Data Processing Addendum changed Sazabi, Oct 26, 2026

1. +Added: This Data Processing Addendum (including the annexes attached hereto, " DPA ") forms part of the Terms of Use Agreement, located at https://www.sazabi.com/legal/product/terms-of-use (the " Agreement "), between Sazabi Inc. (" Company ") and Customer.
2. +Added: For purposes of this DPA, the terms below have the meanings set forth below. Capitalized terms that are used but not defined in this DPA have the meanings given elsewhere in the Agreement.
3. +Added: (a) Affiliate means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity, where "control" refers to the power to direct or cause the direction of the subject entity, whether through ownership of voting securities, by contract or otherwise.
4. +Added: (b) Authorized User means an employee or contractor of Customer who is authorized by Customer to access and use the Service on behalf of and for the benefit of Customer.
5. +Added: (c) Applicable Data Protection Laws means, as and to the extent applicable, the State Privacy Laws, GDPR, and FADP.
6. +Added: (d) Controller means the entity that, alone or jointly with others, determines the purposes or means of the Processing of Personal Data, including, as applicable, any "business" as that term is defined by the California Consumer Privacy Act.
7. +Added: (e) Customer means the entity that is party to the Terms of Use Agreement with Company.
8. +Added: (f) Customer Data means information provided or made available by Customer to Company for Processing on Customer's behalf to perform the Services.
9. +Added: (g) Data Subject means the identified or identifiable natural person to whom Personal Data relates.
10. +Added: (h) EEA means the European Economic Area.
11. +Added: (i) FADP means the Swiss Federal Act on Data Protection in its revised version of 25 September 2020.
12. +Added: (j) FDPIC means Swiss Federal Data Protection and Information Commissioner.
13. +Added: (k) GDPR means, as and where applicable to Processing concerned: (i) the General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR "); and/or (ii) the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (as amended, including by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019) (" UK GDPR "), including, in each case (i) and (ii) any applicable national implementing or supplementary legislation (e.g., the UK Data Protection Act 2018), and any successor, replacement, amendment or re-enactment, to or of the foregoing. References to "Articles" and "Chapters" of, and other relevant defined terms in, the GDPR shall be construed accordingly.
14. +Added: (l) Information Security Incident means an actual breach of Company's security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in Company's possession, custody or control. Information Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.
15. +Added: (m) Personal Data means Customer Data that constitutes "personal data," "personal information," or "personally identifiable information" as defined in Applicable Data Protection Laws, except that Personal Data does not include such information received by Company directly or from other sources (such as its other customers) independent of Company's relationship with Customer.
16. +Added: (n) Process or Processing means any operation or set of operations which is performed by Company on behalf of Customer under this Agreement, on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
17. +Added: (o) Processor means the entity that Processes Personal Data on behalf and at the direction of the Controller, including, as applicable, any "service provider" as that term is defined by the California Consumer Privacy Act.
18. +Added: (p) Restricted Transfer means the disclosure, grant of access or other transfer of Personal Data to any person located in: (i) when transferred from the EEA, any country or territory outside the EEA which does not benefit from an adequacy decision from the European Commission (an "EU Restricted Transfer"); (ii) when transferred from the UK, any country or territory outside the UK, which does not benefit from an adequacy decision from the UK Government (a " UK Restricted Transfer "); and (iii) when transferred from Switzerland, a country or territory outside of Switzerland which does not benefit from an adequacy decision from the Swiss authorities (a "Swiss Restricted Transfer"), in each case, which would be prohibited without a legal basis under the GDPR or FADP.
19. +Added: (r) Security Measures has the meaning given in Section 4(a) (Company Security Measures).
20. +Added: (s) Service Data means any data relating to the use, support and/or operation of the Services, which is collected by Company from and/or about Authorized Users of the Services and/or Customer's use of the Service for use for Company's own purposes (certain of which may constitute Personal Data). Service Data includes Personal Data of Customer's business representatives.
21. +Added: (t) Services means the services that Company performs for Customer under the Agreement.
22. +Added: (u) State Privacy Laws means, collectively, the comprehensive state-specific data privacy laws and their regulations currently in effect and applicable to Company's Processing of Personal Data under the Agreement.
23. +Added: (v) Subprocessors means third parties that Company engages to Process Personal Data in relation to the Services.
24. +Added: (w) Supervisory Authority means any entity with the authority to enforce Applicable Data Protection Laws, including, (i) in the context of the EEA and the EU GDPR, shall have the meaning given to that term in the EU GDPR; (ii) in the context of the UK and the UK GDPR, means the UK Information Commissioner's Office (ICO); and (iii) in the context of Switzerland and the FADP, means the FDPIC.
25. +Added: (x) UK Transfer Addendum means the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of the Mandatory Clauses included in Part 2 thereof.
26. +Added: (a) This DPA will remain in effect so long as Company Processes Personal Data, notwithstanding the expiration or termination of the Agreement.
27. +Added: (b) Processing of Personal Data subject to the GDPR shall be subject to Annex 2 (European Annex).
28. +Added: (c) Processing of Personal Data subject to the State Privacy Laws with respect to which Customer is a Business, Controller, Processor, or Service Provider and Company is Customer's service provider or processor (as such terms are defined in State Privacy Laws) shall be subject to Annex 3 (State Privacy Laws Annex) to this DPA.
29. +Added: Company will Process Personal Data as a Processor only in accordance with Customer's instructions to Company. By entering into the Agreement, Customer instructs Company to Process Personal Data to provide the Services and to perform its other obligations and exercise its rights under the Agreement. The Parties acknowledge and agree that the details of Company's Processing of Personal Data (including the respective roles of the Parties relating to such Processing) are as described in Annex 1 (Data Processing Details) to the DPA.
30. +Added: (a) Company Security Measures. Company will implement and maintain technical, administrative, physical and organizational measures designed to protect Personal Data against Information Security Incidents as described in Annex 4 (the "Security Measures "). Company may update the Security Measures from time to time, so long as the updated measures do not materially decrease the overall protection of Personal Data.
31. +Added: (b) Security Compliance by Company Staff. Company shall require that its personnel who are authorized to access Personal Data are subject to appropriate confidentiality obligations.
32. +Added: (c) Information Security Incidents. Company will notify Customer within seventy-two (72) hours of any Information Security Incident of which Company becomes aware. Such notifications will describe available details of the Information Security Incident, including steps taken to mitigate the potential risks and steps Company recommends Customer take to address the Information Security Incident. Company's notification of or response to an Information Security Incident will not be construed as Company's acknowledgement of any fault or liability with respect to the Information Security Incident. Company shall reasonably co-operate with Customer and take such commercially reasonable steps as may be directed by Customer to assist in the investigation of any such Information Security Incident. Customer is solely responsible for complying with notification laws applicable to Customer and fulfilling any third-party notification obligations related to any Information Security Incident. If Customer determines that an Information Security Incident must be notified to any Supervisory Authority, any Data Subject(s), the public or others under Applicable Data Protection Laws, to the extent such notice directly or indirectly refers to or identifies Company, where permitted by applicable laws, Customer agrees to (i) notify Company in advance, and (ii) in good faith, consult with Company and consider any clarifications or corrections Company may reasonably recommend or request to any such notification, which: (i) relate to Company's involvement in or relevance to such Information Security Incident; and (ii) are consistent with applicable laws.
33. +Added: (d) Customer's Security Responsibilities. Customer agrees that Customer is solely responsible for its use of the Services, including (a) making appropriate use of the Services to ensure a level of security appropriate to the risk in respect of the Customer Data; (b) securing the account authentication credentials, systems and devices Customer uses to access the Services; (c) securing Customer's systems and devices that Company uses to provide the Services; and (d) backing up Personal Data.
34. +Added: (e) Customer's Security Assessment. Customer has determined that the Services, the Security Measures and Company's commitments under this DPA are adequate to meet Customer's needs, including with respect to any security obligations of Customer under Applicable Data Protection Laws, and provide a level of security appropriate to the risk in respect of the Personal Data.
35. +Added: (a) Data Subject Request Assistance. Company will (taking into account the nature of the Processing of Personal Data) provide Customer with assistance reasonably necessary and technically feasible for Customer to perform its obligations under Applicable Data Protection Laws to fulfill requests by Data Subjects to exercise their rights under Applicable Data Protection Laws (" Data Subject Requests ") with respect to Personal Data in Company's possession or control, including but not limited to, access, correction, deletion, and cessation of Processing of Personal Data. Customer shall compensate Company for any such assistance at Company's then-current professional services rates, which shall be made available to Customer upon request.
36. +Added: (b) Customer's Responsibility for Requests. If Company receives a Data Subject Request, Company will (i) notify Customer; and (ii) advise the Data Subject to submit the request to Customer. Customer will be solely responsible for responding to any such request.
37. +Added: (a) Customer shall ensure (and is solely responsible for ensuring) that it has given such notices to and obtained such consents and permissions from third parties (including, without limitation, Data Subjects), and has all rights, in each case, as may be required under applicable law or otherwise for Company to Process Personal Data as contemplated by the Agreement.
38. +Added: (b) Customer represents and warrants to Company that it will not knowingly submit Customer Data that contains any Personal Data that contains racial, ethnic or national origin; religious or philosophical beliefs; political opinions; protected health information subject to the Health Insurance Portability and Accountability Act (" HIPAA "); other mental or physical health condition, diagnosis, history, treatment or other health data; health insurance information; pregnancy; sex life, sexuality or sexual orientation; status as transgender or non-binary; citizenship; citizenship or immigration status; union membership; status as a victim of crime; genetic, biometric, neural or biological data; personal information of children or teens; precise location information; Social Security number; driver's license number; state identification card number; passport number; other government-issued identification numbers; financial information or account number; tax return data; contents of a communication to which either you were not a party or you do not have the rights to share with a third party; or any bulk U.S. sensitive personal data or U.S. government-related data, in each case as defined in the U.S. Department of Justice's Final Rule on Prohibition on Bulk Data Transfers to Foreign Adversaries (28 C.F.R. Part 202), as amended, or any successor or similar rule, law, or regulation (collectively, " Restricted Data ").
39. +Added: (c) Customer represents and warrants that there is, and will be throughout the term of the Agreement, a valid legal basis for the Processing by Company of Personal Data in accordance with this DPA and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing) for the purposes of all Applicable Data Protection Laws (including Article 6, Article 9(2) and/or Article 10 of the GDPR (where applicable)).
40. +Added: (d) Customer shall ensure that all Data Subjects have (i) been presented with all required notices and statements (including as required by Article 12-14 of the GDPR (where applicable)); and (ii) provided all required consents, in each case (i) and (ii) relating to the Processing by Company of Personal Data.
41. +Added: (a) Consent to Subprocessor Engagement. Customer generally authorizes Company to engage third parties as Subprocessors in accordance with this Section 7.
42. +Added: (b) Information about Subprocessors. Information about Subprocessors, including their functions and locations, is available in Annex 5 of this DPA (" Subprocessor List "). Company may continue to use those Subprocessors already engaged by Company as at the date of this DPA.
43. +Added: (c) Requirements for Subprocessor Engagement. When engaging any Subprocessor, Company will enter into a written contract with such Subprocessor containing data protection obligations not less protective than those in this DPA with respect to Personal Data to the extent applicable to the nature of the services provided by such Subprocessor. Company shall be liable for all obligations subcontracted to, and all acts and omissions of, the Subprocessor in connection with the services they provide to Company to the same extent as Company would have been had it performed the Processing itself.
44. +Added: (d) Opportunity to Object to Subprocessor Changes. When Company engages any new Subprocessor after the effective date of the DPA, Company will notify Customer of the engagement (including the name and location of the relevant Subprocessor and the activities it will perform) by updating the Subprocessor List or by other written means. If Customer objects to such engagement in a written notice to Company within 15 days after being informed of the engagement on reasonable grounds relating to the protection of Personal Data, Customer and Company will work together in good faith to find a mutually acceptable resolution to address such objection. If the parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, Customer may, as its sole and exclusive remedy, terminate the Agreement and cancel the Services by providing written notice to Company and pay Company for all amounts due and owing under the Agreement as of the date of such termination.
45. +Added: Reviews and Audits of Compliance. Customer may audit Company's compliance with its obligations under this DPA up to once per year and on such other occasions as may be required by Applicable Data Protection Laws. Company will contribute to such audits by providing Customer with the information and assistance reasonably necessary to conduct the audit. Due to the nature of the Services, on-site audits are not necessary for Customer to audit Company's compliance with this DPA. If a third party is to conduct the audit, Company may object to the auditor if the auditor is, in Company's reasonable opinion, not independent, a competitor of Company, or otherwise manifestly unsuitable. Such objection by Company will require Customer to appoint another auditor or conduct the audit itself. To request an audit, Customer must submit a proposed audit plan to Company at least two weeks in advance of the proposed audit date and any third-party auditor must sign a customary non-disclosure agreement mutually acceptable to the parties (such acceptance not to be unreasonably withheld) providing for the confidential treatment of all information exchanged in connection with the audit and any reports regarding the results or findings thereof. The proposed audit plan must describe the proposed scope, duration, and start date of the audit. Company will review the proposed audit plan and provide Customer with any concerns or questions (for example, any request for information that could compromise Company security, privacy, employment or other relevant policies). Company will work cooperatively with Customer to agree on a final audit plan. Nothing in this Section 8 shall require Company to breach any duties of confidentiality. If the controls or measures to be assessed in the requested audit are addressed in a SOC 2 Type 2, ISO, NIST or similar audit report performed by a qualified third-party auditor within twelve (12) months of Customer's audit request and Company has confirmed there have been no known material changes in the controls audited since the date of such report, Customer agrees to accept such report in lieu of requesting an audit of such controls or measures. The audit must be conducted during regular business hours, subject to the agreed final audit plan and Company's safety, security or other relevant policies, and may not unreasonably interfere with Company business activities. Customer will promptly notify Company of any non-compliance discovered during the course of an audit and provide Company the audit reports generated in connection with the audit(s) under this Section 8, unless prohibited by Applicable Data Protection Laws. Customer may use the audit reports only for the purposes of meeting Customer's regulatory audit requirements and/or confirming compliance with the requirements of this DPA. Any audits are at Customer's sole expense. Customer shall reimburse Company for any time expended by Company and any third parties in connection with any audits or inspections under this Section 8 at Company's then-current professional services rates, which shall be made available to Customer upon request. Customer will be responsible for any fees charged by any auditor appointed by Customer to execute any such audit.
46. +Added: (a) Subject to Sections 9(b) and 9(c), upon the date of cessation of any Services involving the Processing of Personal Data (the " Cessation Date "), Company shall promptly cease all Processing of Personal Data for any purpose other than for storage or as otherwise permitted or required under this DPA.
47. +Added: (b) Subject to Section 9(d), to the extent technically possible in the circumstances (as determined in Company's sole discretion), on Customer's written request to Company (to be made no later than fourteen (14) days after the Cessation Date (" Post-cessation Storage Period ")), Company shall within fourteen (14) days of such request, at Customer's election either: (i) return a complete copy of all structured Personal Data within Company's possession to Customer by secure file transfer, promptly following which Company shall delete or anonymize all other copies of such Personal Data, or (ii) either (at Company's option) delete or anonymize all structured Personal Data within Company's possession.
48. +Added: (c) In the event that during the Post-cessation Storage Period, Customer does not instruct Company in writing to either delete or return Personal Data pursuant to Section 9(b), Company shall, subject to Section 9(d), promptly after the expiry of the Post-cessation Storage Period either (at its option) delete; or render anonymous, all structured Personal Data then within Company's possession to the fullest extent technically possible in the circumstances.
49. +Added: (d) Notwithstanding the above, Company may retain Personal Data, where permitted or required by applicable law, for such period as may be permitted or required by such applicable law, provided that Company shall (i) maintain measures designed to protect all such Personal Data, and (ii) Process the Personal Data only as necessary for the purpose(s) specified in the applicable law permitting or requiring such retention.
50. +Added: (a) Customer acknowledges that Company may collect, use and disclose Service Data for its own business purposes: (i) for accounting, tax, billing, audit, and compliance purposes; (ii) to provide, improve, develop, optimise, market and maintain the Services; (iii) to investigate fraud, spam, wrongful or unlawful use of the Services; (iv) to combine Service Data with other data; (v) to de-identify Personal Data so the de-identified data can be used and disclosed by Company for lawful business purposes; and/or (vi) as otherwise permitted or required by applicable law.
51. +Added: (b) In respect of any such Processing described in Section 10(b), Company: (i) independently determines the purposes and means of such Processing; (ii) shall comply with Applicable Data Protection Laws (if and as applicable in the context); (iii) shall process consumer sale/share opt-out requests that are forwarded to Company by Customer to the extent required by Applicable Data Protection Laws and upon request provide documentation to Customer that it has done so; (iv) shall Process such Service Data as described in Company's relevant privacy notices/policies, as updated from time to time; and (v) where possible, shall apply technical and organizational safeguards to any relevant Personal Data that are no less protective than the Security Measures.
52. +Added: (a) Company shall not use Customer Data for AI Model training or fine-tuning purposes unless Customer has provided its prior written opt-in consent to such use. Customer acknowledges that the incorporation of AI Models is a feature of the Service, and that Company may use aggregated data, deidentified data, usage data, metadata, and derived data generated through Customer's use of the Services, for the purposes of: (i) developing, training, improving, and optimizing AI components of the Service, and (ii) enhancing the performance, functionality, and security of Company's offerings. "AI Models" means machine learning models, algorithms, or artificial intelligence systems developed, maintained, improved or used by Company.
53. +Added: Customer acknowledges that Company shall not use Customer Data in a manner that identifies Customer or any individual, or that would reasonably be expected to re-identify such data, when used for AI Model training or product improvement, and Company will not re-identify Personal Data that has been deidentified.
54. +Added: (a) Except as expressly modified by the DPA, the terms of the Agreement remain in full force and effect. Notwithstanding anything in the Agreement or any order form entered in connection therewith to the contrary, the parties acknowledge and agree that Company's access to Personal Data does not constitute part of the consideration exchanged by the parties in respect of the Agreement. Notwithstanding anything to the contrary in the Agreement, any notices required or permitted to be given by Company to Customer under this DPA may be given (i) in accordance with any notice clause of the Agreement; (ii) to Company's primary points of contact with Customer; or (iii) to any email provided by Customer for the purpose of providing it with Services-related communications or alerts. Customer is solely responsible for ensuring that such email addresses are valid.
55. +Added: (b) Company agrees to cooperate in good faith with Customer concerning any amendments as may be reasonably necessary to address compliance with the Applicable Data Protection Laws.
56. +Added: (c) Company may on notice vary this DPA to the extent that (acting reasonably) it considers necessary to address the requirements of Applicable Data Protection Laws from time to time, including by varying or replacing the SCCs in the manner described in Paragraph 3.3 of Annex 2 (European Annex).
57. +Added: (d) In the event of any conflict or inconsistency between (i) this DPA and the Agreement, this DPA shall prevail, or (ii) any SCCs entered into pursuant to Paragraph 2 of Annex 2 (European Annex) and this DPA and/or the Agreement, the SCCs shall prevail in respect of the Restricted Transfer to which they apply.
58. +Added: THE TOTAL AGGREGATE LIABILITY OF EITHER PARTY TOWARDS THE OTHER PARTY, HOWSOEVER ARISING, UNDER OR IN CONNECTION WITH THE AGREEMENT, THIS DPA AND THE SCCS (IF AND AS THEY APPLY) WILL UNDER NO CIRCUMSTANCES EXCEED ANY LIMITATIONS OR CAPS ON, AND SHALL BE SUBJECT TO ANY EXCLUSIONS OF, LIABILITY AND LOSS AGREED BY THE PARTIES IN THE AGREEMENT; PROVIDED THAT, NOTHING IN THIS SECTION 13 WILL AFFECT ANY PERSON'S LIABILITY TO DATA SUBJECTS UNDER THE THIRD-PARTY BENEFICIARY PROVISIONS OF THE SCCS (IF AND AS THEY APPLY).
59. +Added: Name: Sazabi Inc. is a U.S. corporation
60. +Added: Address: 2261 Market Street, STE 85391, San Francisco, California 94114

161 more changed paragraphs are on the page itself.