Legal

Data processing addendum

Last updated: October 8, 2026

1. Roles and instructions

Customer is the controller and Proto is the processor of personal data handled on Customer's behalf ("Customer Personal Data"). Where Customer acts as a processor, Proto acts as its sub-processor and Customer confirms it is authorised to give instructions. The subject matter, duration, nature, purpose, data types and people concerned are in Annex I.

Proto will process Customer Personal Data only on Customer's documented instructions, including for transfers, unless EU or Member State law requires otherwise. In that case Proto will tell Customer before processing unless the law prohibits it. Instructions include this DPA, the agreement, Customer's settings and its authorised users' requests. Proto will immediately inform Customer if it considers an instruction unlawful.

Proto is a controller for its own account, billing, security and legal records, as described in the Privacy Policy. We do not use your company's content to train AI models unless your company opts in. Connected-app data from Google is never used for training. Any separate training instruction must comply with applicable law.

2. Confidentiality and security

Proto will ensure that people authorised to process Customer Personal Data are bound by confidentiality commitments or statutory confidentiality duties. Proto will apply appropriate measures under Article 32 GDPR, including the measures in Annex II, and will not reduce their overall level of protection during the agreement.

3. Sub-processors

Customer gives general written authorisation for the providers on the Sub-processors page, incorporated as Annex III. Proto will update that page at least 30 days before a new sub-processor starts handling Customer Personal Data. Customer may object within that period on reasonable data protection grounds. Proto will work with Customer to resolve the objection; if no reasonable solution is available, Customer may end the affected service.

Proto will require a written agreement imposing the same applicable data protection obligations on each sub-processor before it processes Customer Personal Data under this DPA. Proto remains responsible to Customer for its sub-processors' performance of those duties.

4. Assistance and personal data breaches

Taking account of the nature of processing, Proto will assist Customer through appropriate technical and organisational measures, insofar as possible, with requests under Chapter III GDPR. Proto will pass requests received directly to Customer, unless legally required to respond itself. Proto will also assist with security, breach notices, impact assessments and prior consultation under Articles 32 to 36, taking account of the processing and information available to Proto.

Proto will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and within 48 hours of confirming it. The notice will include available information about the breach, affected people and records, likely consequences, measures taken or proposed, and a contact for further information. Proto may provide further information in stages and will help Customer meet its own notification duties.

5. Return and deletion

At Customer's choice, Proto will return or delete Customer Personal Data within 60 days of the end of the service, and delete existing copies unless EU or Member State law requires storage. Returns will be in a commonly used machine-readable format. Deletion from live systems will also take place within 60 days of a deletion request. Backup copies roll off on their schedule, remain protected and are not used for other purposes; any restored data remains subject to the deletion instruction.

6. Information and audits

Proto will make available the information needed to demonstrate compliance with this DPA and allow and contribute to audits, including inspections, by Customer or its appointed auditor. Documentation and written answers are the first step. If they do not resolve a reasonable concern, an inspection may follow on reasonable notice, under confidentiality and with safeguards for other customers' information. These arrangements do not restrict a supervisory authority's powers or any mandatory audit right.

7. International transfers

For a restricted transfer to Proto, the parties incorporate the 2021 European Commission Standard Contractual Clauses ("SCCs") by reference: Module Two where Customer is a controller, and Module Three where Customer is a processor. For onward restricted transfers, Proto will require the applicable safeguards, including Module Three where relevant. Where the SCCs cannot serve as a transfer safeguard because the importer's processing is already subject to GDPR, their obligations remain contractual terms and the parties will put any required alternative safeguard in place before proceeding with that transfer.

Clause 7 applies. Clause 9(a) uses Option 2 (general authorisation) with 30 days' notice. The optional wording in Clause 11(a) does not apply. Clause 17 uses Option 1 and Irish law; Clause 18(b) designates the Irish courts. Annexes I, II and III below complete the corresponding SCC annexes. The competent supervisory authority is determined under Clause 13: Customer's authority where established in the EU; otherwise the authority of its EU representative, or, if no representative is required, the Irish authority where affected data subjects are located in Ireland (and otherwise the authority of an EU Member State where affected data subjects are located, identified by Customer).

For UK restricted transfers, the ICO's International Data Transfer Addendum to the EU SCCs, version B1.0 effective 21 March 2022, applies. Its Tables 1 to 3 use the parties, modules, choices and annexes in this DPA, with each party's account or agreement contact as its key contact. For Table 4, either party may end the Addendum as permitted by its mandatory clauses. Those clauses prevail over conflicting terms.

For Swiss transfers, references to GDPR include the Swiss Federal Act on Data Protection, references to Member States include Switzerland, and the Swiss authority and courts apply where Swiss law requires. These adaptations do not limit EU data subjects' rights. Where a recipient is certified under the applicable Data Privacy Framework, that framework may support the transfer. If another safeguard is legally required, the parties will put it in place before proceeding with the restricted transfer.

8. Liability and precedence

Liability follows the Terms, except where applicable law or the SCCs prohibit a limit. Nothing limits data subjects' statutory rights or remedies. This DPA prevails over the Terms for personal data processing, including any conflicting breach-notice or provider responsibility term. The SCCs and UK Addendum prevail over this DPA, including their governing law, court jurisdiction and third-party rights. This DPA continues while Proto processes Customer Personal Data.

Annex I: Parties and processing

Exporter: Customer, identified by its account and agreement details; controller under Module Two, processor under Module Three. Its activities are using Proto for its business. Importer: Proto, contact support@letproto.com; processor. Its activities are providing the service. Acceptance of the agreement incorporating this DPA constitutes the parties' acceptance of these terms and the incorporated SCCs, dated by that acceptance. The competent authority is determined in section 7 (SCC Annex I.C).

Subject matter and purpose: providing an AI assistant for Customer's business. Nature: receiving, storing, organising, retrieving and processing information to provide the service on Customer's instructions. Frequency: ongoing during use. Duration: the agreement's term and the return and deletion period in section 5.

Data subjects: Customer's staff and admins, contacts, and people whose information appears in messages, connected apps or meetings. Data types: names, contact details, roles, account details, messages, audio, images, files, connected-app content, meeting transcripts, notes, preferences and relevant technical records. Sensitive data: none is sought; it may appear incidentally. Such data remains subject to restricted access, Customer's lawful instructions and the safeguards in Annex II.

For transfers to sub-processors, the subject matter, nature and duration are the service and data described for each provider in Annex III, limited to providing that service and applicable retention obligations.

Annex II: Security measures

• Encryption protects stored customer content and backups.
• Access controls limit access to authorised roles and people.
• Customer information is separated between companies.
• Encrypted backups support recovery.

Annex III: Sub-processors

The Sub-processors page lists the providers, their services, data types and locations, subject to the notice and objection procedure in section 3.