Data Processing Addendum

Data Protection Laws: every law on privacy and personal data that applies to the processing, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended ("CCPA") and other US state privacy laws, and Israel's Protection of Privacy Law. Customer Personal Data: personal data that MeMaMu LLC processes on the Customer's behalf to provide the Service, as described in Annex 1, chiefly the messages and details of the people the Customer's users correspond with in conversations they switch on, and, for a team account, its members' data. Sub-processor: a third party MeMaMu LLC engages to process Customer Personal Data.

The Customer is the controller (or a processor acting for its own controller) and MeMaMu LLC is its processor (or sub-processor) for Customer Personal Data. MeMaMu LLC is a separate controller for its own account, billing, security and service-improvement data, as the Privacy Policy describes. MeMaMu LLC processes Customer Personal Data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use and settings of the Service, unless the law requires otherwise, in which case it will tell the Customer first unless the law forbids that. MeMaMu LLC will tell the Customer if it believes an instruction breaks Data Protection Laws. The Customer is responsible for having a lawful basis, and giving any notice or obtaining any consent Data Protection Laws require, for the processing it instructs, including towards the people its users correspond with. Learning from a user's drafts, comments and GENT work to improve the Service for that Customer is part of providing the Service. What is learned stays with that Customer's account and is never used for any other customer.

MeMaMu LLC ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality, and limits that access to those who need it. It maintains the technical and organisational measures in Annex 2, which it may update as long as the overall level of protection does not decrease.

The Customer gives MeMaMu LLC general authorisation to engage Sub-processors. The current list is in section 6 of the Privacy Policy. MeMaMu LLC will update that list before engaging a new Sub-processor and, for an account that asks privacy@altrmode.com to be notified, email it at least 14 days before. The Customer may object on reasonable data-protection grounds within that time; if the parties can't resolve the objection, the Customer may stop using the affected feature or end the Terms as its sole remedy. MeMaMu LLC imposes data-protection obligations on each Sub-processor no less protective than this DPA, and remains responsible for them. Platforms the Customer chooses to connect (for example Gmail, Slack, Microsoft Teams or a GENT tool) are the Customer's own providers, not MeMaMu LLC's Sub-processors.

Taking into account the nature of the processing, MeMaMu LLC helps the Customer answer requests from data subjects to exercise their rights, mainly through the Service itself (switching conversations off, disconnecting, deleting the account, and Download my data). If MeMaMu LLC receives such a request directly about Customer Personal Data, it will pass it to the Customer and will not answer it itself except to say so, unless the law requires otherwise.

MeMaMu LLC will notify the Customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information the Customer reasonably needs to meet its own obligations as it becomes available, and will take reasonable steps to contain and remedy it. Notifying is not an admission of fault.

MeMaMu LLC gives the Customer reasonable assistance with data-protection impact assessments and prior consultations with authorities about the Service, and makes available the information reasonably necessary to show compliance with this DPA. The Customer may audit that compliance once a year, or after a personal data breach or a request from an authority, first by written questions and the documentation MeMaMu LLChas; where that is not enough, by an inspection on 30 days' notice, during business hours, at the Customer's cost, under confidentiality, and without access to other customers' data.

Customer Personal Data is deleted on the schedule in section 8 of the Privacy Policy, and in full when the Customer disconnects the account it came from or deletes its ALTRmode account. Before deleting its account the Customer can download a copy (Settings → Plan & account → Download my data). MeMaMu LLC may keep data only where the law requires, and then keeps it confidential and processes it for no other purpose. Backups roll off within 35 days.

MeMaMu LLC processes Customer Personal Data in the United States and wherever its Sub-processors operate. To the extent a transfer of Customer Personal Data from the EEA, the UK or Switzerland to MeMaMu LLC is not covered by an adequacy decision (including the EU-US Data Privacy Framework), the parties incorporate the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 ("SCCs"), Module Two (controller to processor) or Module Three (processor to processor) as applicable, with: clause 7 included; option 2 (general authorisation) in clause 9 with the notice period in section 4; the optional wording in clause 11 excluded; Irish law and the courts of Ireland in clauses 17 and 18; Annex I and II of the SCCs completed by Annexes 1 and 2 of this DPA; and the Customer as data exporter and MeMaMu LLC as data importer. For the UK, the International Data Transfer Addendum issued by the Information Commissioner applies to the SCCs, with the tables completed by this DPA and either party able to end it as section 19 of the Addendum allows. For Switzerland, the SCCs apply with the Swiss Federal Data Protection and Information Commissioner as competent authority, Swiss law where the FADP applies, and "member state" read to include Switzerland. If the SCCs conflict with this DPA, the SCCs prevail.

Where the CCPA or a similar US state law applies, MeMaMu LLC is the Customer's service provider or processor, and processes Customer Personal Data only for the business purposes in Annex 1. MeMaMu LLC will not sell or share it; retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Service; or combine it with personal information it receives from others, except as those laws allow. It will comply with those laws, give the same level of privacy protection they require, and tell the Customer if it can no longer meet them; the Customer may then take reasonable steps to stop and remedy unauthorised use. MeMaMu LLC certifies that it understands these restrictions.

Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws or the SCCs do not allow that. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails. MeMaMu LLC may update this DPA to reflect changes in law or in the Service, without lowering the protection it gives; material changes are announced as section 14 of the Terms describes. Questions: privacy@altrmode.com.

• Data subjects: people who correspond with the Customer's users in the conversations they switch on, including the members of a community channel the Customer moderates with the Moderator; the Customer's own customers who write to a help desk the Customer connects (Zendesk, Freshdesk, Intercom, Help Scout, Front), and the Customer's colleagues who write internal notes there; people who review the Customer's business or apps on a review site the Customer connects; people named in calendar entries, tasks and work tools the Customer connects; and, for a team account, its members.
• Personal data: names, user names, email addresses, phone numbers and profile pictures; the content and metadata of messages, emails and their attachments, including identifiers of people who read a group message; calendar entries; to-dos written from those messages (which can name the person who asked); content of tasks, tickets, documents, repositories and records in tools the Customer connects for GENTs.
• Special categories: none are sought; any that appear in message content are processed only as part of that content, protected by the measures in Annex 2, including encryption at rest.
• Frequency: continuous, while a conversation or tool is switched on.
• Nature and purpose: storing, analysing and transmitting the data to provide the Service: learning the user's writing style, drafting and sending replies, showing group-message reader details where the connected service provides them, screening for phishing and spam, carrying out GENT tasks, and checking that what GENTs find is shared only with people entitled to see it, as the user instructs. Where a user turns on the Moderator in a channel they run, checking each new message there against the rules the user sets and the channel publishes, and removing it, or timing out, removing or banning its sender on the platform, as the user allows; the Customer decides these rules and steps and is responsible for telling the channel's members. For a team account, applying the integration settings its owners and admins choose, giving members the connections an admin shares with the team, and showing the team's admins how often members' GENTs used them.
• Duration: for the term of the Terms and the retention periods in section 8 of the Privacy Policy.
• Sub-processors: as listed in section 6 of the Privacy Policy, for the purposes stated there.

• Encryption in transit (TLS) for all traffic, except to a Customer server that the Customer chose to connect over plain http (no credentials are sent to it).
• Encryption at rest with AES-256-GCM for message content, drafts, learned style, summaries, notes, files, bridge caches and all credentials, with keys held outside the database and rotated under a versioned keyring.
• Connected-account credentials bound to the customer they belong to, so they can't be used for another.
• Mandatory two-factor authentication for password accounts; account lockout after repeated wrong codes.
• Default-off processing: nothing in a conversation is analysed until the user switches it on.
• Data minimisation: files people send aren't stored; messages deleted 90 days after they were sent (at most 7 days later while the ALTR finishes learning from them); cached group-reader identifiers are limited to 300 message entries per connection and deleted with their message or when the channel is disconnected, while reader lists fetched on demand aren't retained; everything for a conversation deleted 72 hours after it is switched off.
• Staff tools that show counts, statuses and scores, never message text or the names and addresses of the people in a conversation; production access limited to authorised personnel and logged.
• A security audit log of sensitive account actions.
• AI providers bound by commercial terms that forbid training on customer data.
• Backups that roll off within 35 days; an incident-response process with notification as section 6 describes.