Data Processing Addendum.

Duration of processing

Setell processes Personal Data for the duration of the underlying service agreement between the parties, plus a thirty (30) day tail following termination during which the Controller may request export of its Personal Data in a portable format. After that thirty-day window, Setell will delete or return Personal Data in accordance with Section 11.

Transfer mechanisms

Setell processes Personal Data primarily in the United States (AWS us-east-1 for application hosting; Neon, hosted on AWS us-east-2, for the primary database). Where Personal Data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a third country that has not received an adequacy decision, the parties agree that the Standard Contractual Clauses approved by the European Commission in Implementing Decision 2021/914 of 4 June 2021 (Module 2, Controller-to-Processor) apply and are incorporated by reference, with the Controller as the data exporter and Setell as the data importer. The UK Addendum to the EU Standard Contractual Clauses applies to transfers from the United Kingdom; the Swiss Federal Data Protection and Information Commissioner's adaptation applies to transfers from Switzerland.

Cooperation with the Controller

Setell will, taking into account the nature of the processing and insofar as possible, assist the Controller through appropriate technical and organizational measures in fulfilling the Controller's obligation to respond to requests from Data Subjects exercising their rights under GDPR Articles 12 to 22, including:

• The right of access (Art. 15)
• The right to rectification (Art. 16)
• The right to erasure / 'right to be forgotten' (Art. 17)
• The right to restriction of processing (Art. 18)
• The right to data portability (Art. 20)
• The right to object (Art. 21)
• The right not to be subject to a decision based solely on automated processing (Art. 22)

If a Data Subject submits a request directly to Setell, Setell will, without undue delay, forward the request to the Controller and will not respond to the Data Subject directly unless authorized to do so by the Controller or required by law.

Notification timing and contents

Setell will notify the Controller without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting the Controller's Personal Data. The notification will, at minimum and to the extent then known:

• Describe the nature of the breach including, where possible, the categories and approximate number of Data Subjects and records concerned
• Communicate the name and contact details of Setell's contact point for the breach
• Describe the likely consequences of the breach
• Describe the measures taken or proposed to address the breach and to mitigate its possible adverse effects

Setell will provide ongoing updates as the investigation progresses and will cooperate with the Controller's investigation and notifications to supervisory authorities and Data Subjects, as applicable.

At end of processing

At the Controller's choice, Setell will delete or return all Personal Data to the Controller after the end of the provision of services relating to processing, and will delete existing copies unless applicable law requires storage of the Personal Data. Specifically:

• On termination of the underlying service agreement, the Controller has thirty (30) days to request export of its Personal Data in a portable format
• After the thirty-day export window, Setell will delete the Controller's Personal Data from production systems
• Backup copies containing Personal Data are purged within ninety (90) days of the termination effective date
• Sub-Processors are instructed to delete the Controller's Personal Data on the same schedule, except where retention is required by applicable law
• Setell will, on the Controller's written request, certify in writing that the deletion has been completed

Limitation

Each party's liability arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitations of liability and exclusions of damages set forth in the underlying service agreement between the parties. Nothing in this DPA limits or excludes either party's liability for matters that cannot be excluded or limited under applicable law.

For privacy & data rights inquiries: privacy@setell.ai
For security concerns: security@setell.ai