Data Processing
Agreement

This schedule sets out the requirements for completing the official EU SCCs incorporated under section 11.2. Their unmodified mandatory text applies. This schedule and the incorporated customer transfer record together form their appendices.

SCC selections

Modules

Module 2 for controller-to-processor transfers; Module 3 for processor-to-subprocessor transfers. Only the module matching the Company's actual role for the relevant processing applies.

Clause 7

The optional docking clause does not apply.

Clause 9(a)

Option 1: prior specific written authorization. The parties shall agree and record the advance request period in the customer transfer record before relying on these SCCs. Annex III identifies the specifically authorized recipients.

Clause 11

The optional independent dispute-resolution language does not apply.

Clause 17

The parties shall select and record the applicable option and governing law in the customer transfer record in accordance with Clause 17. The selected law must permit third-party beneficiary rights.

Clause 18(b)

The parties shall identify the courts of an EU Member State in the customer transfer record, subject to the SCCs' mandatory data-subject rights.

Annex I.A: parties

Data exporter

Company, with its legal name, address and privacy contact recorded in the Principal Agreement or customer transfer record. Its role is controller for Module 2 or processor for Module 3. Its relevant activities are use of the contracted Services and transfer of the data described in Annex I.B.

Data importer

NuvoTech, Inc. (DBA AthenaHQ), 225 Bush Street, Suite 370, San Francisco, CA 94104. Contact: Alan Yao, alan@athenahq.ai. Its role is processor for Module 2 or subprocessor for Module 3. Its relevant activities are operation of the contracted Services and processing on Company's documented instructions.

Acceptance and date

The parties' binding adoption of this Agreement and completed transfer record, including the adoption date and acceptance evidence, is recorded in the Principal Agreement or customer transfer record.

Annex I.B: processing and transfer description

Data subjects

Company's users and business contacts, and individuals whose personal data Company includes in uploaded content, prompts, integrations or support communications. Company specifies any additional categories in its transfer record.

Personal data

User names, email addresses and account information; personal data in customer-provided prompts, documents, integration content and support communications. The transfer record identifies the categories for the contracted features actually used.

Sensitive data

No sensitive-data processing is authorized by this schedule alone. Before instructing such processing, Company and Processor shall document the specific data, purpose, restrictions and additional safeguards in the transfer record.

Frequency

As needed on a recurring basis during use of the contracted Services, unless the transfer record specifies a one-time transfer.

Nature and purpose

Receipt, storage, retrieval, analysis and generation of outputs for the contracted AI visibility, analytics and content features; account administration and customer support, on Company's documented instructions.

Duration

For the term of the relevant Services and the return, retention and deletion periods in section 9. The recipient schedule specifies the subject matter, nature and duration of processing by each subprocessor.

Annex I.C: competent supervisory authority

The competent authority is determined under Clause 13 from Company's establishment, representative or relevant data subjects, as applicable, and identified in the customer transfer record. The choice of governing law does not itself determine the competent authority.

Annex II: technical and organizational measures

The verified security schedule incorporated in the customer transfer record forms Annex II. Before relying on these SCCs, the parties shall complete that schedule with the specific measures actually applied to the relevant systems and processing. Sections 3, 4, 7 and 9 continue to apply. The security schedule must describe:

• Authentication, organization-scoped authorization and privileged access controls for nonpublic customer data.
• Protection of data in transit and at rest, including the actual encryption scope and key-management responsibilities for each covered service.
• Personnel access restrictions, confidentiality obligations and security guidance.
• Security-relevant audit records, incident-handling procedures and breach-notification processes.
• Data return, retention and deletion procedures for the relevant stores and onward recipients, including verification of completion.
• Storage, backup, recovery and security-testing measures and their effectiveness for the relevant processing.

Annex III: specifically authorized subprocessors

Company's versioned recipient schedule, incorporated in its transfer record, identifies each specifically authorized subprocessor's legal name, address and contact; purpose and data categories; actual processing destinations; and subject matter, nature and duration of processing. Processor shall retain Company's written authorization. The public provider list below is not a substitute for this schedule or authorization.

Customer transfer record

Before relying on this arrangement, the parties shall complete and incorporate a written record identifying Company's legal entity, address, privacy contact and applicable role; the relevant controller and its instructions for Module 3; the competent supervisory authority; binding adoption date and evidence; actual feature and data scope; authorized recipients and destinations; verified security measures; agreed SCC option, request-period, governing-law and court selections; UK Table 4 selection where applicable; applicable assessment and supplementary measures; and any stronger negotiated restrictions. A required item that is not applicable shall have a documented reason.

This schedule sets out the requirements for completing the Tables for the ICO's International Data Transfer Addendum, version B1.0, in force March 21, 2022, subject to completion of the customer transfer record required by section 11.3.

Table 1: parties and start date

The exporter, importer and contacts are those in Annex I.A and the completed customer transfer record, including any applicable registration details. The start date is the recorded date on which both parties are bound by this Agreement and the completed UK arrangement.

Table 2: selected SCCs

Commission Implementing Decision (EU) 2021/914 of June 4, 2021, with Module 2 or Module 3 as recorded for the relevant processing. Clause 7: no. Clause 11 optional language: no. Clause 9(a): Option 1, specific authorization, with the advance request period agreed in the customer transfer record. Module 4 and its combination-of-data entry do not apply.

Table 3: appendix information

Annex I.A, Annex I.B, Annex II and Annex III of Schedule A, together with their completed customer-specific information in the incorporated transfer record.

Table 4: ending after changes

The parties shall select and record which parties may end the UK Addendum under Section 19 of its Mandatory Clauses before relying on the UK arrangement.

Part 2: mandatory clauses

Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

That Part 2 is incorporated in full. Its mandatory amendments and hierarchy apply, including its UK governing-law and court provisions. The EU selections in Schedule A do not override those provisions for UK Restricted Transfers.