Data Processing Addendum

This Data Processing Addendum (the “DPA”) forms part of the agreement between AIScreen Inc. (“AIScreen” or “Processor”) and the undersigned customer (“Customer” or “Controller”) for the provision of digital signage software services (“Services”). This DPA is effective as of the date of the last signature below and is incorporated into the Services agreement (“Agreement”) between the parties. The purpose of this DPA is to ensure that Personal Data (defined below) is processed in accordance with applicable U.S. data protection laws. In the event of any conflict between this DPA and the Agreement with respect to processing of Personal Data, the terms of this DPA shall control. All other terms of the Agreement remain in full force and effect.

1. Definitions

For purposes of this DPA, the following terms have the meanings set out below. Capitalized terms not defined in this DPA shall have the meaning set forth in the Agreement.

“Personal Data” (or “Personal Information”) means any information that identifies, relates to, describes, or can reasonably be linked to an identified or identifiable natural person or household. This includes, but is not limited to, identifiers (such as name, email, phone number), contact details, online identifiers (IP address or device ID), profile or account information, content or media containing personal identifiers, and usage or behavioral data.
“Processing” (and “Process”) means any operation or set of operations performed on Personal Data, whether by automated means or otherwise, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, deletion, or destruction of Personal Data.
“Data Controller” (or “Controller”) means the entity or person which determines the purposes and means of the processing of Personal Data. For purposes of this DPA, the Customer is the Data Controller. (Under the California Consumer Privacy Act (CCPA), the Customer may be referred to as the “Business.”)
“Data Processor” (or “Processor”) means the entity which Processes Personal Data on behalf of the Data Controller. For purposes of this DPA, AIScreen is the Data Processor. (Under the CCPA, AIScreen acts as a “Service Provider” processing Personal Data on behalf of the Customer.)
“Data Protection Laws” means all applicable U.S. federal and state laws and regulations relating to privacy, data protection, and the Processing of Personal Data. This includes, without limitation, the California Consumer Privacy Act of 2018 (Cal. Civ. Code §1798.100 et seq.), as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”), and any other state privacy laws that apply to the Processing of Personal Data under this DPA (such as Virginia’s Consumer Data Protection Act, Colorado Privacy Act, etc.), as well as applicable federal data protection laws.
“Consumer” means an individual person who is a resident of a U.S. state and whose Personal Data is Processed. (This term has the meaning given in the CCPA and similar state laws. For purposes of this DPA, a Consumer may be referred to as a “Data Subject.”)
“Service Provider” means an entity that receives Personal Data from a business (Controller) for a business purpose pursuant to a written contract and is prohibited from retaining, using, or disclosing the Personal Data for any purpose other than performing the services specified in the contract. In the context of this DPA, AIScreen is acting as a Service Provider to Customer as defined by the CCPA and similar laws.
“Sub-Processor” means any third-party service provider, subcontractor, or affiliate engaged by AIScreen to assist in Processing Personal Data on behalf of the Customer, or to provide a part of the Services.
“Security Incident” (or “Personal Data Breach”) means any confirmed unauthorized or unlawful access to, acquisition of, or disclosure of Personal Data, or any accidental loss, alteration, or destruction of Personal Data, that occurs on systems managed or controlled by Processor or its Sub-Processors. A Security Incident does not include unsuccessful attempts or activities that do not compromise the security of Personal Data (for example, unsuccessful login attempts, pings, or similar network scans).

2. Roles of the Parties

2.1 Controller and Processor: The parties acknowledge and agree that, as between the parties, Customer is the Data Controller (or “Business” under CCPA) and AIScreen is the Data Processor (or “Service Provider” under CCPA) with respect to any Personal Data processed under this DPA. Customer, as Controller, determines the purposes and means of the Processing of Personal Data. AIScreen, as Processor, will Process Personal Data only on behalf of and in accordance with Customer’s documented instructions and this DPA.

2.2 Compliance with Laws: Each party shall comply with its respective obligations under applicable Data Protection Laws in the performance of this DPA. Customer is responsible for ensuring that Customer has provided any necessary notices and obtained any required consents or legal bases for the Processing of Personal Data by AIScreen in connection with the Services. AIScreen shall Process Personal Data in compliance with the requirements set forth in CCPA and other applicable laws for Service Providers/Data Processors, including without limitation not Selling or Sharing Personal Data (as defined under CCPA) and not Processing Personal Data for any purposes other than those specified by Customer and this DPA.

2.3 Instructions: Processor will Process Personal Data only on Customer’s instructions. The Agreement (including this DPA) constitutes Customer’s complete and final instructions to AIScreen for the Processing of Personal Data. Any additional or alternate instructions must be agreed upon in writing by the parties. Processor shall promptly inform Customer if, in its opinion, an instruction violates applicable law or is not feasible, and the parties will cooperate in good faith to resolve the issue. If Processor is ever required by applicable law or legal process to Process Personal Data other than as instructed by Customer, Processor will inform Customer of that legal requirement (unless prohibited from doing so by law) and will limit the Processing to what is legally required.

3. Scope, Nature, Purpose, and Duration of Processing

3.1 Subject-Matter and Purpose: The subject-matter of Processing under this DPA is the Personal Data provided by or on behalf of Customer to AIScreen, or collected by AIScreen on behalf of Customer, in order for AIScreen to provide the agreed-upon digital signage Services to Customer. The purpose of the Processing is strictly limited to enabling and improving the Services, including displaying content on digital signage, managing Customer’s content and accounts, monitoring system usage, and providing related support and technical maintenance. AIScreen shall not Process the Personal Data for any purpose other than as necessary to provide the Services in accordance with the Agreement and Customer’s instructions, or as required by law.

3.2 Nature of Processing: The Processing of Personal Data will involve various operations depending on how Customer uses the Services. This may include collection, storage on cloud-based servers, organization of data (e.g. in a content management system), retrieval and display of content, analytics on usage (such as logging when and where content is shown), and deletion or modification of content as instructed by Customer. Processor may also transmit Personal Data to Customer and authorized end-users (for example, delivering reports or enabling access to manage content), and otherwise use Personal Data as needed to fulfill its obligations as a service provider.

3.3 Categories of Personal Data: The categories of Personal Data subject to Processing under this DPA include, but are not limited to:

Identification and Contact Data: e.g. full name, business or personal contact information (email address, telephone number, mailing address), employer or company name, job title or role of Customer’s authorized users.
Account and Authentication Data: e.g. usernames, passwords or password hashes, account IDs, profile information, and preferences for users authorized by Customer to access the AIScreen platform.
Media and Content Data: any personal information included in the digital content that Customer uploads or creates using the Services. This can include photographs, videos, audio recordings, graphics or messages that contain images or names of individuals, metadata of files, or any other Personal Data embedded in content to be displayed on screens.
Usage and Technical Data: e.g. logs of user actions within the AIScreen platform (such as content scheduling or updates made by Customer’s users), device information (such as device identifiers or player IDs for the screens, IP addresses, and general location of devices), analytics data on content display times and frequencies, and other behavioral data related to the usage of the Services by Customer or its end-users.
Support and Communications Data: any Personal Data contained in communications between Customer and AIScreen regarding support or inquiries (for example, an email address and name in a support ticket, or information provided during a help chat or phone call).
Other Categories as Needed: any other Personal Data that Customer chooses to provide to AIScreen or that is Processed on Customer’s behalf in the course of using the Services. Customer should avoid transmitting any sensitive personal information (such as Social Security numbers, financial account details, health or medical information, etc.) via the Services unless specifically necessary, but to the extent any such data is provided and processed, it will be protected under this DPA as Personal Data.

3.4 Categories of Data Subjects: Data Subjects (or “Consumers”) whose Personal Data may be processed under this DPA include the following categories of individuals:

Customer’s Personnel: Individuals who are employees, contractors, or agents of Customer that are authorized to use the AIScreen Services or whose information is uploaded into the Services. This includes administrators of Customer’s AIScreen account and other end-users who log in to manage or upload content.
Customer’s Clients or End Users: Individuals to whom Customer wishes to display information using the Services, or whose personal information may be included in the content managed through AIScreen. For example, if Customer uses AIScreen to display employee announcements, the employees featured in those announcements are Data Subjects; if Customer is a school, students or staff whose information appears on digital signage are Data Subjects.
Individuals Communicating with Customer via the Service: If the Service includes interactive features (such as forms or sign-ups on a digital display) or if viewers provide feedback or interact with content that collects data (to the extent such features are offered and used by Customer), those individuals may also be Data Subjects.
Website Visitors or Users (if applicable): In some cases, Personal Data might be collected about individuals who interact with content that is part of the Services (for example, if AIScreen collects analytics on who viewed certain content via web links or QR codes displayed on signage). Such individuals would also be Data Subjects under this DPA.

Customer shall ensure that the Personal Data provided to AIScreen for processing pertains to the categories listed above and is collected and disclosed to Processor in compliance with Data Protection Laws.

3.5 Duration of Processing: The duration of Processing under this DPA corresponds to the duration of the Agreement and any post-termination period during which AIScreen continues to provide any Services to Customer or retains Personal Data on behalf of Customer. Processor will Process Personal Data only for as long as the Services are provided to Customer, plus any additional retention period required by law or agreed upon in writing, or as necessary for Processor to comply with its legal obligations. Upon termination or expiration of the Agreement, Processing of Personal Data shall cease as provided in Section 9 (Return or Deletion of Data), subject to any legal obligation to retain certain data for a longer period.

4. Data Subject Rights and Requests

4.1 Consumer/Data Subject Rights: Customer is responsible for handling any requests from individuals (Data Subjects or Consumers) relating to their Personal Data processed under this DPA, including but not limited to requests for access to their data, correction or rectification of inaccurate data, deletion or erasure of data, restriction of processing, data portability, or to opt-out of any sale or certain processing of their data (to the extent such rights are provided by applicable law). Applicable laws such as the CCPA provide Consumers with specific rights (e.g., the right to know/access, the right to delete, the right to opt-out of sale of Personal Information, and the right to non-discrimination for exercising such rights). Other state laws may grant additional rights such as the right to correct inaccurate information or to opt out of targeted advertising or profiling. It is Customer’s duty as Controller/Business to determine what rights apply and to comply with such requests.

4.2 Processor Assistance: AIScreen, as Processor, shall assist Customer in fulfilling its obligation to respond to Data Subject requests under applicable Data Protection Laws. Taking into account the nature of the Processing and the information available to Processor, AIScreen will reasonably cooperate with and assist Customer by:

Providing available information or tooling that allows Customer to appropriately respond to a Data Subject’s request (for example, enabling Customer to search, retrieve, or delete specific Personal Data within the AIScreen platform).
Complying with Customer’s written requests or instructions to correct, delete, or block access to specific Personal Data, or to export a copy of Personal Data, as required to fulfill a verified Data Subject request, provided such instructions are technically feasible and legally permissible.
If applicable law (such as CCPA) requires the Processor to comply directly with certain Consumer requests as a Service Provider, AIScreen will take necessary action to comply (for example, honoring an opt-out preference signal as required by law in contexts where AIScreen controls the processing).

4.3 Notification of Requests: If AIScreen directly receives any request from an individual seeking to exercise any Data Subject/Consumer right with respect to Personal Data that AIScreen processes on Customer’s behalf, AIScreen will (to the extent legally permitted) promptly forward the request to Customer. Processor shall not respond to any such direct request on its own except to acknowledge receipt or as required by law (for example, to inform the requesting individual that the request has been forwarded to the relevant Controller). Customer will then be responsible for handling the request. In the event Processor is legally required to respond to the individual (such as under certain state laws where a Service Provider may be obligated to comply with opt-out signals), Processor will notify Customer of that obligation and coordinate appropriate handling to the extent allowed.

4.4 Limitations: Processor’s obligation to assist with Data Subject requests is contingent on Customer’s timely written request for assistance and sufficient detail for Processor to locate the relevant Personal Data. Processor may charge a reasonable fee for assistance to the extent permitted by law if the request is manifestly unfounded, excessive, or overly repetitive, or if significant resources are required by Processor to fulfill the assistance (in which case Processor will inform Customer of the fee and reasoning in advance). Both parties shall ensure that proper authentication of a Data Subject request is performed as required by law (for example, verifying the identity of the requestor) – Customer is primarily responsible for this verification in its role as Controller.

5. Processor’s Data Security Measures

5.1 Security Program: AIScreen shall implement and maintain appropriate technical and organizational security measures to protect Personal Data from unauthorized or unlawful Processing and from accidental loss, destruction, damage, or disclosure. These measures will be appropriate to the nature of the Personal Data and the risks associated with its processing, and shall at a minimum meet the standards required by applicable Data Protection Laws and prevailing industry practices for data security. AIScreen’s security program includes administrative, physical, and technical safeguards designed to ensure the confidentiality, integrity, and availability of Personal Data.

5.2 Specific Security Measures: Without limiting the generality of the foregoing, Processor agrees to at least the following security measures:

Access Control: Ensure that access to Personal Data is strictly limited to authorized personnel who have a legitimate need to access the data for purposes of providing the Services. This includes using authentication controls (such as unique user IDs and strong passwords, multi-factor authentication where available) and access privilege restrictions to prevent unauthorized access. Processor will promptly deactivate or revoke access credentials of any personnel who no longer require access.
Confidentiality Training and Commitment: Ensure that all employees or agents authorized to process Personal Data are bound by a duty of confidentiality. AIScreen will train its personnel on their privacy and security responsibilities and will impose appropriate contractual obligations (including confidentiality agreements) on employees and subcontractors who have access to Personal Data.
Encryption and Protection of Data: Use encryption or other security technologies to protect Personal Data in transit over public networks and, where feasible, at rest. For example, transmit data over HTTPS or other encrypted protocols. Store Personal Data in secure environments and, if stored on portable media or devices, ensure such data is encrypted or otherwise secured. Implement measures to protect against unauthorized access to network and database environments where Personal Data is stored (such as firewalls, intrusion detection systems, and network segmentation as appropriate).
Physical Security: Maintain physical security controls at facilities (or those of its hosting providers) where Personal Data is stored, such as data centers. This includes access badges or biometric controls, surveillance, and other measures to prevent unauthorized physical access to servers or infrastructure that contain Personal Data.
Vulnerability Management: Regularly monitor and assess the security of Processor’s systems and services. This includes applying security patches and updates in a timely manner, conducting periodic vulnerability scans or penetration testing, and monitoring systems for indications of unauthorized access or anomalous activity. Identified security issues will be promptly addressed in accordance with Processor’s incident response policies.
Backup and Recovery: Maintain backup procedures and disaster recovery capabilities to ensure availability of Personal Data and resilience of the Services. Backups containing Personal Data will be protected with security measures similar to live data. In the event of an incident affecting availability, Processor will work to restore access to Personal Data in a timely manner.

5.3 Security Assessments and Certifications: Upon Customer’s written request, AIScreen will provide Customer with a high-level overview of its security measures (such as summaries of any third-party security audits or certifications, e.g. SOC 2 or ISO 27001, if available) to help Customer evaluate Processor’s compliance with this DPA. Customer acknowledges that detailed security reports may contain sensitive proprietary information of AIScreen, and AIScreen reserves the right to require a nondisclosure agreement or to provide summaries in lieu of full reports where appropriate for security and confidentiality.

5.4 No Diminishment of Protection: Processor will not materially decrease the overall security of the Services or the protection provided for Personal Data during the term of the Agreement. Customer is responsible for using the Services in a secure manner, including maintaining the security of Customer’s account credentials and configuring the Services appropriately. Customer shall promptly notify AIScreen if it suspects any unauthorized access to its account or to Personal Data within the Services so that both parties may collaborate on remediation.

6. Sub-Processor Management

6.1 Use of Sub-Processors: Customer provides general authorization for AIScreen to engage Sub-Processors to assist in the Processing of Personal Data for purposes of providing the Services. Sub-Processors may include AIScreen’s affiliates and third-party service providers (for example, data center operators, cloud hosting providers, software tools used in service delivery, support ticketing systems, etc.) that perform functions on AIScreen’s behalf. A placeholder list of current Sub-Processors is provided in Appendix 1 to this DPA (to be updated from time to time as described below).

6.2 Obligations of Sub-Processors: AIScreen shall ensure that any Sub-Processor it engages to process Personal Data on Customer’s behalf is bound by a written agreement imposing data protection obligations substantially equivalent to those in this DPA. This includes obligations to Process Personal Data only for the limited and specified purposes of providing the Services to Customer, to maintain the confidentiality and security of the Personal Data, to notify AIScreen of any Security Incidents, and to otherwise meet the requirements of applicable Data Protection Laws (including qualifying as a Service Provider under CCPA where applicable). AIScreen remains fully liable to Customer for the performance of any Sub-Processor that processes Personal Data under this DPA, and shall be responsible for any acts or omissions of its Sub-Processors that cause AIScreen to breach any of its obligations under this DPA.

6.3 Notice and Updates to Sub-Processor List: AIScreen will maintain an updated list of Sub-Processors involved in the Processing of Personal Data. AIScreen shall make this list available to Customer upon request (for example, by providing a URL or document listing current Sub-Processors and their functions). AIScreen will provide Customer with reasonable advance notice (such as via email or through the Customer’s account) of any intended additions or replacements of Sub-Processors that will Process Personal Data under this DPA. In such notice, AIScreen will describe the new Sub-Processor’s identity and location and the type of processing they will perform. Except in cases of emergency replacements or required additions to maintain service continuity, AIScreen will endeavor to give at least 30 days’ notice before the new Sub-Processor begins processing any Personal Data.

6.4 Objection Right: If Customer has a reasonable basis to object to AIScreen’s use of a new Sub-Processor (for example, if the Customer can demonstrate that the Sub-Processor’s processing of Personal Data would cause Customer to violate applicable Data Protection Laws or would present an undue security risk), Customer must notify AIScreen in writing within 15 days after receipt of the notice described in Section 6.3. The parties will then discuss Customer’s concerns in good faith with the aim of finding a mutually acceptable resolution. This may include AIScreen providing additional information or security assurances regarding the Sub-Processor, or in exceptional cases, exploring alternative solutions. If the parties cannot reach a resolution and AIScreen elects to proceed with the engagement of the Sub-Processor, Customer may have the right to terminate the portion of the Services that involve the objectionable Sub-Processor. In the event Customer terminates the affected Services for this reason, AIScreen will provide a pro-rated refund of any prepaid fees for the terminated portion of the Services. Customer agrees that such termination and refund shall be its sole and exclusive remedy if it objects to any new Sub-Processor.

6.5 Emergency Sub-Processor Replacement: Notwithstanding the foregoing, Customer agrees that AIScreen may replace or add a Sub-Processor on an expedited basis if necessary to maintain and support the Services (for example, if a Sub-Processor ceases operations unexpectedly or in the event of an emergency that requires immediate replacement). In such cases, AIScreen will inform Customer as soon as practicable of the change and will provide the opportunity to object retroactively as set forth in Section 6.4, recognizing that the Services could be disrupted without the change.

6.6 International Data Transfers by Sub-Processors: (Reserved / Not Applicable). Note: This DPA is focused on U.S.-based processing. AIScreen will primarily utilize Sub-Processors located in the United States for the Processing of Personal Data. To the extent that any Processing by a Sub-Processor involves a transfer of Personal Data to a jurisdiction outside of the United States in a manner that triggers legal data transfer requirements, AIScreen will ensure such transfer is performed in compliance with applicable Data Protection Laws. (If Customer requires specific terms for international data transfers, the parties will address such terms in a separate agreement or amendment.)

7. Data Breach Notification

7.1 Notification Obligation: In the event AIScreen becomes aware of a confirmed Security Incident (Personal Data Breach) that affects Customer’s Personal Data, AIScreen shall notify Customer without undue delay. AIScreen will provide this notice promptly after discovering the Security Incident, and in any event no later than ten (10) business days after confirming that a breach of Personal Data has occurred. (AIScreen will make good faith efforts to contact Customer within a much shorter timeframe, such as within 72 hours of verification of the incident, recognizing the importance of prompt communication.)

7.2 Content of Notice: AIScreen’s notification of a Security Incident will include, to the extent such information is available to Processor at the time of the notice:

A summary of the nature of the Security Incident, including the date or period of occurrence and the date of discovery.
A description of the Personal Data that is known to be affected (such as categories of data and approximate number of records or individuals impacted).
The known or suspected root cause of the incident and any initial findings.
A description of immediate measures that have been or will be taken by AIScreen to contain and remediate the breach, and to mitigate any potential harm.
Contact information for an AIScreen incident response representative whom Customer can reach for further information or coordination.

As additional details become known, AIScreen will provide timely updates to Customer. The parties agree to work together in good faith to investigate the incident, mitigate its effects, and fulfill any legal notification obligations.

7.3 Coordination and Cooperation: AIScreen will take reasonable steps to control and remedy the Security Incident, such as closing unauthorized access, patching vulnerabilities, or recovering data. AIScreen will cooperate with Customer’s reasonable requests in connection with the investigation and response to the Security Incident. This cooperation includes providing relevant information about the incident as Customer may reasonably require to comply with its obligations under data breach notification laws (for example, to prepare required notices to individuals or authorities, or to inform law enforcement if necessary).

7.4 No Admission: The notification of or response to a Security Incident by AIScreen shall not be construed as an acknowledgment by AIScreen of any fault or liability with respect to the incident. The Parties acknowledge that Customer (as Controller/Business) is responsible for determining whether to notify regulators or individuals of a Security Incident, and for the content of any such notices, to the extent required by applicable law. However, AIScreen will provide reasonable assistance to Customer in fulfilling those obligations, such as by providing information and draft content for notifications upon request.

7.5 Incident Recordkeeping: Processor will maintain records of Security Incidents and relevant facts as required by applicable law and its internal incident response policies. Upon Customer’s request, and subject to confidentiality, AIScreen will summarize the results of its investigation and root cause analysis relating to a Security Incident that affected Customer’s data.

8. Return or Deletion of Data

8.1 Data Retention During Term: Throughout the term of the Agreement, AIScreen will not retain Personal Data longer than is necessary to carry out the purposes of processing authorized by Customer, except as otherwise required or permitted by law. Unless otherwise set forth in the Agreement or required by law, AIScreen’s operational practices may involve routine deletion or anonymization of certain data (for example, removing or aggregating log data after a defined period) in line with data minimization principles.

8.2 Deletion or Return Upon Termination: Upon termination or expiration of the Agreement, or upon Customer’s written request at an earlier time, AIScreen will, at Customer’s election, either (a) return to Customer all Personal Data (including any Customer content and databases containing Personal Data) in AIScreen’s possession or control, or (b) securely delete or render unreadable all such Personal Data. If Customer requests return of data, AIScreen will provide the data in a commonly used and structured format (for example, exporting data files) within a reasonable time following termination. If Customer requests deletion, AIScreen will use commercially reasonable efforts to permanently and irretrievably delete the Personal Data from its systems, except as otherwise stated below. If Customer does not make an election within thirty (30) days of termination, AIScreen will proceed to delete the Personal Data in its systems in accordance with its standard decommissioning and deletion processes.

8.3 Confirmation of Deletion: Upon Customer’s request, AIScreen will confirm in writing (e.g. via email) that deletion of Personal Data has been completed. Customer understands that backup or archival copies of Personal Data which have been automatically generated by AIScreen’s systems (e.g., as part of routine backup processes) may be retained for a short period of time not to exceed a commercially reasonable retention period (for example, in off-site backups maintained for disaster recovery). During any such retention period, the Personal Data will remain subject to the protections of this DPA and AIScreen will not actively Process the data for any purpose other than storage for security and backup. Such backup data will be overwritten or deleted in the normal course of AIScreen’s data retention cycle.

8.4 Legal Requirements to Retain Data: Notwithstanding the foregoing, if AIScreen is required by applicable law or regulation to retain some or all of the Personal Data (for example, to comply with financial record-keeping laws, to resolve disputes, or to enforce agreements), or if the Personal Data is stored in a manner such that AIScreen cannot readily isolate or delete it (for example, stored on encrypted tapes), AIScreen may retain such data to the minimum extent and for the minimum duration required beyond the termination of the Agreement. In such case, AIScreen will continue to maintain the data in accordance with the confidentiality and security obligations of this DPA and will not actively process the data except as required for the legal compliance purpose.

8.5 Fees for Data Export (if applicable): If Customer requests a data export or other assistance with returning data upon termination that incurs a significant cost (for example, a custom data migration to a new provider), AIScreen will inform Customer of any reasonable costs or fees associated with such service in advance. Basic data export in standard format or deletion shall be provided at no additional charge.

9. Audit Rights and Oversight

9.1 Audit Rights: Customer (or its appointed independent auditor that is not a competitor of AIScreen, and who is bound by appropriate confidentiality obligations) shall have the right to audit AIScreen’s compliance with this DPA up to once per year, or more frequently if required by a competent data protection authority or in the event of a known Security Incident impacting Customer’s data. Any such audit shall be conducted upon at least thirty (30) days’ prior written notice to AIScreen, and the parties will mutually agree on the scope, timing, and duration of the audit so as to minimize disruption to AIScreen’s business. The audit shall be limited to relevant systems, processes, and documentation in AIScreen’s possession or control that are used for the Processing of Customer’s Personal Data.

9.2 Alternative Evidence: In lieu of a Customer-conducted audit, Customer may request that AIScreen provide recent audit results or certifications from independent third-party auditors, to the extent AIScreen has such reports (for example, a SOC 2 Type II report, ISO 27001 certification, or similar security assessment) that evaluate AIScreen’s technical and organizational measures. Customer agrees that such reports, if provided and applicable to the Services, may satisfy Customer’s audit needs and relieve AIScreen of a direct audit request, unless Customer has a legitimate reason to require additional information (for instance, if there are material issues indicated in the provided report or if mandated by a regulator).

9.3 Confidentiality of Audit: Any audits or information obtained by Customer in the course of an audit shall be deemed AIScreen’s confidential information. Customer shall use the information solely for the purpose of meeting its audit requirements and shall not disclose the information without AIScreen’s prior written consent, except as required by law. Customer shall ensure that its auditors (if external) are bound to confidentiality no less protective than the confidentiality provisions of the Agreement.

9.4 Audit Expenses: Customer will be responsible for any costs and fees related to an audit initiated by Customer. If an audit finds material non-compliance by AIScreen with this DPA, AIScreen shall bear the costs of addressing such non-compliance. Otherwise, Customer shall bear its own costs of the audit and any reasonable expenses incurred by AIScreen to support the audit (such as staff time, unless such costs are minimal).

9.5 Audit Results and Remediation: Upon completion of an audit, Customer may provide AIScreen with the audit results, and the parties will jointly review any findings. AIScreen will address any confirmed material vulnerabilities or violations of this DPA identified in the audit by taking appropriate remedial actions within a reasonable timeframe. The parties may document any agreed remediation plan in writing. Any disputes over audit findings or remediation will be resolved in accordance with the dispute resolution process under the Agreement.

10. Additional Provisions

10.1 Confidentiality and Limitations: All Personal Data processed by AIScreen on behalf of Customer is considered confidential to Customer. AIScreen shall not disclose Personal Data to any third party except as permitted in the Agreement or this DPA, or as necessary to comply with a lawful government request (in which case AIScreen will follow the process in Section 2.3 for legal disclosures). The obligations of confidentiality assumed by AIScreen hereunder are in addition to any confidentiality obligations in the Agreement. In the event of a conflict between the confidentiality provisions of the Agreement and this DPA with regard to Personal Data, the stricter obligation shall apply.

10.2 Indemnification and Liability: The allocation of liability for each party under this DPA, including indemnification obligations, shall be governed by the corresponding sections of the Agreement. The parties agree that any liability arising under this DPA is subject to the limitations and exclusions of liability set forth in the Agreement, provided that such limitations shall not apply in violation of any applicable Data Protection Law (for example, if law forbids limiting liability for certain data protection obligations). No third-party rights or beneficiaries are created by this DPA, except as expressly provided by Data Protection Laws.

10.3 Conflict with Agreement: Except as modified by this DPA, the terms of the underlying Agreement shall remain in full force and effect. In the event of any inconsistency or conflict between the Agreement and this DPA as it pertains to the Processing of Personal Data, the provisions of this DPA shall prevail. Notwithstanding the foregoing, if the Agreement contains stronger protection for Personal Data or broader rights for Customer than this DPA, those stronger protections shall not be diminished or overridden by this DPA.

10.4 Amendments: This DPA may be amended only by a written instrument signed by both parties, except that if new data protection laws or regulations become applicable to the Services, AIScreen may propose amendments to this DPA as reasonably necessary to ensure ongoing compliance. Such amendments shall become effective with the written consent of Customer (which shall not be unreasonably withheld or delayed). The parties acknowledge that certain privacy laws (such as future state laws) may impose requirements that are automatically applicable by operation of law; in such cases, this DPA shall be interpreted in a manner that allows both parties to comply with those requirements.

10.5 Severability: If any provision of this DPA is found to be invalid or unenforceable by a court of competent jurisdiction, that provision will be deemed modified to the minimum extent necessary to make it valid and enforceable, or if it cannot be made valid, then it shall be severed and the remainder of this DPA shall remain in full force and effect. The parties will negotiate in good faith a lawful and enforceable provision that as closely as possible reflects the original intent of the invalid or unenforceable provision.

10.6 Entire Agreement: This DPA, together with the Agreement (and any other documents incorporated by reference therein), constitutes the entire understanding between Customer and AIScreen concerning the subject matter of data processing and supersedes all prior discussions, agreements, and understandings regarding such subject matter. Each party acknowledges that in entering into this DPA it has not relied on any representations not expressly contained herein.

10.7 Governing Law and Jurisdiction: This DPA shall be governed by and construed in accordance with the laws of the State of Delaware, USA, without regard to its conflict of laws principles. The parties hereby consent to the exclusive jurisdiction of, and venue in, the state and federal courts located within the State of Delaware for the resolution of any disputes arising out of or relating to this DPA, except to the extent otherwise required by applicable law (for example, where jurisdiction in a different venue is mandated by a privacy regulation). Each party waives any objection based on inconvenient forum or lack of jurisdiction.

10.8 Signatures and Authority: This DPA may be executed in counterparts, which taken together will constitute one instrument. Signatures delivered electronically (for example, via a digital signature service or by PDF) shall be deemed binding. Each person signing this DPA represents that they have the authority to bind the party on whose behalf they are signing.

IN WITNESS WHEREOF, the parties have caused this DPA to be executed by their duly authorized representatives:

Customer (Data Controller): AuthorizedSignatoryNameAuthorized Signatory Name
Title: TitleTitle
Organization: CustomerNameCustomer Name
Date: DateDate

AIScreen Inc. (Data Processor):
Authorized Signatory Name: Nikita Sherbina
Title: Chief Executive Officer
Organization: AIScreen Inc.
Date: [Date of Signing]

Appendix 1: Authorized Sub-Processors (Placeholder)

Below is a placeholder list of AIScreen’s current Sub-Processors engaged in Processing Personal Data on behalf of Customer. This list includes the name of each Sub-Processor, the nature of the services they provide, and their primary location. AIScreen will update this Appendix as needed in accordance with Section 6 of the DPA.

Sub-Processor Name: e.g.,ABCCloudHostingCo.e.g., ABC Cloud Hosting Co. – Service Provided: Cloud infrastructure and hosting services – Location: e.g.,USA(datacentersinVirginiaandOregon)e.g., USA (data centers in Virginia and Oregon)
Sub-Processor Name: e.g.,XYZEmailSupportInc.e.g., XYZ Email Support Inc. – Service Provided: Email delivery and support ticketing system – Location: e.g.,USA(California)e.g., USA (California)
Sub-Processor Name: TobedisclosedTo be disclosed – Service Provided: e.g.,Dataanalyticsormonitoringe.g., Data analytics or monitoring – Location: RegionRegion

This Appendix is for disclosure purposes and may be updated by AIScreen from time to time. An up-to-date sub-processor list may also be provided via AIScreen’s website or by direct notice to Customer.

Table of contents