Data Processing Addendum

IMPORTANT NOTICE: 

1. DEFINITIONS

Controller:means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data. The Subscriber is the Controller with respect to Subscriber Data.

Data Breach:means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.

Data Processing Agreement:means this DPA and any annexes attached hereto.

Data Subject:means the identified or identifiable individual to whom Personal Data relates.

Data Subject Rights:means the rights of Data Subjects under the GDPR, including rights of access, rectification, erasure, restriction of processing, data portability, and objection.

GDPR:means Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data.

Personal Data:means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier.

Processing:means any operation performed on Personal Data, whether by automated means or not, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, making available, alignment, combination, restriction, erasure or destruction.

Processor:means the natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller. Aradyne is the Processor under this DPA.

Sub-processor:means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Processor under written contract.

Subscriber Data:means the electronic data or information submitted by the Subscriber, its Users, or Authorized Parties to the Service, including any Personal Data contained therein.

2. SCOPE AND PURPOSE OF PROCESSING

2.1 Scope.

This DPA applies to the Processing of Personal Data by Aradyne as a Processor acting on instructions from the Subscriber (the Controller) in connection with the provision of the PeakSpitz Software-as-a-Service (“Service”) as described in the Subscription Terms of Service.

2.2 Purpose.

Aradyne shall process Personal Data contained within Subscriber Data solely for the purposes of: (a) providing the Service; (b) preventing or addressing technical problems; (c) verifying and improving the Service; and (d) complying with applicable laws and this DPA, and only on the documented instructions of the Subscriber as set forth herein.

2.3 Special Categories of Personal Data; Clinical Data.

The Service is not provided for the Processing of special categories of personal data within the meaning of Article 9 of the GDPR, which are Prohibited Input Data under Section 6.9 of the Subscription Terms of Service, save for Clinical Data processed for a Subscriber for which the Clinical Data Schedule, available at https://eu.peakspitz.com/clinical-data, has been executed, in a Tenant for which Aradyne has enabled the Clinical Layer. For such Clinical Data, Part B of the Clinical Data Schedule supplements this DPA and sets out the particulars required by Article 28(3) of the GDPR; this DPA otherwise applies, and in the event of a conflict concerning Clinical Data, Part B of the Clinical Data Schedule prevails over this DPA.

3. PROCESSING INSTRUCTIONS

3.1 Subscriber as Controller.

The Subscriber is the Controller of all Personal Data contained in Subscriber Data. Aradyne shall process Personal Data only on the documented instructions of the Subscriber, including regarding the transfer of Personal Data outside the European Economic Area (EEA), unless required by Union or Member State law.

3.2 Instructions.

Instructions for processing shall include: (i) the nature of processing; (ii) the purpose of processing; (iii) categories of Data Subjects; (iv) categories of Personal Data; and (v) duration of processing. Such instructions are set forth in Annex 1 to this DPA.

3.3 Compliance with Instructions.

Aradyne shall immediately notify the Subscriber if an instruction, in Aradyne’s opinion, violates the GDPR or other data protection laws. Aradyne shall comply with the Subscriber’s instructions unless required otherwise by Union or Member State law.

4. OBLIGATIONS OF ARADYNE AS PROCESSOR

4.1 Processing only on Instructions.

Aradyne ensures that persons authorised to process Personal Data are subject to appropriate confidentiality undertakings or legal obligations of confidentiality. Aradyne shall not engage any Sub-processor without prior specific or general written authorization from the Subscriber.

4.2 Confidentiality and Security.

Aradyne shall ensure that employees or agents who have access to Personal Data are bound by obligations of confidentiality or are under an appropriate legal obligation of confidentiality. Aradyne shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including those set forth in Annex 2 to this DPA.

4.3 Assisting with Data Subject Rights.

Aradyne shall, taking into account the nature of the Processing, assist the Subscriber by implementing appropriate technical and organisational measures in fulfilling the Subscriber’s obligations to respond to Data Subject Rights requests, including rights of access, rectification, erasure, data portability, and objection to processing.

4.4 Assistance with Data Protection Impact Assessments (DPIAs).

Aradyne shall assist the Subscriber with data protection impact assessments and prior consultations with supervisory authorities as required under the GDPR, in particular by providing the Subscriber with information and technical details necessary to assess the risks and safeguards for the Processing.

4.5 Return or Deletion of Personal Data.

At the choice of the Subscriber, Aradyne shall, at the end of the provision of services relating to the Processing, delete or return all Personal Data to the Subscriber and delete existing copies unless Union or Member State law requires storage of the Personal Data.

4.6 Audit Rights and Compliance Certifications.

Aradyne shall make available all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits and inspections by the Subscriber or the Subscriber’s auditors. Aradyne shall provide the Subscriber with appropriate audit certifications, including ISO 27001 or equivalent security certifications, upon request.

5. SUB-PROCESSORS

5.1 Authorization and Notification.

The Subscriber provides Aradyne with a general written authorization to engage Sub-processors for the Processing of Personal Data, subject to this Section 5. Aradyne shall give the Subscriber at least thirty (30) days’ prior written notice of the intended addition or replacement of any Sub-processor — which notice may be given by email and/or by updating a Sub-processor list or notification page to which the Subscriber may subscribe — so as to give the Subscriber a reasonable opportunity to object, on reasonable grounds relating to data protection, before the new Sub-processor begins Processing Personal Data. Where a prompt replacement of a Sub-processor is required for security or other urgent reasons outside Aradyne’s reasonable control, Aradyne may replace the Sub-processor without prior notice and shall inform the Subscriber without undue delay thereafter.

5.2 Current Sub-processors.

The approved Sub-processors as of the date of this DPA are listed in Annex 3. Aradyne shall maintain this list and update it as required.

5.3 Right to Object.

If the Subscriber objects to the engagement of a new Sub-processor, the Subscriber may suspend use of the Service or terminate the Subscription Terms of Service without penalty, provided written notice is given within thirty (30) days of notification of the Sub-processor change.

5.4 Sub-processor Obligations.

Aradyne shall impose on Sub-processors, through binding written agreements, the same data protection obligations as are set out in this DPA, in particular with regard to confidentiality, security, and assistance with Data Subject Rights. Aradyne shall remain fully liable to the Subscriber for the performance of any Sub-processor’s obligations.

6. INTERNATIONAL DATA TRANSFERS

6.1 Transfer Mechanisms.

Where Aradyne or a Sub-processor Processes Personal Data outside the European Economic Area (EEA), the transfer shall be made under an appropriate transfer mechanism recognised under Chapter V of the GDPR, namely (in order of preference where more than one is available): (i) a transfer to a country, territory, or sector benefiting from an adequacy decision of the European Commission (including, for certified recipients in the United States, the EU–US Data Privacy Framework); (ii) the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 (the “EU SCCs”); or (iii) another lawful mechanism under the GDPR. The transfer mechanism applicable to each Sub-processor is summarised in Annex 3.

6.2 EU Standard Contractual Clauses.

Where the EU SCCs apply, they are incorporated into this DPA by reference and completed as follows: Module Two (controller to processor) applies to transfers from the Subscriber (as controller) to Aradyne (as processor), and Module Three (processor to sub-processor) applies to onward transfers from Aradyne to a Sub-processor; the optional docking clause (Clause 7) applies; the option under Clause 9(a) is general authorization with the time period stated in Section 5.1; the optional Clause 11(a) independent dispute-resolution mechanism does not apply; the governing law under Clause 17 and the forum under Clause 18 are those of the Republic of Cyprus (or, where Cyprus law does not permit, the law and courts of the EEA Member State of the competent supervisory authority); and Annexes I, II, and III to the EU SCCs are populated by Annexes 1, 2, and 3 to this DPA respectively. In the event of a conflict, the EU SCCs prevail over this DPA in respect of the transfer they govern.

6.3 EU–US Data Privacy Framework.

Where a US Sub-processor is certified under the EU–US Data Privacy Framework, Aradyne may rely on that adequacy decision as the transfer mechanism for the relevant Processing. Because the continued validity of the Data Privacy Framework is subject to ongoing legal and regulatory developments, Aradyne maintains the EU SCCs as a fallback with each such Sub-processor, which take effect automatically if and to the extent the Data Privacy Framework ceases to provide a valid basis for the transfer.

6.4 United Kingdom and Switzerland.

For transfers subject to the UK GDPR, the EU SCCs apply as supplemented by the International Data Transfer Addendum issued by the UK Information Commissioner under s.119A of the Data Protection Act 2018, and a transfer risk assessment is carried out where required. For transfers subject to the Swiss Federal Act on Data Protection (FADP), the EU SCCs apply with the modifications necessary under Swiss law (including that the Swiss Federal Data Protection and Information Commissioner is a competent authority, references to the GDPR are read as references to the FADP where applicable, and Swiss law and the Swiss courts govern in respect of Swiss transfers).

6.5 Transfer Impact Assessment; Supplementary Measures.

Aradyne has carried out, and keeps under review, a transfer impact assessment for transfers made under the EU SCCs, taking into account the European Data Protection Board Recommendations 01/2020, and implements supplementary technical, organisational, and contractual measures (including the encryption and access controls described in Annex 2) where appropriate. A copy of the current transfer impact assessment is available to the Subscriber on request.

6.6 Subscriber Acknowledgement.

The Subscriber acknowledges and authorises the transfers described in Annex 3 and the use of the transfer mechanisms described in this Section 6 as necessary to provide the Service.

7. DATA SECURITY

Aradyne shall implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data. These measures are detailed in Annex 2 and are appropriate to the risk presented by the Processing.

8. DATA BREACH NOTIFICATION

8.1 Notification Timeline.

Aradyne shall notify the Subscriber without undue delay, and in any event no later than forty-eight (48) hours, after becoming aware of a Data Breach affecting Personal Data, unless the Data Breach is unlikely to result in a risk to the rights and freedoms of Data Subjects. Aradyne shall provide the Subscriber with all information reasonably available and necessary for the Subscriber to meet its own obligations under the GDPR, supplementing the notification as further information becomes available. Such notification is not, and shall not be construed as, an admission of fault or liability by Aradyne.

8.2 Notification Content.

Aradyne’s notification shall include: (i) the nature of the Data Breach; (ii) categories and approximate number of Data Subjects affected; (iii) categories and approximate volume of Personal Data affected; (iv) likely consequences of the Data Breach; (v) measures taken or proposed to remedy the Data Breach and mitigate harm; and (vi) contact point for further information.

8.3 Cooperation.

Aradyne shall cooperate fully with the Subscriber and competent authorities in addressing the Data Breach, including provision of evidence and assistance with notifications to Data Subjects and regulatory authorities.

9. AI ASSISTANT AND AUTOMATED DATA PROCESSING

9.1 AI Processing Transparency.

The Service includes an AI Assistant that may process Personal Data to provide recommendations, analysis, and other AI-generated outputs. Aradyne shall: (i) clearly disclose to the Subscriber that Personal Data is processed by the AI Assistant; (ii) maintain transparency regarding the purpose, scope, and lawful basis for AI processing; (iii) not use Personal Data or outputs therefrom to train, fine-tune, or improve machine learning models without explicit written consent from the Subscriber.

9.2 Output Storage.

Aradyne shall not store AI-generated outputs (AI Outputs) for purposes of model training, improvement, or any purpose other than: (i) providing the Service to the Subscriber; (ii) improving the Service solely for the Subscriber’s benefit; and (iii) complying with applicable law. AI Outputs shall not be used for commercial advantage or shared with third parties without the Subscriber’s express written consent.

9.3 EU AI Act Compliance.

Aradyne has assessed the AI Assistant under the EU AI Act (Regulation (EU) 2024/1689) and has determined that it is not a high-risk AI system within the meaning of Article 6 and operates as a limited-risk AI system subject to the transparency obligations of Article 50. Aradyne maintains documentation of this assessment and provides transparency regarding: (i) the AI system’s purpose and design; (ii) the categories of Personal Data processed; (iii) the technical and organisational measures implemented to manage risks; and (iv) the right of Data Subjects to object to automated processing affecting them.

9.4 Third-Party Model Providers.

The AI Assistant relies on third-party foundation-model providers, engaged as Sub-processors and identified in Annex 3, to perform inference. Where the AI Assistant transmits Personal Data, or Subscriber prompts and inputs, to such a provider, Aradyne shall ensure, through binding written terms consistent with Section 5.4, that the provider: (i) processes such data solely to perform the requested inference and provide the Service, and for no other purpose; (ii) does not use the Subscriber’s prompts, inputs, or any Personal Data therein to train, fine-tune, or improve its foundation models or any other model, save with the Subscriber’s explicit written consent; (iii) is bound by obligations of confidentiality; and (iv) does not retain such data beyond the period necessary to perform the inference, save as required by applicable law. This Section 9.4 complements Sections 9.1 and 9.2, which govern Aradyne’s own handling of Personal Data and AI Outputs.

10. US PRIVACY LAWS

10.1 CCPA/CPRA Applicability.

To the extent that the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), applies to Aradyne’s Processing of Personal Data on behalf of the Subscriber, Aradyne shall be deemed a “service provider” as defined in Cal. Civ. Code § 1798.140(ag). Aradyne shall: (i) process Personal Data solely for the business purposes specified in this DPA and the Subscription Terms of Service; (ii) not “sell” or “share” (as those terms are defined under the CCPA) Personal Data received from or on behalf of the Subscriber; (iii) not retain, use, or disclose Personal Data for any purpose other than the business purposes specified in this DPA, including any commercial purpose other than providing the Service; (iv) not combine Personal Data received from the Subscriber with personal information received from other sources or collected from its own interactions with consumers, except as permitted by the CCPA; and (v) comply with applicable provisions of the CCPA and grant the Subscriber the right to take reasonable and appropriate steps to ensure that Aradyne uses Personal Data in a manner consistent with the Subscriber’s obligations under the CCPA.

10.2 Other US State Privacy Laws.

To the extent that any other US state privacy law (including the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and the Texas Data Privacy and Security Act, each as amended from time to time) applies to Aradyne’s Processing of Personal Data on behalf of the Subscriber, Aradyne shall fulfil the role of “processor” (or equivalent designation under the applicable law) and shall process Personal Data only on behalf of and pursuant to the documented instructions of the Subscriber, consistent with the obligations set forth in this DPA.

10.3 De-identification.

Aradyne shall not attempt to re-identify any de-identified data derived from Personal Data, except for the purpose of determining whether its de-identification processes comply with applicable law.

11. TERMINATION AND DATA HANDLING

11.1 End of Processing.

Upon termination or expiry of the Subscription Terms of Service, Aradyne shall, at the Subscriber’s choice: (i) securely delete all Personal Data (except where retention is required by law); or (ii) return all Personal Data in a structured, commonly used, machine-readable format.

11.2 Retention.

Aradyne shall not retain Personal Data longer than necessary to fulfil the purposes for which it was collected, except where retention is required by Union or Member State law, in which case Aradyne shall inform the Subscriber of the legal requirement, the purpose of retention, and the expected deletion date.

12. GOVERNING LAW AND JURISDICTION

This DPA shall be governed by the laws of the Republic of Cyprus and the GDPR. Both parties submit to the jurisdiction of the courts of Cyprus. In the event of any conflict between this DPA and the Subscription Terms of Service, the terms of this DPA shall prevail to the extent the conflict relates to the Processing of Personal Data, save as provided in Section 2.3.

13. LIABILITY

13.1 Allocation Between the Parties.

Each Party’s aggregate liability arising out of or related to this DPA — whether in contract, tort (including negligence), under Article 82 of the GDPR, or under any other theory — is subject to, and counts towards, the limitations and exclusions of liability set out in Section 11 of the Subscription Terms of Service, including the liabilities that cannot be excluded under Section 11.0 of that agreement. For the avoidance of doubt, the Processing of Personal Data under this DPA is not a breach of Sections 4, 5, 7, or 8 of the Subscription Terms of Service for the purpose of the exception to the liability cap in Section 11.2 of that agreement.

13.2 Article 82 GDPR Recourse.

Where one Party has paid compensation to a Data Subject under Article 82 of the GDPR, it is entitled to claim back from the other Party that part of the compensation corresponding to the other Party’s responsibility for the damage, in accordance with Article 82(5). As between the Parties, Aradyne’s liability under this Section 13.2 is limited to damage caused by Processing where Aradyne has not complied with obligations of the GDPR directed specifically to processors, or has acted outside or contrary to the Subscriber’s lawful documented instructions, within the meaning of Article 82(2).

13.3 Data Subjects’ Direct Rights Unaffected.

Nothing in this DPA or the Subscription Terms of Service limits or excludes the right of a Data Subject to receive full and effective compensation, or to bring a claim directly against either Party, under Article 82(1) of the GDPR.

13.4 Regulatory Proceedings.

Each Party shall promptly notify the other of any complaint, investigation, or enforcement action by a supervisory authority relating to the Processing under this DPA, and the Parties shall cooperate in good faith in responding. Each Party is responsible for any administrative fine imposed on it to the extent the fine is attributable to its own acts or omissions, without prejudice to either Party’s rights of recourse under applicable law.

ANNEX 1: DETAILS OF PROCESSING

Parameter	Description
Subject Matter	Processing of Subscriber Data containing Personal Data in accordance with the Subscription Terms of Service.
Duration	During the Term of the Subscription Terms of Service.
Purpose	Provision of the Service, support, maintenance, improving the Service, and compliance with legal obligations.
Categories of Data Subjects	Employees, contractors, customers, and other individuals whose data is uploaded by the Subscriber.
Types of Personal Data	Name, email address, contact information, and any other data uploaded by the Subscriber, as determined by the Subscriber’s use of the Service.
Special Categories of Personal Data	None. Special categories of personal data are Prohibited Input Data under Section 6.9 of the Subscription Terms of Service, save for Clinical Data under an executed Clinical Data Schedule, whose details of processing are set out in Part B of that Schedule.

ANNEX 2: TECHNICAL AND ORGANISATIONAL MEASURES

A. TECHNICAL MEASURES

Data Encryption:All Personal Data in transit is encrypted using Transport Layer Security (TLS 1.2 or higher). Personal Data at rest is encrypted using AES-256 encryption.

Access Controls:Role-based access control (RBAC) restricts access to Personal Data to authorized personnel only. Multi-factor authentication (MFA) is required for all access to systems containing Personal Data.

Audit Logging:All access to Personal Data is logged and retained for audit purposes. Logs include user identity, timestamp, action taken, and data accessed.

Intrusion Detection:Aradyne implements intrusion detection systems (IDS) and intrusion prevention systems (IPS) to monitor and prevent unauthorized access to systems processing Personal Data.

Vulnerability Management:Regular vulnerability assessments and penetration testing are conducted. Security patches and updates are applied promptly.

Data Backup and Redundancy:Personal Data is backed up regularly and stored in geographically redundant locations. Disaster recovery procedures are tested regularly.

B. ORGANISATIONAL MEASURES

Personnel Security:All personnel with access to Personal Data undergo background checks and receive data protection training. Personnel are bound by confidentiality agreements.

Data Protection Governance:A Data Protection Officer (DPO) is responsible for ensuring compliance with data protection laws. Regular data protection impact assessments are conducted.

Third-party Management:All Sub-processors are subject to written data protection agreements that impose obligations equivalent to this DPA. Sub-processors are audited regularly.

Incident Response:A documented incident response plan is in place and tested regularly. All Data Breaches are investigated and documented.

Sub-processor Audits:Sub-processors are audited annually or as required by contract to ensure compliance with data protection obligations.

ANNEX 3: APPROVED SUB-PROCESSORS

The following Sub-processors may process Personal Data under this DPA. This list is kept current in accordance with Section 5; Aradyne notifies the Subscriber of changes and the Subscriber may object as provided in Sections 5.1 and 5.3.

Transfer mechanisms. Subscriber Data forming part of the Service is hosted within the EEA by default. Sub-processors located within the EEA (including OVH, Mistral AI, Brevo/Mailjet, Green Cloud, JCC, and Viva) do not involve a restricted transfer. For Sub-processors that Process Personal Data outside the EEA (including Amazon Web Services, Microsoft Azure, Google Cloud Platform, Cerebras, Anthropic, Deepinfra, Apple, and Stripe), transfers are made under the EU SCCs and, where the recipient is certified, the EU–US Data Privacy Framework, in each case as described in Section 6, together with the UK and Swiss supplements where applicable.

Sub-processor Name	Service Provided	Processing Location	Data Categories
Amazon Web Services (AWS)	Cloud infrastructure and services	EU, US, Asia-Pacific regions	Personal Data
Microsoft Azure	Cloud infrastructure and services	EU, US, Asia-Pacific regions	Personal Data
Google Cloud Platform (GCP)	Cloud infrastructure and services	EU, US, Asia-Pacific regions	Personal Data
OVH	Cloud infrastructure and services	EU (France, Germany, Poland)	Personal Data
Cerebras	AI inference and processing	US	Personal Data
Anthropic	AI model provider and inference	US	Personal Data
Deepinfra	AI model hosting and inference	US, EU	Personal Data
Mistral AI	AI model provider	EU (France)	Personal Data
Apple	AI/ML services	US, EU	Personal Data
Brevo (formerly Sendinblue) / Mailjet	Transactional email and communications	EU (France)	Personal Data
Green Cloud	Cloud hosting	EU	Personal Data
Stripe	Payment processing	US, EU (Ireland)	Payment and billing data
JCC (JCC Payment Systems Ltd)	Card payment processing	Cyprus (EEA)	Payment and billing data
Viva (Viva.com)	Payment processing	EU (Greece)	Payment and billing data