Modern.ai Data Processing Addendum

Published with Modern.ai SaaS Terms and Conditions v2.5, which refer to it in Sections 1.15 and 7.1.

This Modern.ai Data Processing Addendum (the "DPA") is entered into by and between Modern AI LLC, a Florida limited liability company, with offices located at 263 N.E. 61st Street, Miami, FL 33137 ("Modern.ai"), and the Customer that has Accepted the Modern.ai SaaS Terms and Conditions (the "SaaS T&Cs"). This DPA forms part of the Agreement and applies whenever Modern.ai Processes Customer Personal Data in providing the Services. This version number and effective date are printed in the document itself so that every Acceptance can be tied to the exact text Accepted.

1. Definitions

1.1 Defined Terms. Capitalized terms used but not defined in this DPA have the meanings given in the SaaS T&Cs, including "Agent", "Agent Action", "Agreement", "Connected Account", "Customer Data", "Data Privacy Laws", "Device", "Model Provider", "Order", "Output", "Personal Data", "Platform", "Process", "Sensitive Personal Information", "Services", "Third-Party Services", "Usage Data", and "User".

1.2 "Controller", "Processor", "Data Subject", and "Supervisory Authority" have the meanings given in applicable Data Privacy Laws. "Controller" includes "business", and "Processor" includes "service provider", "contractor", and "processor", as those terms are used in U.S. state Data Privacy Laws.

1.3 "CCPA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations. "Business Purpose", "Sell", "Share", and "Consumer" have the meanings given in the CCPA.

1.4 "Customer Personal Data" means Personal Data contained in Customer Data or Output that Modern.ai Processes on behalf of Customer in providing the Services, including Personal Data that an Agent reads from a Connected Account or Third-Party Service on Customer's instructions. Customer Personal Data does not include Modern.ai Controller Data.

1.5 "GDPR" means Regulation (EU) 2016/679. "UK GDPR" means the GDPR as it forms part of the law of the United Kingdom, together with the UK Data Protection Act 2018. "Swiss FADP" means the Swiss Federal Act on Data Protection.

1.6 "Modern.ai Controller Data" has the meaning set forth in Section 5.1.

1.7 "Personal Data Breach" means a breach of security of the Modern.ai Systems leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. A Personal Data Breach is a "security incident affecting Customer Data" for the purposes of Section 7.3 of the SaaS T&Cs. It does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, or failed log-in attempts.

1.8 "Restricted Transfer" means a transfer of Customer Personal Data that is subject to the GDPR, the UK GDPR, or the Swiss FADP to a country that has not been recognized as providing an adequate level of protection under those laws.

1.9 "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021. "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.

1.10 "Subprocessor" means any third party, including any Model Provider, engaged by Modern.ai that Processes Customer Personal Data in providing the Services. A Third-Party Service that Customer or a User selects, connects, or instructs an Agent to use is not a Subprocessor (see Section 10).

2. Scope and Roles

2.1 Application. This DPA applies to Customer Personal Data that Modern.ai Processes in providing the Services, in every region, and for as long as Modern.ai Processes it, including during the export and deletion periods in Section 13.

2.2 Customer as Controller. Where Customer is a Controller of Customer Personal Data, Customer appoints Modern.ai as its Processor. Customer is the Controller, and Modern.ai is the Processor, as set forth in Section 7.1 of the SaaS T&Cs.

2.3 Customer as Processor. Where Customer Processes Customer Personal Data on behalf of a third-party Controller (for example, where Customer uses the Services to serve its own clients), Customer appoints Modern.ai as its Subprocessor. In that case: (a) Customer warrants that its instructions, including the appointment of Modern.ai and Modern.ai's Subprocessors, have been authorized by the relevant Controller; (b) Customer will act as the single point of contact for, and will relay to Modern.ai, any instruction, request, or communication of the relevant Controller; (c) Modern.ai will take instructions only from Customer, unless Data Privacy Laws require otherwise; and (d) Customer is responsible for meeting its own obligations to the relevant Controller.

2.4 Modern.ai as Controller. Modern.ai is a Controller, and not a Processor, of Modern.ai Controller Data, as set forth in Section 5.

3. Processing Instructions

3.1 Documented Instructions. Modern.ai will Process Customer Personal Data only on Customer's documented instructions, unless required to do so by Law. Customer instructs Modern.ai to Process Customer Personal Data: (a) to provide, secure, and support the Services in accordance with the Agreement and the Order; (b) as initiated by Customer and its Users through the Platform, including through the configuration of Agents, Connected Accounts, Approval Gates, budgets, and limits, and through the Agent Actions that result; (c) to prevent abuse of the Services and comply with Law, as set forth in Section 7.2 of the SaaS T&Cs; and (d) as otherwise agreed by the Parties in writing. The Agreement and Customer's use and configuration of the Platform are Customer's complete instructions as of the effective date of this DPA. Additional instructions outside the scope of the Agreement require prior written agreement and may be subject to additional Fees.

3.2 Instructions Required by Law. Where Law requires Modern.ai to Process Customer Personal Data other than on Customer's instructions, Modern.ai will inform Customer of that legal requirement before Processing, unless the Law prohibits Modern.ai from doing so on important grounds of public interest.

3.3 Unlawful Instructions. Modern.ai will inform Customer promptly if, in its opinion, an instruction infringes Data Privacy Laws. Modern.ai is not obliged to review Customer's instructions for legality, and informing Customer does not make Modern.ai responsible for the instruction. Modern.ai may suspend Processing in accordance with that instruction until Customer confirms or modifies it.

3.4 Agent Actions. Customer acknowledges that Agents interpret instructions and that models are probabilistic, as set forth in Section 4.9 of the SaaS T&Cs. An Agent Action taken within the configuration set by Customer is Processing on Customer's instructions for the purposes of this DPA. Modern.ai's obligation to apply an Approval Gate, budget, or limit as configured by Customer is unaffected.

3.5 No Training. Modern.ai will not use Customer Personal Data to train, retrain, or fine-tune any artificial intelligence model made available to any person other than Customer, unless Customer opts in in writing, as set forth in Sections 7.2 and 9.5 of the SaaS T&Cs.

4. Details of Processing

4.1 Description. The subject matter, nature and purpose, duration, categories of Data Subjects, and types of Customer Personal Data Processed under this DPA are set forth in Annex I.

4.2 Duration. Modern.ai will Process Customer Personal Data for the Term and for the export and deletion periods set forth in Section 13, unless Law requires longer retention.

5. Modern.ai as Controller

5.1 Modern.ai Controller Data. Modern.ai is an independent Controller of the following Personal Data ("Modern.ai Controller Data"): (a) account, billing, and contact information of Customer and its Users that Modern.ai Processes to administer the Agreement, take payment, and communicate with Customer; (b) the Acceptance records described in Section 2.3 of the SaaS T&Cs; (c) Personal Data contained in Usage Data, to the extent Modern.ai Processes it for the purposes described in Section 9.6 of the SaaS T&Cs; and (d) Personal Data that Modern.ai Processes to secure the Modern.ai Systems, prevent fraud and abuse, and comply with Law, to the extent Modern.ai determines the purposes and means of that Processing.

5.2 Privacy Notice. Modern.ai Processes Modern.ai Controller Data in accordance with its Privacy Notice and applicable Data Privacy Laws. Modern.ai retains Acceptance records for seven (7) years after the Agreement ends.

5.3 Usage Data. Usage Data does not include the content of Customer Data or Output. Modern.ai will use and disclose Usage Data in aggregated or de-identified form only in a form that does not identify Customer, any User, or any individual. Where Modern.ai holds de-identified data, it will take reasonable measures to ensure the data cannot be associated with an individual, publicly commit to maintain and use it only in de-identified form, not attempt to re-identify it, and require any recipient to do the same.

6. Customer Obligations

6.1 Lawful Basis and Notices. Customer is responsible for: (a) the accuracy, quality, and legality of Customer Personal Data and the means by which Customer acquired it; (b) having, and documenting, a lawful basis for the Processing it instructs; (c) providing all notices and obtaining all consents required by Data Privacy Laws, including to individuals whose Personal Data an Agent reads from a Connected Account, and to individuals an Agent contacts on Customer's behalf; and (d) ensuring that its instructions comply with Data Privacy Laws. These obligations supplement Customer's warranties in Section 6.1 of the SaaS T&Cs.

6.2 Call and Meeting Transcription. Where Customer or a User uses the Platform to transcribe a call or meeting, Customer is responsible for giving every notice and obtaining every consent that Law requires from each participant before transcription begins, including under any Law that requires the consent of all parties to a communication.

6.3 Sensitive Personal Information. Customer will not submit Sensitive Personal Information to the Services except as permitted by Section 6.2 of the SaaS T&Cs or an Order. Where Sensitive Personal Information is present in content that Customer connects so that Agents may perform the Agent Actions Customer requests, Modern.ai will Process it under this DPA with the same measures as other Customer Personal Data. Modern.ai does not represent that the Services meet any sector-specific requirement for Sensitive Personal Information, including requirements applicable to health, payment card, or children's data, unless the Order expressly states otherwise.

6.4 Configuration. Customer is responsible for configuring the Platform, including Connected Accounts, Approval Gates, Unattended Mode, retention settings where offered, and User access, in a manner appropriate to the Personal Data involved, and for the security of its Access Credentials and Devices, as set forth in Sections 4.6 and 7.5 of the SaaS T&Cs.

7. Confidentiality of Personnel

7.1 Modern.ai will ensure that its personnel authorized to Process Customer Personal Data are subject to a duty of confidentiality, whether contractual or statutory, and may use Customer Personal Data only to provide, secure, and support the Services. Technical access to Customer Personal Data on shared infrastructure is as described in Section 8.3.

8. Security

8.1 Security Measures. Modern.ai will implement and maintain the technical and organizational measures set forth in Annex II, which are designed to protect Customer Personal Data against Personal Data Breaches and are appropriate, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the Processing.

8.2 Changes to Security Measures. Modern.ai may update the measures in Annex II from time to time, provided that the update does not materially reduce the overall protection of Customer Personal Data.

8.3 Shared Infrastructure. Unless the Order states that Customer is provided dedicated infrastructure, the Services may be provided on infrastructure shared with other customers of Modern.ai, as set forth in Section 3.2 of the SaaS T&Cs. As set forth in Section 7.3 of the SaaS T&Cs, Customer Personal Data on shared infrastructure is not physically or logically isolated from the data of other customers of Modern.ai, and Modern.ai's personnel, systems, and the automated Agents that operate the Platform may have technical access to it, subject to Modern.ai's access controls, Section 7 of this DPA, and Section 10 of the SaaS T&Cs. Modern.ai's commitments regarding the separation of Customer Personal Data from the data of other customers are limited to those stated in Annex II and the Order.

8.4 Customer Responsibilities. Customer is responsible for its use of the Services and for the security measures within its control, as set forth in Section 6.4, and for determining whether the measures in Annex II meet Customer's obligations under Data Privacy Laws.

9. Subprocessors

9.1 Authorization. Customer gives Modern.ai general authorization to engage Subprocessors, including Model Providers, to Process Customer Personal Data in providing the Services. The Subprocessors in use on the effective date of this DPA are listed in Annex III, and the current list is provided to Customer on written request to legal@modern.ai (the "Subprocessor List"). The Subprocessor List is Modern.ai's Confidential Information. For each Subprocessor, the Subprocessor List states its name, the Processing it performs, the location of Processing, and, for each Model Provider, the retention setting Modern.ai applies to requests it routes to that Model Provider.

9.2 Subprocessor Obligations. Before a Subprocessor Processes Customer Personal Data, Modern.ai will enter into a written agreement with it that imposes data protection obligations no less protective of Customer Personal Data than those in this DPA, to the extent applicable to the services the Subprocessor provides. Modern.ai remains responsible for the acts and omissions of each Subprocessor to the same extent as if they were the acts or omissions of Modern.ai, as set forth in Section 3.9 of the SaaS T&Cs.

9.3 Model Providers. Modern.ai routes requests to Model Providers using settings designed to limit retention and to prevent training on Customer's content, where the Model Provider offers such settings, as set forth in Section 7.6 of the SaaS T&Cs. Model Providers' retention practices are governed by their own terms. Modern.ai does not warrant that any Model Provider will not retain any content. The retention setting Modern.ai applies to each Model Provider is stated in the Subprocessor List.

9.4 Model Routing. Modern.ai sends Model Provider requests through the model router named in Annex III, which selects for each request the upstream Model Provider that serves it. Modern.ai does not select the upstream Model Provider for an individual request, and the upstream Model Providers and their locations of Processing are not fixed. Modern.ai sends each request with the routing settings stated in Annex III. Modern.ai will give notice under Section 9.5 before changing the model router or relaxing those routing settings.

9.5 Notice of New Subprocessors. Modern.ai will provide at least fourteen (14) days' notice before adding a new Subprocessor that Processes Customer Personal Data, by updating the Subprocessor List and notifying Customer by email.

9.6 Objection. Customer may object to a new Subprocessor on reasonable data protection grounds by Notice to Modern.ai within the notice period in Section 9.5. The Parties will discuss Customer's objection in good faith. Modern.ai may address the objection by making a commercially reasonable change to the Services or Customer's configuration that avoids Processing of Customer Personal Data by the new Subprocessor. If Modern.ai cannot reasonably address the objection, Customer may terminate the affected Order by Notice and will be entitled to a pro-rata refund of prepaid Fees for the remainder of the Subscription Term, as set forth in Section 3.9 of the SaaS T&Cs. If Customer does not object within the notice period, Customer is deemed to have authorized the new Subprocessor.

9.7 Emergency Replacement. Where Modern.ai must replace a Subprocessor without notice because of a reason outside its reasonable control, such as a security risk or the Subprocessor ceasing to provide its service, Modern.ai will notify Customer as soon as reasonably practicable, and Customer's objection right in Section 9.6 will apply from that notice.

10. Third-Party Services and Customer-Directed Disclosures

10.1 Not Subprocessors. Where Customer or a User connects a Third-Party Service, supplies its own Model Provider account or key, connects a model context protocol server, or instructs an Agent to read from, send to, publish to, or otherwise disclose Customer Personal Data to a Third-Party Service, that Third-Party Service is engaged by Customer and is not a Subprocessor of Modern.ai. Customer's use of it is governed by Section 3.10 of the SaaS T&Cs and the terms between Customer and its provider.

10.2 Disclosure on Instructions. A disclosure of Customer Personal Data that results from an Agent Action taken within Customer's configuration is a disclosure on Customer's instructions.

10.3 Devices. Models that run locally on a Device Process inputs on that Device unless Customer enables a capability that transmits them elsewhere, as set forth in Section 7.5 of the SaaS T&Cs.

11. Assistance

11.1 Data Subject Requests. Taking into account the nature of the Processing, Modern.ai will assist Customer by appropriate technical and organizational measures, insofar as possible, in responding to requests from Data Subjects to exercise their rights under Data Privacy Laws. Where the Platform allows Customer to access, correct, or delete Customer Personal Data itself, Customer will use those tools first. If Modern.ai receives a request directly from a Data Subject that identifies Customer, Modern.ai will forward it to Customer without undue delay and will not respond to it except to direct the Data Subject to Customer, unless Law requires otherwise.

11.2 Assessments and Consultations. Taking into account the nature of the Processing and the information available to Modern.ai, Modern.ai will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with Supervisory Authorities that Data Privacy Laws require of Customer in relation to the Services, to the extent Customer does not otherwise have access to the relevant information.

11.3 Cost. Modern.ai provides the assistance in this Section 11 without additional charge, except that Modern.ai may charge a reasonable fee, agreed in advance, where a request is manifestly unfounded, excessive, or requires effort disproportionate to the Services.

12. Personal Data Breach

12.1 Notification. Modern.ai will notify Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach, consistent with Section 7.3 of the SaaS T&Cs. Modern.ai will notify the administrators designated by Customer and the contact set forth in the Order.

12.2 Content of Notice. To the extent the information is available, Modern.ai's notice will describe the nature of the Personal Data Breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it and mitigate its effects, and will name a contact for further information. Where not all information is available at once, Modern.ai will provide it in phases without undue further delay.

12.3 Response. Modern.ai will take reasonable steps to contain, investigate, and mitigate the Personal Data Breach, and will provide reasonable cooperation to Customer to enable Customer to meet its own obligations to notify Supervisory Authorities, Data Subjects, and others.

12.4 No Admission. Modern.ai's notice of, or response to, a Personal Data Breach is not an acknowledgement of fault or liability.

12.5 Customer Notifications. Customer is responsible for any notification to Supervisory Authorities, Data Subjects, or others that Data Privacy Laws require of Customer as Controller. Modern.ai will not notify them on Customer's behalf unless Customer instructs it to do so in writing or Law requires it.

13. Retention, Return and Deletion

13.1 Activity Records. The Platform records Agent conversations, tool calls, and Agent Actions taken under Customer's account, as described in Section 7.4 of the SaaS T&Cs. During the Term, Modern.ai retains such records until Customer deletes them, unless the Order provides otherwise.

13.2 Call and Meeting Transcripts. Where Customer uses the feature, the Platform produces transcripts of calls and meetings. Modern.ai does not store call or meeting audio. Modern.ai retains transcripts on the same basis as other activity records under Section 13.1.

13.3 Other Customer Personal Data. Modern.ai retains other Customer Personal Data for the Term, until Customer deletes it, or as the Order specifies.

13.4 Export After Termination. For thirty (30) days after termination or expiration of the Agreement, Customer may request an export of its Customer Data and Output, including Customer Personal Data, by email to support@modern.ai, and Modern.ai will provide the export in a commonly used format, as set forth in Section 14.6 of the SaaS T&Cs.

13.5 Deletion After Termination. Following the export period, Modern.ai will delete Customer Personal Data from its active systems within thirty (30) days and from its backups within ninety (90) days, and will confirm such deletion in writing on request, as set forth in Section 14.6 of the SaaS T&Cs. Backups are whole-system archives, so Customer Personal Data is removed from backups as each backup expires under Annex II, paragraph 6. Until deletion from backups, Modern.ai will not restore Customer Personal Data from backups except as needed to recover from a failure of the Modern.ai Systems, and this DPA continues to apply to it.

13.6 Retention Required by Law. Section 13.5 does not apply to Customer Personal Data that Law requires Modern.ai to retain. Modern.ai will retain such data only for the period and purpose required, will continue to protect it under this DPA, and will not otherwise Process it.

13.7 Subprocessors and Model Providers. Modern.ai will require each Subprocessor to delete Customer Personal Data in accordance with its agreement with Modern.ai. Content retained by a Model Provider under its own terms is addressed in Section 9.3.

14. Audits and Information

14.1 Information. Modern.ai will make available to Customer, on written request, the information reasonably necessary to demonstrate Modern.ai's compliance with this DPA, including written responses to reasonable security and privacy questionnaires and, where Modern.ai holds them, summaries of third-party audit or assessment reports. Modern.ai does not represent that it holds any certification or third-party attestation unless Annex II states so.

14.2 Audits. Where the information provided under Section 14.1 is not sufficient to demonstrate compliance, or where a Supervisory Authority or Law requires it, Customer, or an independent auditor appointed by Customer that is not a competitor of Modern.ai and is bound by confidentiality, may audit Modern.ai's compliance with this DPA, including by inspection, subject to the following: (a) Customer gives at least thirty (30) days' Notice, unless a Supervisory Authority requires a shorter period or the audit follows a Personal Data Breach; (b) audits take place no more than once in any twelve (12) month period, except following a Personal Data Breach or where a Supervisory Authority requires it; (c) the Parties agree the scope, timing, and duration in advance; (d) the audit takes place during business hours and does not unreasonably disrupt Modern.ai's operations; (e) the audit does not give access to the data of any other customer of Modern.ai, or to information whose disclosure would compromise the security of the Modern.ai Systems; and (f) Customer bears its own costs and pays Modern.ai's reasonable costs of supporting the audit, unless the audit reveals a material breach of this DPA by Modern.ai.

14.3 Confidentiality. All information provided or obtained under this Section 14 is Modern.ai's Confidential Information.

15. International Transfers

15.1 Location of Processing. Modern.ai hosts the Services in the Google Cloud region us-central1 (Iowa, United States). Modern.ai and its Subprocessors may Process Customer Personal Data in the United States and in the other locations set forth in Annex III. Model requests may be Processed outside the United States, as set forth in Section 9.4.

15.2 EU Transfers. For a Restricted Transfer subject to the GDPR from Customer to Modern.ai, the Parties incorporate the Standard Contractual Clauses into this DPA, as follows: (a) Module Two (controller to processor) applies where Customer is a Controller, and Module Three (processor to processor) applies where Customer is a Processor; (b) Customer is the data exporter and Modern.ai is the data importer; (c) the elections set forth in Annex IV apply; and (d) Annexes I, II, and III of this DPA complete Annexes I, II, and III of the SCCs.

15.3 UK Transfers. For a Restricted Transfer subject to the UK GDPR, the SCCs apply as set forth in Section 15.2, as amended by the UK Addendum, which the Parties incorporate into this DPA. Table 1 to Table 3 of the UK Addendum are completed by Annexes I to IV of this DPA, and for Table 4, neither Party may end the UK Addendum as set out in its Section 19.

15.4 Swiss Transfers. For a Restricted Transfer subject to the Swiss FADP, the SCCs apply as set forth in Section 15.2, with references to the GDPR read as references to the Swiss FADP, the Swiss Federal Data Protection and Information Commissioner as the competent Supervisory Authority, and the term "member state" not interpreted so as to exclude Data Subjects in Switzerland from bringing claims in their place of habitual residence.

15.5 Onward Transfers. Modern.ai will ensure that any onward Restricted Transfer to a Subprocessor is made under a transfer mechanism recognized by the applicable Data Privacy Laws.

15.6 Alternative Mechanism. If a transfer mechanism relied on under this Section 15 is invalidated or replaced, the Parties will cooperate in good faith to adopt a valid alternative, which Modern.ai may implement by updating this DPA in accordance with Section 19.3.

15.7 Conflict. If the SCCs or the UK Addendum conflict with this DPA or the Agreement, the SCCs or the UK Addendum prevail to the extent of the conflict.

16. U.S. State Data Privacy Laws

16.1 Service Provider and Contractor Terms. Where the CCPA applies, Modern.ai is a service provider or contractor to Customer, and Customer discloses Customer Personal Data to Modern.ai only for the limited and specified Business Purposes of providing, securing, and supporting the Services as described in the Agreement and Annex I. Modern.ai will not: (a) Sell or Share Customer Personal Data; (b) retain, use, or disclose Customer Personal Data for any purpose, including any commercial purpose, other than those Business Purposes or as otherwise permitted by the CCPA; (c) retain, use, or disclose Customer Personal Data outside the direct business relationship between Modern.ai and Customer; or (d) combine Customer Personal Data with Personal Data it receives from or on behalf of another person, or collects from its own interactions with a Consumer, except as permitted by the CCPA.

16.2 Compliance and Notice. Modern.ai will comply with its obligations under the CCPA and provide the same level of privacy protection as the CCPA requires of businesses. Modern.ai will notify Customer if it determines that it can no longer meet its obligations under the CCPA.

16.3 Customer Rights. Customer may take reasonable and appropriate steps to ensure that Modern.ai uses Customer Personal Data consistently with Customer's obligations under the CCPA, including through the measures in Section 14, and, on notice, to stop and remediate any unauthorized use of Customer Personal Data.

16.4 Other U.S. States. Where the Colorado Privacy Act, the Virginia Consumer Data Protection Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Utah Consumer Privacy Act, or any other U.S. state Data Privacy Law applies, Modern.ai is a Processor and will: (a) Process Customer Personal Data only on Customer's instructions as set forth in Section 3; (b) ensure that each person Processing Customer Personal Data is subject to a duty of confidentiality as set forth in Section 7; (c) engage Subprocessors only under a written contract as set forth in Section 9; (d) delete or return Customer Personal Data at the end of the Services as set forth in Section 13, unless Law requires retention; (e) make available the information necessary to demonstrate compliance and allow assessments as set forth in Section 14; and (f) assist Customer with its obligations as set forth in Sections 11 and 12.

16.5 Certification. Modern.ai certifies that it understands and will comply with the restrictions in this Section 16.

17. Government Requests

17.1 If a public authority requests access to Customer Personal Data, Modern.ai will, unless prohibited by Law: (a) attempt to redirect the authority to request the data directly from Customer; (b) promptly notify Customer and provide a copy of the request; and (c) disclose only the minimum data necessary to comply with a legally binding request, after assessing its lawfulness and, where Modern.ai reasonably considers it unlawful, challenging it to the extent reasonable. Section 10.4 of the SaaS T&Cs also applies.

18. Liability

18.1 Limitations Apply. Each Party's liability arising out of or related to this DPA, including under the SCCs and the UK Addendum to the extent permitted by Law, is subject to Section 13 of the SaaS T&Cs. Modern.ai's breach of this DPA is an enhanced claim under Section 13.4(C) of the SaaS T&Cs, subject to the limit set forth in that Section. Nothing in this DPA changes the allocation of liability in Section 13 of the SaaS T&Cs.

18.2 Customer Indemnity. Customer's obligations under Section 12.2 of the SaaS T&Cs, including with respect to any Action by an individual whose Personal Data is Processed, apply to Processing under this DPA and are excluded claims under Section 13.3(D) of the SaaS T&Cs.

18.3 Data Subject Rights. Nothing in this Section 18 limits any right that a Data Subject has directly against either Party under Data Privacy Laws or the SCCs.

19. General

19.1 Term. This DPA takes effect when Customer Accepts the SaaS T&Cs and remains in effect for as long as Modern.ai Processes Customer Personal Data, notwithstanding the expiration or termination of the Agreement.

19.2 Order of Precedence. In the event of a conflict with respect to the Processing of Personal Data: (a) the SCCs and the UK Addendum, where they apply, prevail; then (b) this DPA; then (c) the remainder of the Agreement, in the order set forth in Section 2.5 of the SaaS T&Cs. An Order signed by both Parties prevails over this DPA only where it expressly states that it overrides this DPA.

19.3 Updates. Modern.ai may update this DPA by publishing a new version with a new version number and effective date, in accordance with Section 15.12 of the SaaS T&Cs. Modern.ai will not make an update that materially reduces the protection of Customer Personal Data during Customer's then-current Subscription Term, except as required by Law or a Supervisory Authority. Updates to the Subprocessor List are made under Section 9 and are not updates to this DPA. Each published version will remain available at its own address.

19.4 Governing Law. This DPA is governed by the law that governs the Agreement under Section 15.7 of the SaaS T&Cs, except that the SCCs and the UK Addendum are governed by the law stated in Annex IV.

19.5 Notices. Notices under this DPA are given in accordance with Section 15.3 of the SaaS T&Cs. Privacy and data protection inquiries may also be sent to legal@modern.ai. Formal legal notices should be sent to legal@modern.ai and to Modern AI LLC, 263 N.E. 61st Street, Miami, FL 33137, Attn: Legal.

---

Annex I: Details of Processing

A. List of Parties

Data exporter: Customer, as identified in the Order or the Acceptance record. Contact details: as set forth in the Order or Customer's account. Activities relevant to the transfer: use of the Services under the Agreement. Role: Controller (or, where Section 2.3 applies, Processor).

Data importer: Modern AI LLC, 263 N.E. 61st Street, Miami, FL 33137. Contact: Legal, legal@modern.ai. Activities relevant to the transfer: provision of the Services under the Agreement. Role: Processor (or, where Section 2.3 applies, Subprocessor). Modern.ai has not appointed a representative in the European Union or the United Kingdom.

Signature and date: each Party signs this Annex by its Acceptance of the SaaS T&Cs under Section 2.1 of the SaaS T&Cs.

B. Description of Processing

Categories of Data Subjects. As determined by Customer through its use of the Services, which may include: (a) Customer's Users, personnel, and contractors; (b) Customer's customers, prospects, suppliers, and other business contacts; (c) individuals whose Personal Data appears in Connected Accounts, including senders and recipients of email and messages, calendar invitees, and individuals named in documents; (d) participants in calls and meetings that Customer transcribes using the Platform; (e) recipients of communications that Agents send on Customer's behalf; and (f) individuals whose Personal Data an Agent reads from a website or Third-Party Service on Customer's instructions.

Categories of Personal Data. As determined by Customer through its use of the Services, which may include: (a) identification and contact details; (b) professional and employment information; (c) the content of email, messages, calendar entries, documents, and files in Connected Accounts; (d) instructions, prompts, and files that Customer and Users submit; (e) Output; (f) Agent conversations, tool calls, and records of Agent Actions; (g) transcripts of calls and meetings; (h) screen, file, clipboard, and browser-session content from a Device where Customer enables those capabilities; and (i) transaction and order information relating to Customer's own customers.

Sensitive data. Not intended to be Processed. Customer will not submit Sensitive Personal Information except as permitted by Section 6.2 of the SaaS T&Cs. Where it is present incidentally in connected content, it is protected by the measures in Annex II.

Frequency of transfer. Continuous, for the duration of the Services.

Nature of Processing. Hosting, storage, transmission, and retrieval of Customer Data; Processing of instructions and content by Agents and by models supplied by Model Providers to produce Output and take Agent Actions; reading from and writing to Connected Accounts and Third-Party Services on Customer's instructions; transcription where Customer uses the feature; maintenance of activity records; support; security monitoring; backup; and deletion.

Purpose of Processing. To provide, secure, and support the Services for Customer in accordance with the Agreement and Customer's instructions under Section 3.

Duration and retention. For the Term and the export and deletion periods in Section 13. Activity records and transcripts are retained until Customer deletes them, unless the Order provides otherwise. No call or meeting audio is stored.

Transfers to Subprocessors. The subject matter, nature, and duration of Processing by each Subprocessor are set forth in Annex III.

C. Competent Supervisory Authority

Where the data exporter is established in a Member State of the European Union, the supervisory authority of that Member State. Where the data exporter is not established in the European Union but falls within the territorial scope of the GDPR and has appointed a representative, the supervisory authority of the Member State in which the representative is established. Where the data exporter is not established in the European Union and has not appointed a representative, the supervisory authority of Ireland. For Restricted Transfers subject to the UK GDPR, the UK Information Commissioner. For Restricted Transfers subject to the Swiss FADP, the Swiss Federal Data Protection and Information Commissioner.

---

Annex II: Technical and Organizational Security Measures

1. Encryption. Customer Data is encrypted in transit, and at rest by Modern.ai's hosting provider (Google Cloud) using its default encryption. Backups are stored in the same encrypted environment. The Device application encrypts stored sign-in credentials using the operating system's secure storage; other locally cached data is protected by the security of the Device.

2. Access Control. Access to the Modern.ai Systems is restricted to Modern.ai personnel, Subprocessors, and the automated Agents that operate the Platform. Administrative sign-in to Modern.ai's servers is controlled through Google Cloud identity and access permissions. On shared infrastructure, technical access to Customer Data is as described in Section 8.3.

3. Separation of Customers. On shared infrastructure, Customer Data is not physically or logically isolated from the data of other customers, as set forth in Section 8.3 and Section 7.3 of the SaaS T&Cs. Dedicated infrastructure is available only where the Order states it.

4. Logging and Monitoring. The Platform keeps an audit log of administrative actions and Agent activity, available to Customer's designated administrators. Approval decisions are logged.

5. Incident Response. Modern.ai responds to Personal Data Breaches and notifies Customer as set forth in Section 12.

6. Backup, Recovery, and Deletion. A full backup is taken daily and kept for at least fourteen (14) days. Backups are whole-system archives stored in Modern.ai's hosting environment. Customer Data is removed from backups as they expire, within the period in Section 13.5.

7. Personnel. Personnel authorized to Process Customer Personal Data are bound by confidentiality, as set forth in Section 7.

8. Code Execution, Browser, and Device Confinement. Browser capabilities check each web address requested, refuse internal and private network addresses, and re-check each redirect. Code execution is not technically isolated on shared infrastructure; it is subject to the Approval Gates in Section 4.4 of the SaaS T&Cs, as set forth in Section 4.7 of the SaaS T&Cs.

9. Subprocessor Terms. Subprocessors are engaged under written terms as set forth in Section 9.2.

10. Certifications and Attestations. None.

Security contact: legal@modern.ai.

---

Annex III: Subprocessors

The Subprocessors in use on the effective date of this DPA are:

Speech-to-text transcription and search run on open-source models that Modern.ai operates on its own infrastructure in Google Cloud, and involve no further Subprocessor. The current list is provided as set forth in Section 9.1 and changes in accordance with Section 9.

---

Annex IV: Elections Under the Standard Contractual Clauses and UK Addendum

1. Clause 7 (Docking clause): applies.

2. Clause 9(a) (Use of sub-processors): Option 2, general written authorization, with the notice period in Section 9.5.

3. Clause 11(a) (Redress): the optional language does not apply.

4. Clause 13 (Supervision): as set forth in Annex I.C.

5. Clause 17 (Governing law): the law of Ireland.

6. Clause 18 (Choice of forum and jurisdiction): the courts of Ireland.

7. Clause 8.5 and Clause 16(d) (Deletion certification): certification of deletion is provided on request, as set forth in Section 13.5.

8. Clause 8.9 (Audits): audits are conducted as set forth in Section 14, to the extent consistent with the SCCs.

9. UK Addendum: governed by the laws of England and Wales; Table 4 as set forth in Section 15.3.

---

Modern.ai Data Processing Addendum · Version 1.2 · Effective 1 November 2026