Data Processing Addendum (DPA)

DRAFT v1 — FOR ATTORNEY REVIEW ONLY. This document is a working draft prepared for review by legal counsel. It is not legal advice and must not be signed or relied upon until reviewed and approved by a qualified attorney.

This Data Processing Addendum ("DPA") is attached to and forms part of the Master Services Agreement ("MSA") between:

• [CUSTOMER LEGAL ENTITY NAME], with its registered address at [CUSTOMER ADDRESS] ("Customer"), acting as Controller; and
• [EPICME LEGAL ENTITY NAME], with its registered address at [EPICME ADDRESS] ("EpicMe"), acting as Processor.

Effective date: the effective date of the MSA, unless the parties agree otherwise in writing.

1. What This DPA Is For

1.1 Under the MSA, EpicMe builds and hosts AI professional digital twins ("Droids") for the Customer's staff ("Subjects") and answers Droid queries via API. Doing that requires EpicMe to process personal data on the Customer's behalf.

1.2 This DPA sets the rules for that processing. It is designed to satisfy Article 28 of the GDPR and UK GDPR, applicable US state privacy laws, and the cross-border transfer rules described in Section 12.

1.3 If this DPA conflicts with the MSA on a data protection matter, this DPA wins. If this DPA conflicts with the Standard Contractual Clauses or UK Addendum incorporated in Section 12, those transfer instruments win.

1.4 EpicMe's Privacy Policy ([URL]) describes EpicMe's practices in plain language for Subjects; it does not override this DPA.

2. Definitions

2.1 "Personal Data" means any information relating to an identified or identifiable natural person that EpicMe processes on the Customer's behalf under the MSA.

2.2 "Data Protection Laws" means, as applicable: the EU General Data Protection Regulation (EU) 2016/679 ("GDPR"); the UK GDPR and the UK Data Protection Act 2018; and US state privacy laws including the California Consumer Privacy Act as amended by the CPRA ("CCPA") and comparable state statutes (e.g., Virginia, Colorado, Connecticut, Texas).

2.3 "EU SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

2.4 "UK Addendum" means the UK Information Commissioner's International Data Transfer Addendum to the EU SCCs (version B1.0, in force 21 March 2022), or the UK IDTA where applicable.

2.5 "Subprocessor" means a third party engaged by EpicMe to process Personal Data on the Customer's behalf.

2.6 "Subject" and "Droid" have the meanings given in the MSA. Other capitalized terms have the meanings given in the MSA or in Data Protection Laws.

3. Roles and Scope of Processing

3.1 Roles. For Personal Data processed to provide the service, the Customer is the Controller and EpicMe is the Processor. Each party will comply with Data Protection Laws applicable to its role.

3.2 Details of processing. The subject matter, duration, nature and purpose of the processing, the categories of data subjects, and the categories of Personal Data are set out in Annex A.

3.3 Customer responsibilities. The Customer is responsible for: (a) having a lawful basis for the processing; (b) providing Subjects with required privacy notices; (c) obtaining any consents required for intake, document uploads, and consented web research on Subjects; and (d) the accuracy and lawfulness of the Personal Data it (or its Subjects) submits.

3.4 Heightened-sensitivity acknowledgment. The parties acknowledge that Droid profiling produces quasi-psychometric inferences about Subjects (behavioral scoring, decision-style and communication-style analysis). Even where such data does not qualify as special-category data under Article 9 GDPR, both parties will treat generated profiles, scores, and personas as data of heightened sensitivity, and the Customer will factor this into its own risk assessments (see Section 8).

4. EpicMe Processes Only on Customer Instructions

4.1 EpicMe will process Personal Data only on the Customer's documented instructions, including with respect to international transfers, unless required to do otherwise by EU, EU Member State, UK, or other applicable law — in which case EpicMe will inform the Customer of that legal requirement before processing, unless the law prohibits it on important grounds of public interest.

4.2 The Customer's documented instructions are: the MSA, this DPA (including the Annexes), the Customer's configuration choices in the service, and any additional written instructions agreed by the parties.

4.3 If EpicMe believes an instruction violates Data Protection Laws, it will promptly tell the Customer and may pause the affected processing until the instruction is confirmed or changed.

4.4 EpicMe will not use Personal Data to train or improve general-purpose AI models, and will contractually require the same of its AI Subprocessors as described in Annex C.

5. Confidentiality

5.1 EpicMe will ensure that every person it authorizes to process Personal Data (employees and contractors) is bound by a contractual or statutory duty of confidentiality, and processes Personal Data only as needed to provide the service.

6. Security

6.1 EpicMe will implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing, as required by Article 32 GDPR / UK GDPR.

6.2 The current measures are described in Annex B. EpicMe may update them over time, provided the updates do not materially reduce the overall level of protection.

7. Subprocessors

7.1 General authorization. The Customer gives EpicMe general written authorization to engage Subprocessors. The Subprocessors engaged as of the effective date are listed in Annex C.

7.2 Flow-down. EpicMe will impose on each Subprocessor, by written contract, data protection obligations materially equivalent to those in this DPA, and remains fully liable to the Customer for each Subprocessor's performance.

7.3 Notice of changes. EpicMe will give the Customer at least [30] days' prior written notice (email or in-product notice to [CUSTOMER NOTICE CONTACT/MECHANISM]) before adding or replacing a Subprocessor.

7.4 Right to object. The Customer may object on reasonable data protection grounds within [15] days of notice. The parties will discuss in good faith; if EpicMe cannot reasonably accommodate the objection (for example, by offering an alternative configuration), the Customer may terminate the affected services and receive a pro-rata refund of prepaid, unused fees for those services.

7.5 BYOK carve-out. If the Customer supplies its own Anthropic API key ("BYOK"), the processing performed via that key is governed by the Customer's own agreement with Anthropic, not by Annex C of this DPA; for that processing, Anthropic acts as the Customer's direct processor/service provider, and EpicMe's responsibility is limited to securely handling the key as described in Annex B.

8. Helping the Customer Meet Its Own Obligations

8.1 Data subject rights. Taking into account the nature of the processing, EpicMe will assist the Customer with appropriate technical and organizational measures, insofar as possible, to respond to Subjects' (and other data subjects') requests to exercise their rights — access, rectification, erasure, restriction, portability, objection, and rights regarding automated decision-making/profiling. If a data subject contacts EpicMe directly, EpicMe will forward the request to the Customer without undue delay and will not respond substantively except to direct the person to the Customer, unless legally required.

8.2 DPIAs and consultations. EpicMe will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to EpicMe. Given the quasi-psychometric profiling described in Section 3.4, the parties expect the Customer will typically need to conduct a DPIA before deploying Droids for Subjects, and EpicMe will supply reasonable documentation of its processing to support this.

8.3 Security obligations. EpicMe will assist the Customer, insofar as possible, in ensuring compliance with the Customer's obligations under Articles 32–36 GDPR / UK GDPR.

9. Personal Data Breach Notification

9.1 EpicMe will notify the Customer without undue delay, and in any event within [48] hours, after becoming aware of a personal data breach affecting Personal Data.

9.2 The notification will include, to the extent known (and may be provided in phases): the nature of the breach; categories and approximate numbers of data subjects and records affected; likely consequences; measures taken or proposed; and a contact point at EpicMe.

9.3 EpicMe will reasonably cooperate with the Customer's investigation, remediation, and any notifications the Customer must make to authorities or data subjects. EpicMe will not notify authorities or data subjects on the Customer's behalf unless legally required or the Customer asks in writing.

10. Deletion and Return at End of Service

10.1 On termination or expiry of the MSA, at the Customer's choice, EpicMe will delete or return all Personal Data (including Droid profiles, scores, personas, and query logs) and delete existing copies, unless EU, Member State, UK, or other applicable law requires continued storage — in which case EpicMe will isolate and protect the retained data and delete it when the legal requirement ends.

10.2 Unless the Customer requests return or a different schedule in writing within [30] days of termination, EpicMe will delete Personal Data within [60] days of termination, using the deletion cascade and retention purge mechanisms described in Annex B. Data held by Subprocessors is deleted per the retention terms in Annex C.

10.3 On request, EpicMe will confirm deletion in writing.

11. Audits and Information

11.1 EpicMe will make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 GDPR / UK GDPR and this DPA, including (when available) summaries of third-party audits or certifications and completed security questionnaires.

11.2 EpicMe will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to: (a) [30] days' prior written notice; (b) no more than [one] audit per 12-month period, except after a personal data breach or where required by a supervisory authority; (c) reasonable confidentiality undertakings; (d) audits during business hours without unreasonable disruption; and (e) the Customer bearing its own audit costs. Where a documentation-based review reasonably answers the question, the parties will start there before an on-site inspection.

11.3 EpicMe will immediately inform the Customer if, in its opinion, an audit instruction infringes Data Protection Laws.

12. International Transfers

12.1 The transfer. EpicMe and its Subprocessors process Personal Data in the United States (see Annex C). Where Personal Data protected by the GDPR or UK GDPR is transferred to a country without an adequacy decision, the parties rely on the transfer mechanisms below.

12.2 EU SCCs. The parties incorporate the EU SCCs, Module Two (controller-to-processor), by reference into this DPA, with: the Customer as data exporter and EpicMe as data importer; Clause 7 (docking clause) [INCLUDED / NOT INCLUDED]; Clause 9(a) Option 2 (general authorization) with the notice period in Section 7.3; Clause 11 optional redress language [NOT INCLUDED]; Clause 17 governed by the law of [EU MEMBER STATE]; Clause 18 courts of [EU MEMBER STATE]; Annex I and II of the EU SCCs populated by Annexes A, B, and C of this DPA; and the competent supervisory authority determined under Clause 13 [SUPERVISORY AUTHORITY, IF SPECIFIED].

12.3 UK transfers. For transfers subject to the UK GDPR, the parties incorporate the UK Addendum (or, where the parties agree, the UK IDTA) by reference, with the EU SCCs as amended by the UK Addendum, Table 1 populated with the parties' details, Tables 2–3 populated by Section 12.2 and Annexes A–C, and Table 4: [EITHER PARTY / IMPORTER / EXPORTER] may end the Addendum as set out in Section 19 of the Addendum. Addendum date reference: [DATE].

12.4 Transfer impact assessment. Each party warrants it has no reason to believe the laws of the destination country prevent the data importer from fulfilling the SCCs. EpicMe will, on request, provide reasonable information to support the Customer's transfer impact assessment (including regarding government access requests), will notify the Customer if it becomes subject to a legally binding request for Personal Data from a public authority (unless prohibited), and will challenge unlawful or overbroad requests where reasonably possible. [NOTE FOR COUNSEL: attach or reference the completed TIA / supplementary measures memo.]

12.5 Other jurisdictions. For transfers from other jurisdictions with transfer restrictions, the parties will cooperate to put in place the required mechanism, and the EU SCCs apply mutatis mutandis where permitted.

12.6 EU/UK representatives. EpicMe's EU representative (if appointed) is [EU REPRESENTATIVE NAME AND ADDRESS]; its UK representative (if appointed) is [UK REPRESENTATIVE NAME AND ADDRESS].

13. US State Privacy Laws (CCPA/CPRA and Similar)

13.1 Where the CCPA or a similar US state privacy law applies, EpicMe acts as a "service provider" or "processor", and the Customer is the "business" or "controller". Personal Data is disclosed to EpicMe only for the limited and specified business purpose of providing the service described in Annex A.

13.2 EpicMe will not: (a) sell or share Personal Data (as those terms are defined in the CCPA); (b) retain, use, or disclose Personal Data for any purpose other than the business purpose specified in the MSA and this DPA, or as otherwise permitted for service providers by applicable law; (c) retain, use, or disclose Personal Data outside the direct business relationship between the parties; or (d) combine Personal Data with personal information received from other sources, except as permitted for service providers.

13.3 EpicMe certifies that it understands and will comply with these restrictions. EpicMe will notify the Customer if it determines it can no longer meet its obligations under applicable US state privacy law, and the Customer may then take reasonable steps to stop and remediate unauthorized use of Personal Data.

13.4 EpicMe grants the Customer the rights of oversight, audit, and instruction required of processor/service-provider contracts under applicable US state privacy laws; Sections 4, 8, 10, and 11 apply accordingly.

14. General

14.1 Term. This DPA lasts as long as EpicMe processes Personal Data under the MSA.

14.2 Liability. Liability under this DPA is subject to the limitations and exclusions in the MSA, except where Data Protection Laws do not permit that.

14.3 Changes in law. If Data Protection Laws change in a way that requires amendments to this DPA (including replacement transfer mechanisms), the parties will negotiate the amendment in good faith.

14.4 Governing law. This DPA is governed by the law governing the MSA, except where the SCCs or UK Addendum require otherwise.

Annex A — Details of Processing

Annex B — Technical and Organizational Security Measures

EpicMe maintains at least the following measures:

1. Row-level security (RLS) enforced on all data tables, so each Customer's and Subject's data is isolated at the database layer. 2. Encryption of stored third-party API keys using a dedicated encryption key, separate from general application data. 3. Hashed API keys — service API keys are stored only as hashes, not in plaintext. 4. Per-Droid rate and spend limits to contain abuse and limit blast radius of compromised credentials. 5. Service-role isolation — privileged database roles are isolated from user-facing code paths and used only where required. 6. Prompt-injection input fencing — untrusted input (documents, intake text, web-research content) is fenced before being passed to AI models. 7. Deletion cascade — deleting a Subject or Droid cascades through all dependent records (profiles, logs, documents, personas). 8. Retention purge — automated purge of data past its retention period. 9. Encryption in transit (TLS) for all data exchanged with the service and Subprocessors. *(Standard measure; counsel to confirm inclusion.)* 10. Access control and confidentiality — access to Personal Data limited to personnel who need it, under confidentiality obligations (Section 5).

Annex C — Subprocessors

Authorized as of the effective date:

BYOK exception. If the Customer supplies its own Anthropic API key, AI processing via that key runs under the Customer's own Anthropic terms, and Anthropic is not an EpicMe Subprocessor for that processing (Section 7.5). EpicMe's role is limited to secure key handling per Annex B.

Changes to this list follow the notice and objection process in Section 7.

Signatures