Data Processing Addendum

1. Scope

1.1. Applicability. This DPA applies only to personal data that an Organization submits through the Site relating to individuals other than the person making the submission, such as sample data or other materials shared so that Canan AI can evaluate or demonstrate its products or services, or files attached to a support or sales inquiry, and that Canan AI Processes on the Organization’s behalf (“Organization Personal Data”). This DPA does not apply to: (a) personal data that Canan AI collects about visitors to the Site or about the individuals who submit information through the Site (such as their contact details), which Canan AI Processes as an independent controller in accordance with its Privacy Policy; or (b) personal data Processed in connection with any Canan AI product or service provided under a separate agreement, which is governed by the data protection terms of that agreement.

1.2. Roles of Parties. With respect to Organization Personal Data that constitutes “personal data,” “personal information,” “personally identifiable information,” or any analogous term under applicable Data Protection Law, Organization is the “controller” and “business” (as such terms are defined under applicable Data Protection Law), and Canan AI is the “processor” and “service provider” (as such terms are defined under applicable Data Protection Law). If Organization acts as a processor on behalf of a third-party controller, Canan AI acts as Organization’s subprocessor. Each Party will comply with its respective obligations under applicable privacy and data protection laws, including, as applicable, Regulation (EU) 2016/679 (the “GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act (“CCPA”) and other U.S. state privacy laws (collectively, “Data Protection Law”), in connection with Organization Personal Data. “Process” and “Processing” have the meanings given in Data Protection Law.

1.3. Scope of Processing. The subject matter, nature, and purpose of Canan AI’s Processing of Organization Personal Data, the types of Organization Personal Data Processed by Canan AI, and the categories of applicable data subjects are set out in Schedule I.

1.4. Conflicts in Interpretation. If there is any inconsistency or conflict between this DPA and any other provision of the Terms with respect to Organization Personal Data, the terms of this DPA will control to the extent of such inconsistency or conflict.

2. Organization Personal Data

2.1. Processing on Documented Instructions. Canan AI will only Process Organization Personal Data for the purpose for which Organization submitted it through the Site and in accordance with Organization’s documented instructions, which are set forth in this DPA, the Terms, the purpose Organization communicates when submitting Organization Personal Data, or otherwise provided by Organization to Canan AI in writing (“Documented Instructions”). Instructions that go beyond the scope of this DPA require Canan AI’s prior written agreement. Unless prohibited by applicable law, Canan AI will inform Organization if Canan AI is subject to a legal obligation that requires Canan AI to Process Organization Personal Data in contravention of the Documented Instructions, and will inform Organization if, in Canan AI’s opinion, an instruction infringes Data Protection Law.

2.2. Organization Responsibilities. Organization is responsible for the lawfulness of Organization Personal Data and of its submission to Canan AI. Organization represents and warrants that it (a) has provided all notices and obtained all consents, authorizations, and other lawful bases required under Data Protection Law for Canan AI to Process Organization Personal Data as described in this DPA, and (b) will submit only the Organization Personal Data reasonably necessary for the purpose of the submission. Organization will not submit through the Site any special categories of personal data or sensitive personal data (as defined under Data Protection Law), government identification numbers, financial account or payment card information, or personal data of children, unless Canan AI has first agreed in writing.

2.3. Canan AI Responsibilities. Canan AI will not (a) “sell” or “share” (as such terms are defined in the CCPA) Organization Personal Data, (b) retain, use, or disclose Organization Personal Data for any purpose other than in accordance with the Documented Instructions, (c) retain, use, or disclose Organization Personal Data outside of the direct business relationship between Organization and Canan AI, nor (d) except as otherwise permitted under applicable Data Protection Law, combine Organization Personal Data with personal data that Canan AI receives from or on behalf of any third party or collects from its own interactions with individuals. Canan AI certifies that it understands and will comply with these restrictions. Canan AI will notify Organization if it determines that it can no longer meet its obligations under Data Protection Law. Upon reasonable notice, Organization may take reasonable and appropriate steps to ensure that Canan AI Processes Organization Personal Data consistently with Data Protection Law and to stop and remediate any unauthorized Processing, including by instructing Canan AI to delete Organization Personal Data.

2.4. Personnel. Canan AI will ensure that persons it authorizes to Process Organization Personal Data are subject to appropriate obligations of confidentiality.

2.5. Deletion. Upon Organization’s written request, or once Organization Personal Data is no longer needed for the purpose for which it was submitted, Canan AI will delete Organization Personal Data (or, if Organization so requests in writing before deletion, return it) within a commercially reasonable period, unless applicable law requires Canan AI to retain it. Copies held in backups will be deleted in accordance with Canan AI’s normal backup cycles and will remain protected in accordance with this DPA until deleted. Upon request, Canan AI will confirm deletion in writing.

3. Assistance

3.1. Data Subject Rights. Canan AI will (a) promptly forward to Organization any request it receives from “data subjects” or “consumers” (as such terms are defined under applicable Data Protection Law) to exercise their rights under applicable Data Protection Law relating to Organization Personal Data, (b) advise such data subjects and consumers to submit such requests directly to Organization, and (c) taking into account the nature of the Processing, provide Organization with reasonable assistance as necessary for Organization to fulfil its obligations under applicable Data Protection Law to respond to such requests.

3.2. Cooperation. Taking into account the nature of the Processing and the information available to Canan AI, Canan AI will provide Organization with reasonable assistance as necessary for Organization to fulfil its obligations under applicable Data Protection Law, including to conduct data protection impact assessments and, where necessary, consultations with regulatory authorities with jurisdiction over such Processing, if such consultation is required by Data Protection Law.

3.3. Fees. Canan AI may charge Organization a reasonable fee for assistance under Sections 3.1(c) and 3.2, except where the need for such assistance results from Canan AI’s breach of this DPA.

4. Security

4.1. Security Measures. Canan AI has implemented and will maintain reasonable and appropriate technical and organizational security measures designed to protect the security of Organization Personal Data, including the measures described in Annex II (“Security Measures”). The Parties acknowledge that the Security Measures provide an appropriate level of security for the risks of the Processing of Organization Personal Data under this DPA. Canan AI may update or modify the Security Measures provided that such updates and modifications do not materially decrease the overall security of Organization Personal Data.

4.2. Security Incident. Canan AI will notify Organization without undue delay and in any case within 72 hours after becoming aware of any accidental or unauthorized access to, or disclosure or use of, Organization Personal Data (“Security Incident”). Canan AI will send such notice to the email address Organization provided when submitting Organization Personal Data or that Organization otherwise designates in writing. Canan AI will assist Organization in complying with Organization’s obligations under applicable Data Protection Law by making reasonable efforts to provide Organization with information relating to the Security Incident as it becomes available. Canan AI will also use reasonable efforts to investigate the Security Incident and mitigate the effects and remediate the causes of the Security Incident. Canan AI’s notification of or response to a Security Incident will not be construed as an acknowledgment by Canan AI of any fault or liability.

4.3. Security Information and Audits.

(a) Security Information. Upon Organization’s written request, no more than once every 12 months, Canan AI will provide information reasonably necessary to demonstrate Canan AI’s compliance with this DPA, which may include written responses to a reasonable security questionnaire, summaries of Canan AI’s relevant security policies, and any third-party audit reports or certifications that Canan AI makes generally available (“Security Information”). Security Information is Canan AI’s confidential information.

(b) Additional Audits. Organization may audit Canan AI’s controls applicable to its Processing of Organization Personal Data and compliance with this DPA, including through an on-site inspection (“Audit”), only if (i) the Security Information is not sufficient to demonstrate Canan AI’s compliance with this DPA and Data Protection Law requires such an Audit, (ii) a competent supervisory authority requires such an Audit, or (iii) the Audit follows a Security Incident affecting Organization Personal Data. Any Audit must be (A) conducted by Organization or by an independent third-party auditor designated by Organization that is not a competitor of Canan AI and that has executed an appropriate confidentiality agreement with Canan AI, (B) conducted at Organization’s sole cost, including reimbursement of Canan AI’s reasonable costs and personnel time spent supporting the Audit, (C) requested with at least thirty (30) days’ prior written notice, except where a supervisory authority requires a shorter period, (D) conducted during normal business hours and in a manner that causes minimal disruption, (E) conducted no more than once every 12 months, unless required by a supervisory authority or following a Security Incident, and (F) conducted in accordance with mutually agreed upon scope and terms, including the start date, scope and duration of, and security and confidentiality controls applicable to, the Audit.

(c) Use of Results. Organization may use Security Information and the results of an Audit only for the purposes of meeting Organization’s regulatory audit requirements and/or confirming compliance with the requirements of this DPA. The Parties agree that the audits described in Clause 8.9 of the EU SCCs (defined below) will be carried out in accordance with this Section 5.3.

5. International Data Transfers

5.1. Data Transfers. Organization authorizes Canan AI to conduct transfers of Organization Personal Data to countries deemed to have an adequate level of data protection by the European Commission or the applicable competent regulatory authority, on the basis of adequate safeguards in accordance with Data Protection Law, or pursuant to (a) the contractual clauses annexed to the European Commission’s Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as amended, superseded, or replaced from time to time (“EU SCCs”) or (b) the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, Version B1.0, in force 21 March 2022, as amended, superseded or replaced from time to time (“UK Addendum”).

5.2. EU Data Transfers. For transfers of Organization Personal Data from the European Economic Area, Canan AI and Organization conclude Module 2 (controller-to-processor) of the EU SCCs and, if Organization is a processor on behalf of a third-party controller, Module 3 (processor-to-processor) of the EU SCCs, which are incorporated herein and completed as follows: (a) the “data exporter” is Organization, (b) the “data importer” is Canan AI, (c) the optional docking clause in Clause 7 is implemented, (d) option 2 of Clause 9(a) is implemented and the time period therein is specified in Section 3.2, (e) the optional redress clause in Clause 11(a) is struck, (f) option 1 in Clause 17 is implemented, (g) the governing law is the law of Ireland and the courts in Clause 18(b) are the Courts of Dublin, Ireland, and (h) Annex I and Annex II to Modules 2 and 3 of the EU SCCs are Schedule I and Annex II of this DPA, respectively. For transfers of Organization Personal Data from Switzerland, the EU SCCs apply as completed above, with references to the GDPR read as references to the Swiss Federal Act on Data Protection, any dispute arising from these EU SCCs relating to Swiss Data Protection Law will be resolved by the courts of Switzerland, and data subjects who have their habitual residence in Switzerland may bring claims under the EU SCCs before the courts of Switzerland.

5.3. UK Data Transfers. For transfers of Organization Personal Data from the United Kingdom, Canan AI and Organization conclude the UK Addendum, which is incorporated herein and completed as follows: (a) in Table 1, the “Exporter” is Organization and the “Importer” is Canan AI, and their details are set forth in this DPA and the Terms, (b) in Table 2, the first option is selected and the “Approved EU SCCs” are the EU SCCs referred to in Section 5.2, (c) in Table 3, Annexes 1 (A and B) and II to the “Approved EU SCCs” are Schedule I and Annex II of this DPA, respectively, and (d) in Table 4, both the “Importer” and the “Exporter” can terminate the UK Addendum.

5.4. Conflict. If there is any conflict between this DPA and the EU SCCs or the UK Addendum, the EU SCCs or the UK Addendum, as applicable, will prevail.

6. Liability

Each Party’s liability arising out of or relating to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the exclusions and limitations of liability in the Terms. Nothing in this Section 6 limits either Party’s liability to data subjects under the EU SCCs or the UK Addendum to the extent such limitation is not permitted by Data Protection Law.

7. Term and Changes

This DPA remains in effect for as long as Canan AI Processes Organization Personal Data and will automatically terminate once all Organization Personal Data has been deleted or returned in accordance with Section 2.5. Canan AI may update this DPA by posting a revised version on the Site, provided that, unless required by applicable law, no update will materially reduce the protection of Organization Personal Data submitted before the update.

Schedule I

Description of Processing

1. List of Parties

Data exporter:

Name: Organization, with the name, address, and contact details Organization provides when submitting Organization Personal Data through the Site.

Activities relevant to the data transferred under these Clauses: Organization submits Organization Personal Data through the Site for purposes such as an evaluation or demonstration of Canan AI’s products or services, or a support or sales inquiry.

Role (controller/processor): Controller (or, where Module 3 applies, processor on behalf of a third-party controller).

Signature and date: Organization’s submission of Organization Personal Data through the Site constitutes its signature of, and agreement to, the EU SCCs and UK Addendum as of the date of submission.

Data importer:

Name: Canan AI, 8 The Green, Suite G, Dover, DE 19901. Contact: privacy@cananai.com.

Activities relevant to the data transferred under these Clauses: Canan AI Processes Organization Personal Data on behalf of Organization for the purpose for which Organization submitted it through the Site.

Role (controller/processor): Processor on behalf of Organization.

Signature and date: Canan AI’s Processing of Organization Personal Data constitutes its signature of, and agreement to, the EU SCCs and UK Addendum as of the date of submission.

2. Categories of Data Subjects

Individuals whose personal data Organization chooses to submit through the Site, which may include Organization’s employees, contractors, customers, end users, and other business contacts.

3. Categories of Personal Data Transferred

Organization Personal Data, the content of which is determined and controlled by Organization, which may include contact details, professional information, and other personal data contained in sample data or other materials Organization chooses to submit.

4. Sensitive Data Transferred (If Applicable)

None. Organization will not submit sensitive data through the Site except as permitted under Section 2.2.

5. Frequency of the Transfer

On a one-off or occasional basis, depending on Organization’s submissions through the Site.

6. Nature of the Processing

Receipt, storage, access, review, analysis, and deletion of Organization Personal Data as necessary to fulfil the purpose for which it was submitted, as described in the Terms and this DPA.

7. Purpose(s) of the International Data Transfer and Further Processing

To respond to Organization’s request, such as conducting an evaluation or demonstration of Canan AI’s products or services, or responding to a support or sales inquiry.

8. Duration of Processing

Organization Personal Data will be retained only for as long as necessary for the purpose for which it was submitted, and then deleted in accordance with Section 2.5 of this DPA, subject to any retention required by applicable law.

9. Sub-Processor Transfers

For the subject matter and nature of the Processing, reference is made to the Terms and this DPA. The Processing will take place for as long as Canan AI Processes Organization Personal Data under this DPA.

10. Competent Supervisory Authority

The competent authority for the Processing of Organization Personal Data relating to data subjects located in the EEA is the Supervisory Authority of Ireland.

The competent authority for the Processing of Organization Personal Data relating to data subjects located in the UK is the UK Information Commissioner.

The competent authority for the Processing of Organization Personal Data relating to data subjects located in Switzerland is the Swiss Federal Data Protection and Information Commissioner.

Annex II

Technical and Organizational Measures

Canan AI implements the following measures, which are designed to protect the security, confidentiality, and integrity of Organization Personal Data:

• Encryption: Organization Personal Data is encrypted in transit using industry-standard protocols (such as TLS) and encrypted at rest where supported by Canan AI’s infrastructure providers.

• Access Controls: Access to Organization Personal Data is limited to personnel who need it to fulfil the purpose of the submission, using unique credentials and multi-factor authentication for administrative access where supported.

• Personnel: Personnel with access to Organization Personal Data are bound by confidentiality obligations.

• Infrastructure: Organization Personal Data is hosted with reputable cloud infrastructure providers that maintain industry-recognized security certifications.

• Vulnerability Management: Canan AI applies security updates to the systems that store Organization Personal Data in a timely manner.

• Incident Response: Canan AI maintains a process for detecting, investigating, and responding to Security Incidents, including notifying Organization as described in Section 5.2.

• Data Minimization and Deletion: Canan AI retains Organization Personal Data only as long as needed for the purpose of the submission and deletes it as described in Section 2.5.

• Subprocessor Management: Canan AI reviews the security practices of Subprocessors before engagement and binds them to written data protection obligations as described in Section 3.1.

Terms of Use