This Data Processing Addendum ("DPA") forms part of the Terms of Service between S2 Data Systems ("Processor," "we") and the customer that accepted them ("Customer," "you"). It applies when we process personal data contained in Customer Data on your behalf, and is effective from the date you accepted the Terms. If you need a signed copy, email privacy@offdataai.com.

1. Definitions

"Data Protection Laws" means all laws on the processing of personal data that apply to a party in connection with the Service, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended ("CCPA"), other US state privacy laws, and India's Digital Personal Data Protection Act, 2023. "Personal Data" means personal data in Customer Data. "Controller," "processor," "data subject," "processing," "personal data breach" and "supervisory authority" have the meanings given in the GDPR, and include the equivalent terms (such as "business," "service provider," "data fiduciary" and "data processor") in other Data Protection Laws. Other capitalized terms have the meanings in the Terms.

2. Roles and instructions

You are the controller (or a processor acting for your own controller) and we are your processor. Where you are a processor, you confirm your controller has authorized these instructions.
We process Personal Data only on your documented instructions. The Terms, this DPA and your use and configuration of the Service are your complete instructions. We will tell you if we believe an instruction breaks Data Protection Laws.
You are responsible for the lawfulness of the Personal Data you provide and for giving any notices and obtaining any consents required to process it with the Service.

3. Details of the processing

Subject matter and purpose: providing the Service, including the features you use, support, security and abuse prevention.
Duration: the term of your subscription and the deletion period in Section 9.
Nature of processing: collection, storage, analysis, transformation, querying, transmission to AI providers to generate Outputs, display, and deletion.
Data subjects: your users; and any individuals whose data is in content you upload or in systems you connect, such as your customers, employees or patients.
Categories of Personal Data: as determined by you. Typically names and contact details of your users, and whatever personal data your connected systems or uploaded files contain, which the Service mostly reads as metadata but can return as query results.
Special categories: only if you choose to connect or upload them, subject to the restrictions in the Terms. The Service lets you mark such data and mask it from agents.

4. US state law (service provider) terms

For Personal Data subject to the CCPA or similar US laws, we will not sell or share it; retain, use or disclose it for any purpose other than providing the Service to you, or outside our direct business relationship with you; or combine it with personal data we receive from others, except as those laws permit. We will comply with the obligations those laws place on service providers, provide the same level of protection they require, and tell you if we can no longer meet them. You may take reasonable steps to stop and remediate unauthorized use.

5. Confidentiality and personnel

We ensure that everyone we authorize to process Personal Data is bound by confidentiality obligations and accesses it only as needed to provide the Service.

6. Security

We maintain appropriate technical and organizational measures to protect Personal Data, including: TLS encryption in transit; encryption at rest of data source credentials and webhook URLs; logical separation of each customer's data and access checks on every request; scoped, revocable API keys; masking of personal data for AI agents unless you grant the pii:read scope; least-privilege access for our personnel; dependency and infrastructure updates; and backups. We may update these measures if the update does not lower the overall level of protection.

7. Subprocessors

You authorize us to use the subprocessors listed in our Privacy Policy and to engage new ones. We impose data protection obligations on each subprocessor that are no less protective than this DPA, and remain responsible for their performance.
We will notify you of a new subprocessor at least 15 days before it starts processing Personal Data, if you subscribe to notices by emailing privacy@offdataai.com. You may object on reasonable data protection grounds within that period; if we cannot address the objection, you may terminate the affected Service and receive a refund of prepaid fees for the remaining period.

8. Assistance, breaches and records

Data subject requests. We will tell you of any request we receive directly about Personal Data and will not respond except to direct the person to you. Taking into account the nature of the processing, we will help you respond, including through the Service's features for editing, exporting and deleting content.
Personal data breaches. We will notify you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your Personal Data, and give you the information you reasonably need to meet your own obligations. Notifying you is not an admission of fault.
Impact assessments. We will give reasonable help with data protection impact assessments and prior consultations with supervisory authorities about the Service.

9. Return and deletion

You can export your content through the Service at any time. Within 30 days after your subscription ends, we delete Personal Data, unless the law requires us to keep it. Deleted data is cleared from backups within a further 90 days.

10. Audits

On written request, no more than once a year (or after a personal data breach, or when a supervisory authority requires it), we will answer reasonable security questionnaires and give you information needed to show compliance with this DPA. If that is not enough to meet a legal requirement, you may conduct an audit at your expense, with at least 30 days' notice, during business hours, under confidentiality obligations, and without access to other customers' data.

11. International transfers

We may process Personal Data in the United States and in other countries where we or our subprocessors operate. For transfers of Personal Data from the EEA, the UK or Switzerland to a country without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable, which are incorporated by reference: clause 7 (docking) applies; clause 9 option 2 (general authorization) applies with the notice period in Section 7; clause 11's optional language does not apply; clauses 17 and 18 are governed by and subject to the courts of Ireland; and Annexes I and II are completed by Sections 3 and 6 of this DPA. For UK transfers, the UK International Data Transfer Addendum applies; for Swiss transfers, the Clauses apply with references to the GDPR read as references to the Swiss FADP. Where a recipient is certified under the EU-U.S. Data Privacy Framework (or its UK or Swiss extensions), we may rely on that instead.

12. Liability and order of precedence

Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws or the Standard Contractual Clauses do not allow it. If this DPA conflicts with the Terms, this DPA prevails for the processing of Personal Data; if it conflicts with the Standard Contractual Clauses, the Clauses prevail.

13. Contact

S2 Data Systems, 131 Continental Dr, Suite 305, Newark, DE 19713, United States. Data protection questions and notices: privacy@offdataai.com.