Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service or other written agreement for the Dvina service (the "Agreement") between Dvina Inc. ("Dvina") and the customer that accepted the Agreement ("Customer"). It applies automatically when the Customer accepts the Agreement; no separate signature is needed. Capitalised terms not defined here have the meanings given in the Agreement.

1. Scope and precedence

1.1 This DPA applies whenever Dvina processes personal data on the Customer's behalf in providing the Dvina service (the "Service").

1.2 Where this DPA and the Agreement conflict on the processing of personal data, this DPA prevails. Where this DPA and the Standard Contractual Clauses conflict, the Standard Contractual Clauses prevail.

2. Definitions

• Applicable Data Protection Law means the GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection (FADP), and any other data protection law that applies to the processing under this DPA.
• Customer Personal Data means personal data contained in Customer content (chats, uploaded files, documents and data from applications the Customer connects) and other personal data Dvina processes on the Customer's behalf under the Agreement.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Standard Contractual Clauses or SCCs means the clauses annexed to Commission Implementing Decision (EU) 2021/914.
• Subprocessor means any third party engaged by Dvina that processes Customer Personal Data.
• Terms such as controller, processor, data subject, processing and supervisory authority have the meanings given in the GDPR.

3. Roles of the parties

3.1 The Customer is the controller of Customer Personal Data, or a processor acting for its own controllers. Dvina is the Customer's processor, or subprocessor where the Customer is itself a processor.

3.2 Dvina acts as an independent controller only for the personal data it needs to run its own business, such as account administration, billing, security logging and service analytics. That processing is described in the Dvina Privacy Policy and is outside this DPA.

3.3 The Customer is responsible for the lawfulness of the instructions it gives and for having a lawful basis, and any notices or consents required, for the Customer Personal Data it brings into the Service.

4. Processing instructions

4.1 Dvina processes Customer Personal Data only on the Customer's documented instructions. The Agreement, this DPA, and the Customer's configuration and use of the Service (including workspace settings, approval modes, retention settings and connected applications) are the Customer's complete instructions.

4.2 Dvina informs the Customer without delay if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend the affected processing until the instruction is confirmed or changed.

4.3 If Union or Member State law requires Dvina to process Customer Personal Data beyond the Customer's instructions, Dvina informs the Customer before processing, unless that law prohibits it on important grounds of public interest.

4.4 Dvina does not use Customer Personal Data to train AI models, and does not sell or share it for its own purposes.

5. Confidentiality

Dvina ensures that every person authorised to process Customer Personal Data is bound by a contractual or statutory duty of confidentiality, and limits access to personnel who need it to provide, support or secure the Service.

6. Security of processing

6.1 Dvina implements and maintains the technical and organisational measures described in Annex II, appropriate to the risk under Article 32 GDPR. Dvina may update these measures provided that the update does not materially reduce the overall level of protection.

6.2 The Customer is responsible for the security settings under its control, including user access to its workspaces, approval modes for tool actions, the per-chat setting that turns off personal data masking, and the applications it chooses to connect.

7. Subprocessors

7.1 The Customer gives Dvina general written authorisation to engage the Subprocessors listed in Annex III.

7.2 Dvina imposes on each Subprocessor, by written contract, data protection obligations that provide at least the same level of protection as this DPA, and remains fully liable to the Customer for each Subprocessor's performance.

7.3 Dvina gives the Customer at least 30 days' notice before adding or replacing a Subprocessor, by updating Annex III and notifying the Customer's account contact by email.

7.4 The Customer may object to a new Subprocessor on reasonable data protection grounds in writing within that 30-day period. The parties will discuss the objection in good faith. If no resolution is reached, the Customer may terminate the affected part of the Service without penalty and receives a pro-rata refund of prepaid fees for it.

8. Assistance to the Customer

8.1 Taking into account the nature of the processing, Dvina assists the Customer by appropriate technical and organisational measures in responding to requests to exercise data subject rights. The Service provides self-service export and deletion; where that is not sufficient, the Customer can write to hi@dvina.ai.

8.2 If Dvina receives a request directly from a data subject relating to Customer Personal Data, Dvina refers the data subject to the Customer and does not respond further except on the Customer's instruction.

8.3 Dvina provides reasonable information the Customer needs for data protection impact assessments and any prior consultation with a supervisory authority relating to the Service, and assists the Customer in meeting its obligations under Articles 32 to 36 GDPR, taking into account the information available to Dvina.

9. Personal Data Breach

9.1 Dvina notifies the Customer of a Personal Data Breach without undue delay, and in any event within 48 hours after becoming aware of it.

9.2 The notice includes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information not available at first notice is provided in phases without undue further delay.

9.3 Dvina takes reasonable steps to contain the breach and mitigate its effects, and cooperates with the Customer's investigation and any notifications the Customer must make. Notification of a breach is not an acknowledgement of fault or liability.

10. Deletion or return

10.1 During the term, the Customer may export and delete Customer Personal Data through the Service at any time. Workspace retention can be set between 1 and 3650 days, and legal hold suspends deletion where the Customer applies it.

10.2 On termination of the Agreement, Dvina deletes or returns Customer Personal Data, at the Customer's choice, within 30 days. Copies in backups expire on the normal backup cycle within 35 days and remain protected under this DPA until then.

10.3 Dvina may retain Customer Personal Data beyond these periods only where Union or Member State law requires it, and then only for that purpose and under this DPA.

11. Audits and information

11.1 Dvina makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR and this DPA, first through its security and compliance documentation, available third-party audit reports or certifications, and written answers to reasonable security questionnaires, no more than once a year unless a Personal Data Breach or a supervisory authority requires otherwise.

11.2 Where this information is not sufficient, the Customer, or an independent auditor bound by confidentiality and not a competitor of Dvina, may carry out an audit at the Customer's cost, with at least 30 days' written notice, during business hours, and in a way that does not disrupt the Service or compromise other customers' data. Audit results are Dvina's Confidential Information.

12. International transfers

12.1 Customer content is stored and processed in the European Union. Dvina Inc. is established in the United States, its personnel may access the Service for support and operations from outside the European Economic Area, and some Subprocessors are located outside it, as shown in Annex III.

12.2 EU SCCs. To the extent the processing involves a transfer of Customer Personal Data subject to the GDPR to a country without an adequacy decision, the SCCs are incorporated into this DPA by reference: Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor, with the Customer as data exporter and Dvina as data importer. For the SCCs: Clause 7 applies; in Clause 9, Option 2 applies with the notice period in section 7.3; in Clause 11, the optional language does not apply; in Clause 13, the competent supervisory authority is the one determined by Clause 13(a) for the Customer; in Clause 17, Option 2 applies, and if the law of the data exporter's Member State does not allow for third-party beneficiary rights, the law of Germany applies; in Clause 18(b), disputes are resolved before the courts of Munich, Germany; and Annexes I, II and III of this DPA complete the annexes of the SCCs.

12.3 UK. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner is incorporated: Table 1 is completed with the parties' details in the Agreement, Table 2 with the SCC modules and options above, Table 3 with Annexes I to III, and in Table 4 either party may end the Addendum as its Section 19 permits.

12.4 Switzerland. For transfers subject to the Swiss FADP, the SCCs apply with these changes: references to the GDPR are read as references to the FADP where the FADP applies; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for such transfers; and the term "Member State" does not exclude data subjects in Switzerland from suing for their rights in their place of habitual residence.

12.5 Dvina relies on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where a recipient is certified, and on the SCCs otherwise. If a transfer mechanism used here is invalidated, the parties will cooperate to put an alternative lawful mechanism in place.

13. Liability, term and disputes

13.1 Each party's liability under this DPA is subject to the limitations in the Agreement, except where Applicable Data Protection Law or the SCCs do not allow such limitation.

13.2 This DPA stays in force as long as Dvina processes Customer Personal Data under the Agreement.

13.3 Except for the SCCs, which are governed by section 12, this DPA is governed by the law, and disputes under it are resolved in the forum, set out in the Agreement.

Annex I. Description of processing

Annex II. Technical and organisational measures

Annex III. Subprocessors

Contact

Dvina Inc. 2261 Market Street San Francisco, CA 94114 United States

Email: hi@dvina.ai