Data Processing Addendum

This Data Processing Addendum (including its annexes, this "DPA") forms part of the agreement under which [Company legal name] ("Provider" or "Armada") provides the Service to the customer ("Customer"): our Terms of Service or a signed Master Services Agreement (the "Agreement"). It applies automatically when Customer accepts the Agreement and Provider processes Personal Data on Customer's behalf. Customers who need a countersigned copy can ask at [Legal email].

1. Definitions

Capitalized terms not defined here have the meanings given in the Agreement.

• Affiliate: any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity.
• Applicable Data Protection Laws: the privacy, data protection and data security laws that apply to Provider's Processing of Personal Data under the Agreement, including, as applicable, the GDPR, the FADP and the State Privacy Laws.
• Controller: the entity that, alone or jointly with others, determines the purposes and means of the Processing of Personal Data, including a "business" or "controller" under the State Privacy Laws.
• Customer Data: information provided or made available by or on behalf of Customer to Provider for Processing on Customer's behalf to perform the Service, including data Employees read from Customer's connected services and computers.
• Data Subject: the identified or identifiable natural person to whom Personal Data relates.
• Employee: an AI employee Customer hires in the Service.
• FADP: the Swiss Federal Act on Data Protection of 25 September 2020; FDPIC: the Swiss Federal Data Protection and Information Commissioner.
• GDPR: as applicable, (i) Regulation (EU) 2016/679 ("EU GDPR") and (ii) the EU GDPR as it forms part of UK law ("UK GDPR"), with any implementing or supplementary legislation (such as the UK Data Protection Act 2018).
• Information Security Incident: a breach of Provider's security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in Provider's possession or control. It does not include unsuccessful attempts that do not compromise Personal Data, such as failed log-ins, pings or port scans.
• Personal Data: Customer Data that is "personal data", "personal information" or similar under Applicable Data Protection Laws, excluding information about Customer's own users that Provider processes as a controller under its Privacy Policy.
• Process or Processing: any operation performed on Personal Data, whether or not by automated means.
• Processor: the entity that Processes Personal Data on behalf of a Controller, including a "service provider" or "contractor" under the State Privacy Laws.
• Restricted Transfer: a transfer of Personal Data from the EEA, the UK or Switzerland to a country without an adequacy decision under the relevant law.
• SCCs: the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• State Privacy Laws: the comprehensive U.S. state privacy laws and their regulations that apply to Provider's Processing of Personal Data under the Agreement.
• Subprocessor: an Affiliate or third party that Provider engages to Process Personal Data for the Service.
• UK Transfer Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022), as revised.

2. Duration and scope

This DPA stays in effect while Provider Processes Personal Data, even after the Agreement ends. Processing subject to the GDPR or the FADP is also subject to Annex 2; Processing subject to the State Privacy Laws is also subject to Annex 3.

3. Customer instructions

Provider Processes Personal Data only on Customer's documented instructions. Customer's instructions consist of this DPA, the Agreement, and the configuration and requests Customer makes in the Service: the Employees it hires, the services and computers it connects, the apps it allows, the tasks it gives, and the actions it approves. Provider will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws. Instructions outside the scope of the Service require a written agreement between the Parties. The details of the Processing are in Annex 1.

4. Security

• Security measures. Provider implements and maintains the technical and organizational measures described in Annex 4, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the Processing and the risks to Data Subjects. Provider may update them provided the overall protection of Personal Data is not materially reduced.
• Personnel. Provider requires personnel authorized to access Personal Data to be bound by confidentiality, and limits that access to what is needed to provide and support the Service.
• Information Security Incidents. Provider will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of an Information Security Incident, with the details then known, the steps taken to mitigate it and any steps Provider recommends Customer take. Provider will reasonably cooperate with Customer's investigation. Notification is not an acknowledgment of fault. Customer is responsible for notifications to authorities and Data Subjects that the law requires of it.

5. Customer's security responsibilities

Customer is responsible for its use of the Service, including: configuring Employees' permissions, approval rules and allowances appropriately to the risk; securing the credentials, accounts and devices it uses to access the Service; securing the computers it connects to Armada Desk and deciding which apps Employees may use on them; and keeping its own backups where needed. Customer has assessed the Service and the measures in Annex 4 and considers them appropriate for its Personal Data.

6. Data Subject requests

Provider will provide Customer with reasonable assistance, taking into account the nature of the Processing, to respond to requests from Data Subjects to exercise their rights. Many requests can be handled by Customer directly in the Service (for example by deleting content or disconnecting a service). If Provider receives a request directly, it will tell the Data Subject to contact Customer and notify Customer, unless the law prohibits this. Assistance beyond the Service's features may be charged at Provider's then-current rates, quoted in advance.

7. Customer responsibilities

• Customer is responsible for having a lawful basis for the Processing and for giving the notices and obtaining the consents Applicable Data Protection Laws require, including informing people whose data Employees will handle and people who use computers Customer connects.
• Credentials and payment data. Customer may provide logins, payment cards and similar credentials only through the Service's saved-access features, which are designed and protected for them (see Annex 4).
• Restricted Data. Unless agreed in writing, Customer will not use the Service to Process: protected health information subject to HIPAA or other health or medical information; government identification numbers; biometric or genetic data; personal data of children under 16; or other special categories of data under Article 9 or 10 of the GDPR ("Restricted Data"). For health information, the Parties must first sign a business associate agreement.

8. Subprocessors

• Authorization. Customer authorizes Provider to engage Subprocessors, including those listed in Annex 5.
• Requirements. Provider will bind each Subprocessor by a written contract with data protection obligations no less protective than this DPA, to the extent applicable to its services, and remains responsible for its Subprocessors' performance.
• Changes. Provider will give at least 15 days' notice before engaging a new Subprocessor, by updating Annex 5 and notifying Customer in the Service or by email. If Customer objects on reasonable data protection grounds within that period, the Parties will try in good faith to resolve the objection; failing that, Customer may terminate the affected Service and receive a refund of any prepaid amounts for it.

9. Audits

Provider will make available the information reasonably necessary to demonstrate compliance with this DPA and allow audits once a year (and when a supervisory authority requires it), on at least 30 days' written notice with a proposed audit plan. Audits take place in business hours, under confidentiality, without unreasonably disrupting Provider's business, and at Customer's cost. Where a recent independent audit report or certification covers the controls in question, Customer will accept it in place of an audit of those controls. Provider may object to an auditor who is a competitor or not independent.

10. Return and deletion

When the Service ends, Provider will stop Processing Personal Data except as needed to return or delete it. On Customer's request made within 30 days, Provider will return a copy of Customer's Personal Data in a commonly used format, and then delete it. Otherwise, Provider will delete or anonymize it within a commercially reasonable time after that period. Provider may keep Personal Data where the law requires, keeping it confidential and protected, Processing it only for that purpose and deleting it once no longer required. Copies in backups are deleted on their normal cycle and are not used in the meantime.

11. Artificial intelligence

• Provider will not use Personal Data to train, fine-tune or develop any AI or machine-learning model, whether its own or a third party's, except as needed to provide the Service on Customer's instructions or as Customer authorizes in writing.
• Provider prohibits its Subprocessors, including AI model providers, from using Personal Data to train, fine-tune or develop their models.
• Notes Employees keep from their work are part of Customer Data, remain in Customer's workspace, and are shared outside it only if Customer turns on a sharing setting.
• The Service does not make decisions about Data Subjects that produce legal or similarly significant effects on Provider's own initiative. Where Customer configures Employees to take part in such decisions, Customer is responsible for meaningful human review and for Data Subjects' related rights, and Provider will reasonably cooperate.

12. General

• Except as this DPA modifies it, the Agreement stays in full force. Provider's access to Personal Data is not part of the consideration for the Agreement.
• Notices under this DPA may be given under the Agreement's notice clause, to the data protection contacts in Annex 1, or in the Service.
• Provider may update this DPA on notice where necessary to comply with Applicable Data Protection Laws, including to replace the SCCs, provided the update does not materially reduce the protection of Personal Data or materially increase Customer's obligations.
• Each Party's liability under this DPA and the SCCs is subject to the limitations in the Agreement, except that nothing limits Data Subjects' rights under the SCCs' third-party beneficiary provisions.
• If this DPA conflicts with the Agreement, this DPA prevails; if the SCCs conflict with this DPA or the Agreement, the SCCs prevail for the transfers they cover.

Annex 1: Data processing details

Provider (data importer): [Company legal name], [Company address]. Data protection contact: [Privacy email]. Activities: providing the Service, AI employees that work in Customer's connected services and on Customer's computers under Customer's permissions and approvals. Role: processor (or subprocessor, where Customer is itself a processor).

Customer (data exporter): the entity that accepted the Agreement, at the address and data protection contact given in its account. Activities: using the Service in its business. Role: controller (or processor on behalf of its own clients).

Categories of Data Subjects: Customer's personnel and other users of its workspace; Customer's customers, prospects, suppliers and other contacts whose data appears in Customer's connected services, Employees' mailboxes, documents or computer screens; and any other individuals whose data Customer instructs Employees to handle.

Categories of Personal Data: contact details and identifiers; content of emails, messages, documents, records and files in Customer's connected services and apps; images of computer screens captured while Employees work in allowed apps, with the steps taken; requests, instructions and approvals; logins, payment card details and other details Customer saves for Employees; transaction and payment details for payments Customer approves; and technical data such as device and app identifiers.

Sensitive data: none intended (see Section 7). Credentials and payment card details are handled only through saved-access features with the safeguards in Annex 4, and each Employee's policy can require that a person types them every time.

Frequency: continuous, as Customer uses the Service.

Nature and purpose: collection, storage, retrieval, analysis by AI models, transmission to the services and recipients Customer directs, display, recording for audit and replay, and deletion, to perform the tasks Customer gives its Employees and to provide, secure and support the Service.

Duration and retention: for the term of the Agreement and as set out in Section 10; content is kept until Customer deletes it or closes its workspace.

Transfers to Subprocessors: as listed in Annex 5, for the purposes described there.

Annex 2: European annex

1. Processing. 1.1 Where Provider receives an instruction from Customer that, in its reasonable opinion, infringes the GDPR, Provider shall inform Customer. 1.2 Customer shall ensure its instructions comply with the GDPR and all other applicable laws.

2. Impact assessments and prior consultation. Provider shall provide reasonable assistance to Customer, at Customer's cost and on written request, with any data protection impact assessments and prior consultations with supervisory authorities required of Customer under Articles 35 and 36 of the GDPR, in relation to Provider's Processing of Personal Data.

3. Restricted Transfers.

3.1 EU Restricted Transfers. To the extent Processing involves an EU Restricted Transfer from Customer to Provider, the Parties shall comply with the SCCs, which are deemed populated in accordance with Part 1 of Attachment 1 and entered into by the Parties and incorporated into this DPA.

3.2 UK Restricted Transfers. To the extent Processing involves a UK Restricted Transfer, the Parties shall comply with the SCCs as varied by the UK Transfer Addendum and populated in accordance with Part 2 of Attachment 1, which are deemed entered into and incorporated into this DPA.

3.3 Swiss Restricted Transfers. To the extent Processing involves a Swiss Restricted Transfer, the Parties shall comply with the SCCs as varied for the FADP in accordance with Part 3 of Attachment 1, which are deemed entered into and incorporated into this DPA. Nothing limits Data Subjects' right under Clause 18(c) of the SCCs to bring proceedings in Switzerland where they habitually reside there.

3.4 New transfer mechanisms. Provider may, on notice, replace the SCCs with a new or replacement form of standard clauses, or another valid transfer mechanism, provided it does not materially reduce the protection of Personal Data.

3.5 Full-form SCCs. On specific written request supported by evidence that a supervisory authority, Data Subject or further controller requires it, Provider will provide an executed copy of the relevant SCCs for countersignature.

3.6 Operational clarifications. Customer shall protect Provider's trade secrets and confidential information when complying with Clause 8.3 of the SCCs. For Clause 10(a) of Module Three, notifying any third-party controller of a Data Subject request is Customer's responsibility. For Clause 15.1(a), notifying Data Subjects is Customer's responsibility. Section 8 of this DPA applies to Subprocessors under the SCCs, and any approval of a Subprocessor under it constitutes Customer's instruction for onward transfers under Clause 8.8. Audits under Clauses 8.9(c) and 8.9(d) are subject to Section 9. Certification of deletion under Clauses 8.5 and 16(d) is provided on Customer's written request.

Attachment 1 to Annex 2: population of the SCCs

Part 1: EU. (1) The Parties are deemed to have signed the SCCs at the signature block in Annex I to their Appendix. (2) Module Two applies where Customer is a controller; Module Three applies where Customer is a processor. (3) Clause 7 (docking clause) is not used. In Clause 9, Option 2 (general written authorization) applies with the notice period in Section 8 of this DPA (currently 15 days). The optional language in Clause 11 is not used. In Clause 13, all square brackets are removed and the text kept. In Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland. Under Clause 18, disputes are resolved by the courts of Ireland. (4) Annex I to the Appendix is populated with Annex 1 of this DPA, with Customer as data exporter and Provider as data importer. The competent supervisory authority is: that of the EU Member State where Customer is established; if Customer is not established in the EU but has appointed an EU representative under Article 27 GDPR, that of the Member State where the representative is based; otherwise, that of the Member State Customer notifies to Provider's data protection contact in which the relevant Data Subjects are located. Annex II to the Appendix is populated with Section 4 and Annex 4 of this DPA; Customer requests assistance with Data Subject requests through Provider's data protection contact in Annex 1. Provider binds its Subprocessors by contract to obligations that in substance meet or exceed those of the SCCs and this DPA, including security measures, incident notification, return or deletion of Personal Data, and the engagement of further Subprocessors.

Part 2: UK. Where the SCCs apply to UK Restricted Transfers, they are varied by the UK Transfer Addendum: Tables 1 to 3 are populated with Annex 1 of this DPA and Part 1 above; in Table 4, the "Data Importer" box is deemed ticked; and the Parties agree to be bound by the Mandatory Clauses of the UK Transfer Addendum.

Part 3: Switzerland. Where the SCCs apply to Swiss Restricted Transfers, "GDPR" means the FADP, "European Union", "Union" and "Member State" mean Switzerland, and "supervisory authority" means the FDPIC.

Annex 3: State Privacy Laws annex

1. Terms such as "business", "controller", "processor", "commercial purpose", "sell", "share", "service provider" and "contractor" have the meanings given in the State Privacy Laws, and "personal information" means Personal Data governed by them.

2. Provider is a service provider, contractor and/or processor of personal information. Provider: (a) acknowledges that Customer discloses personal information only for the limited and specified purposes in the Agreement; (b) will comply with its obligations under the State Privacy Laws and provide the same level of privacy protection they require; (c) agrees Customer may take reasonable steps to ensure Provider's Processing is consistent with Customer's obligations; (d) will notify Customer if it can no longer meet its obligations; and (e) agrees Customer may, on reasonable notice, take reasonable steps to stop and remediate unauthorized use of personal information.

3. Provider will not: (a) sell or share personal information; (b) retain, use or disclose it for any purpose other than providing the Service, or as the State Privacy Laws otherwise permit; (c) retain, use or disclose it outside the direct business relationship with Customer; or (d) combine it with personal information received from others or collected from Provider's own interactions with the Data Subject, except as the State Privacy Laws permit and as needed to provide the Service. Provider certifies that it understands and will comply with these restrictions.

4. Notice of Subprocessors under Section 8 satisfies Provider's obligation to give notice of and an opportunity to object to them. Customer may audit under Section 9.

Annex 4: Security measures

Encryption. Connected-service access, saved logins, payment cards, two-factor secrets and other secrets are encrypted at rest with AES-256-GCM, with a random nonce per value and the value's field bound in, so a value copied elsewhere fails to decrypt. All traffic between users, apps, computers and the Service is encrypted in transit (TLS).

Least privilege for Employees. Employees never hold raw credentials: a token broker issues a short-lived token only at the moment an authorized action runs, scoped to that Employee's permissions. Each Employee may use only the services and the apps Customer allows, and on a computer only the exact copy of an allowed app.

Human control. Changes can be held for approval, and payments always are; an approval authorizes one action with its exact parameters. Work in an app on a computer pauses as soon as a person touches the mouse or keyboard. Employees on probation have every change approved. Employees whose behavior is anomalous are paused.

Saved access. Each Employee's policy for saved details is set by Customer (may keep, ask every time, or a person always types them). Logins are filled only on the website they belong to.

Screening. Work arriving from outside (such as emails and messages) is screened for prompt attacks aimed at Employees before an Employee sees it.

Access and accounts. Users sign in with email and password through a managed identity provider that stores passwords hashed; two-factor sign-in is available; sessions are listed and can be ended; workspace roles limit what each person can see and do.

Logging and audit. Every Employee action, approval and change is recorded in an audit trail available to Customer; work in apps on computers can be replayed step by step.

Separation. Each workspace's data is logically separated, and every request is authorized against the workspace it concerns.

Infrastructure. The Service runs on Google Cloud, which provides the physical and environmental security of its data centers, network protections and resilience under its own certified security program. Provider applies security updates to its systems and dependencies and keeps backups to recover from failures.

Personnel and incidents. Access by Provider personnel to Customer Data is limited to what is needed to operate and support the Service and is bound by confidentiality. Provider maintains procedures to detect, investigate, contain and notify Information Security Incidents.

Annex 5: List of subprocessors

Services Customer connects (such as its email, chat, calendar, code hosting or accounting providers) are not Provider's Subprocessors; Customer engages them directly, and Employees send data to them on Customer's instructions.

---

Effective October 20, 2026. Based on a template by General Legal, PC (general.legal), provided for general reference and not legal advice.