limited to the specified business purposes, with no sale or sharing for cross-context behavioral advertising and no retention, use or disclosure outside the permitted relationship except as law permits. Company will notify Customer if it can no longer meet an applicable restriction and cooperate in reasonable steps to stop and remediate unauthorized use.

13. Government requests and conflicting obligations

13.1Unless prohibited by law, Company will notify Customer of a legally binding demand for Customer Personal Data and provide reasonable information about its scope. Company will assess the demand, seek clarification or challenge it where there are reasonable grounds, and disclose only the data legally required. An informal request does not itself expand Company’s processing authorization.

13.2Where law prohibits prior notice, Company will seek permission to notify where appropriate and provide notice when the restriction no longer applies. Nothing requires a party to commit contempt, obstruct lawful process or miss a mandatory deadline. If continued processing cannot lawfully meet the agreed safeguards, the parties must restrict or suspend the affected transfer or processing and seek a lawful alternative.

14. Schedule B. Processing description

14.1The subject matter is processing of personal data needed to provide Customer’s purchased Uniforce workspace, configured Agents, orchestration, integrations and authorized support. The nature of processing includes receiving, organizing, storing, retrieving, analyzing, generating, transmitting and deleting information within Customer’s documented configuration. Processing can occur continuously while an authorized workflow is enabled or intermittently when a user initiates a task.

14.2Data subjects may include Customer’s authorized users, personnel, contractors, prospects, customers, suppliers and other business contacts. Data categories may include business identity and contact information, account identifiers, correspondence, documents, prompts, generated content, task and transaction references, recordings or transcripts where enabled, and technical activity records. Only categories actually necessary for the accepted scope are authorized.

14.3Sensitive or specially regulated data is excluded unless the Company expressly accepts the category, purpose and required safeguards in the service-specific schedule. The duration is the contracted service period and the agreed return or deletion period. Customer determines the lawful business purpose; Company does not obtain a general right to repurpose Customer Personal Data. The accepted schedule narrows and supplements this description for the particular deployment.

15. Schedule C. Security obligations

15.1Company will maintain risk-appropriate access controls, individual authorization, confidentiality commitments, protection of credentials and prompt removal of access when no longer needed. Access for support and administration must be restricted to the task and personnel authorized for it. Customer responsibilities for its own users and connected accounts do not replace these Company controls.

15.2Company will protect transmission and storage of Customer Personal Data using measures appropriate to the sensitivity and risk, maintain logical separation of customers’ information, manage vulnerabilities and changes, and retain sufficient security evidence to investigate relevant events. The service-specific schedule records the technical standards, systems and retention periods applicable to the deployment; this annex does not claim a certification or specific infrastructure provider.

15.3Company will maintain incident-handling procedures, appropriate personnel instruction and oversight of authorized subprocessors. Where backups form part of the contracted service, safeguards must cover access, restoration, deletion cycles and reapplication of deletion instructions following recovery. Security measures must be reviewed in light of material changes and cannot be materially reduced below the agreed level during the processing term.

15.4The measures below form the baseline security schedule for the Services. Service-specific additions and lawful variations are recorded in the accepted processing schedule. Company will not materially reduce the overall level of protection during the Agreement.