Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between PineChat Inc., a company registered in New York, United States, with offices at 169 Madison Avenue STE 2590, New York, NY 10016 (“PineChat”), and the customer that has entered into a services agreement, order form, or pilot agreement referencing this DPA (the “Customer”). It is incorporated by reference into that underlying agreement and takes effect on its effective date.

This DPA applies whenever PineChat processes Customer Personal Data on the Customer’s behalf in connection with the PineChat services (the “Services”). Where PineChat processes the personal data of individual consumer users as an independent controller, that processing is governed by the PineChat Privacy Policy, not this DPA.

With respect to Customer Personal Data, the Customer is the controller (or a processor acting on behalf of a third-party controller) and PineChat is the processor.

“Customer Personal Data” means any personal data that PineChat processes on the Customer’s behalf in providing the Services, as described in Annex I.

“Data Protection Law” means all laws applicable to the processing of Customer Personal Data, including, to the extent applicable: the EU General Data Protection Regulation 2016/679 (“EU GDPR”); the UK GDPR and Data Protection Act 2018; the Swiss Federal Act on Data Protection; the California Consumer Privacy Act as amended by the CPRA (“CCPA”); and other US state privacy laws.

“Sub-processor” means any third party engaged by PineChat to process Customer Personal Data on the Customer’s behalf.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.

The terms “controller”, “processor”, “data subject”, “processing” and “supervisory authority” have the meanings given in the EU GDPR.

Documented instructions. PineChat shall process Customer Personal Data only on the Customer’s documented instructions, including with regard to international transfers, unless required to do otherwise by law (in which case PineChat shall inform the Customer before processing, unless legally prohibited). The underlying agreement, this DPA and the Customer’s configuration and use of the Services constitute the Customer’s complete instructions.

Purpose limitation. PineChat shall not sell, rent or otherwise monetize Customer Personal Data, and shall not use it for marketing, advertising, independent profiling, or any purpose other than providing the Services. PineChat shall process only the minimum Customer Personal Data necessary to provide the Services.

Compliance with law. Each party shall comply with its obligations under Data Protection Law in respect of the processing of Customer Personal Data.

Customer responsibilities. The Customer controls the nature and content of Customer Personal Data and warrants that it has provided all notices and obtained all consents or other lawful bases required to enable PineChat lawfully to process Customer Personal Data for the purposes of the Services.

PineChat shall ensure that all personnel authorized to process Customer Personal Data are bound by written confidentiality obligations and process Customer Personal Data only as needed to provide the Services.

PineChat shall implement and maintain the technical and organizational measures set out in Annex II, providing a level of security appropriate to the risk. PineChat may update those measures provided the level of protection is not materially reduced.

On the Customer’s written request (no more than once per year absent a security incident), PineChat shall provide a summary of its security measures and relevant supporting evidence, including any third-party audit reports it holds.

General authorization. The Customer grants PineChat general written authorization to engage the Sub-processors listed in Annex III to process Customer Personal Data in connection with the Services.

Notice and objection. PineChat shall maintain the current Sub-processor list at pinechat.ai/dpa (or a successor URL) and shall give the Customer at least fifteen (15) days’ prior notice of any new or replacement Sub-processor. The Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, the Customer may, as its sole remedy, terminate the affected Services without penalty.

Flow-down and liability. PineChat shall impose data-protection obligations on each Sub-processor that are no less protective than this DPA and shall remain liable to the Customer for each Sub-processor’s performance.

Taking into account the nature of the processing, PineChat shall assist the Customer by appropriate technical and organizational measures, insofar as possible, in responding to requests from data subjects to exercise their rights (access, rectification, erasure, restriction, portability, objection) within ten (10) business days of the Customer’s request, or sooner where required by Data Protection Law.

PineChat shall not respond directly to a data subject regarding Customer Personal Data unless legally required, and then only after notifying the Customer where permitted.

Taking into account the nature of processing and the information available to it, PineChat shall provide reasonable assistance to the Customer with data protection impact assessments and prior consultations with supervisory authorities, and with the Customer’s obligations in respect of security and Personal Data Breach notification, in each case in relation to PineChat’s processing of Customer Personal Data.

PineChat shall notify the Customer without undue delay, and in any event within seventy-two (72) hours, of becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification shall describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address and mitigate it. PineChat shall cooperate with the Customer’s investigation and any regulator or data-subject notifications required by law.

If PineChat receives a legally binding request from a government body or law-enforcement authority for disclosure of Customer Personal Data, PineChat shall, unless legally prohibited: (a) use reasonable efforts to redirect the requesting party to seek the data directly from the Customer; (b) promptly notify the Customer to allow it to seek a protective order or other remedy; (c) challenge any request that is over-broad or unlawful; and (d) disclose only the minimum Customer Personal Data necessary to satisfy a valid request.

Customer Personal Data is processed and stored in the United States. Where Data Protection Law restricts transfers of Customer Personal Data from the EEA, United Kingdom or Switzerland to a country without an adequacy decision, the parties shall rely on an appropriate transfer mechanism, including the EU Standard Contractual Clauses (Module Two: Controller to Processor) and, for UK transfers, the UK International Data Transfer Addendum, which are incorporated by reference and completed using the information in Annex I and Annex III. For Swiss transfers, references in the Standard Contractual Clauses are read as references to the Swiss FADP and the Swiss Federal Data Protection and Information Commissioner.

PineChat shall make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA and, where required by Data Protection Law, shall allow for and contribute to audits by the Customer or its independent auditor (under confidentiality obligations) no more than once in any twelve-month period, during business hours, on at least thirty (30) days’ notice, in a manner that does not unreasonably disrupt PineChat’s operations. PineChat may satisfy an audit request in the first instance by providing existing documentation or third-party audit reports (for example SOC 2 or ISO 27001 assessments).

To the extent the CCPA or another US state privacy law applies, PineChat acts as a “service provider” (or “processor”) and shall not: (a) sell or share Customer Personal Data; (b) retain, use or disclose it for any purpose other than providing the Services or as permitted by law; (c) retain, use or disclose it outside the direct business relationship with the Customer; or (d) combine it with personal information from other sources except as permitted by applicable law. PineChat shall notify the Customer if it can no longer meet these obligations.

On termination or expiry of the Services, PineChat shall, at the Customer’s choice, return or delete all Customer Personal Data within thirty (30) days, unless retention is required by law, in which case PineChat shall protect the data and process it only as legally required. Individual end users who elect to continue using PineChat under a direct consumer relationship after termination do so under the PineChat Privacy Policy, and their data ceases to be subject to the Customer’s instructions.

Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability in the underlying agreement; in the absence of such terms, PineChat’s aggregate liability under this DPA shall not exceed the total amounts paid or payable by the Customer for the Services in the twelve (12) months preceding the event giving rise to the claim. Nothing in this DPA limits liability that cannot lawfully be limited.

This DPA prevails over any conflicting terms of the underlying agreement with respect to the processing of Customer Personal Data. Provisions that by their nature survive termination (confidentiality, return and deletion, liability) shall survive. This DPA is governed by the laws of the State of Delaware, consistent with the PineChat Terms of Service, and disputes shall be resolved in the state or federal courts located in Sussex County, Delaware. PineChat may update this DPA to reflect legal or operational changes; the current version is always available at pinechat.ai/dpa, and material changes will be notified to Customers. Data-protection queries: privacy@pinechat.ai.