Data Processing
Addendum.

This Addendum (the DPA) forms part of the Terms of Service between you (Controller) and Wysera HQ Ltd, 8 The Green, Suite A, Dover, DE 19901, USA (Processor).

It applies whenever we process personal data on your behalf as part of providing the Service. In that processing, you decide the purposes and means and we act on your instructions.

Data Protection Laws means the EU GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss FADP, the CCPA/CPRA and comparable US state privacy laws, and any other applicable privacy law.

Personal Data, processing, data subject, controller, processor and supervisory authority carry the meanings given in the GDPR.

Customer Personal Data means personal data contained in Customer Data, as that term is defined in the Terms.

SCCs means the Standard Contractual Clauses approved by the European Commission in Decision (EU) 2021/914.

We process Customer Personal Data only on your documented instructions. Your use of the Service, together with the Terms and this DPA, constitutes those instructions. Additional instructions need to be agreed in writing and may carry a cost if they require work outside the Service.

We will tell you if, in our opinion, an instruction infringes Data Protection Laws. We may also process where required by law, in which case we will notify you first unless the law forbids it.

We will not sell Customer Personal Data, share it for cross-context behavioural advertising, or use it for our own purposes outside this agreement.

Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality, has access only on a need-to-know basis under the least-privilege model described on /security, and receives guidance appropriate to their role.

Access to customer workspace content is not part of normal operations. Where support requires it, it is logged.

We implement appropriate technical and organisational measures under Article 32 of the GDPR. The specifics are in Annex II, and the operational detail behind them is on /security.

We may update these measures as the product and the threat landscape change, provided we do not materially reduce the overall level of protection during your subscription.

You give general authorisation for us to engage subprocessors. The current list, with each one's purpose and region, is maintained at /trust and summarised in Annex III.

• We impose data protection obligations on each subprocessor that are no less protective than those in this DPA.
• We remain liable to you for a subprocessor's performance as if it were our own.
• We give notice before adding or replacing a subprocessor. Enterprise customers may object in writing within 30 days on reasonable data protection grounds.
• If we cannot resolve a reasonable objection, you may terminate the affected part of the Service and receive a refund of the unused prepaid portion.

The Service gives you controls to access, correct, export, and delete Customer Personal Data yourself, which is usually the fastest route.

Where a data subject contacts us directly about data we process for you, we will not respond to the substance ourselves. We will refer them to you and tell you promptly. Where you cannot fulfil a request through the Service, we will provide reasonable assistance, taking into account the nature of the processing.

We will notify you of a personal data breach affecting Customer Personal Data without undue delay, and in any event within 48 hours of becoming aware of it.

Our notice will describe, as far as we know at the time:

• the nature of the breach and the categories and approximate number of records affected;
• the likely consequences;
• the measures taken or proposed to address it and mitigate harm;
• a contact point for further information.

We will not delay the initial notice in order to complete our investigation. Where facts are still being established we will say so and follow up as they firm up. Notice goes to your account admins.

Notifying a supervisory authority or affected data subjects is your decision as controller. We will give you the information you reasonably need to make it and to meet your own deadlines.

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with data protection impact assessments and with any prior consultation of a supervisory authority. Annex II and /trust are written to answer most of what a DPIA asks for without needing to contact us.

You can export Customer Personal Data in a machine-readable format at any time while the account is active, and for 30 days after termination.

After that we delete it. Workspace data is hard-deleted within 30 days, and encrypted backups containing it are purged on the rolling 30-day backup cycle described on /security. The practical effect is that a deletion is fully flushed from backups within 60 days of termination at the outside.

We keep data beyond that only where law requires, such as tax invoices retained for seven years. Anything retained stays subject to this DPA for as long as we hold it.

To demonstrate compliance we will make available the information in this DPA, on /trust, and on /security, and will respond to reasonable security questionnaires.

We do not have a SOC 2 Type II report yet; the audit is underway with Vanta-led control monitoring and a letter of engagement is available on request. We would rather say that here than let a reference to third-party reports imply one exists.

Where the above is genuinely insufficient for your legal obligations, you may audit once in any 12-month period, on 30 days' written notice, during business hours, without unreasonable disruption, and subject to confidentiality. You bear your own costs and ours if the audit is not triggered by a breach or a supervisory authority.

Primary infrastructure is in AWS us-east-1 (Virginia). EU residency in eu-central-1 (Frankfurt) is available on Pro Bundle and Enterprise, and Enterprise customers can request dedicated deployments in Australia, the UK, or Canada with a typical lead time of 30 to 60 days.

Where the SCCs apply, the docking clause is available, the governing law is Ireland, and the supervisory authority is the one with jurisdiction over you as data exporter. In any conflict between the SCCs and this DPA, the SCCs prevail.

For personal information subject to the CCPA/CPRA, we act as a service provider. We do not sell or share it as those terms are defined, do not retain, use, or disclose it outside the direct business relationship or for any purpose other than performing the Service, and do not combine it with personal information from other sources except as permitted.

We certify that we understand these restrictions and will comply with them. Equivalent terms apply under the Colorado, Virginia, Connecticut, and comparable state privacy laws.

Wyse processes Customer Personal Data only to deliver the Service to your workspace. Four commitments are contractual here, not just policy:

• Customer Personal Data is never used to train public AI models or included in fine-tuning datasets for public release.
• What Wyse learns from your team's edits stays scoped to your tenant and does not benefit other customers.
• Upstream model providers act as our subprocessors, receive only the prompt content needed for the task, and operate under zero-data-retention contracts, so prompts are not retained beyond the inference request.
• Prompt and output logs are retained 90 days by default and can be configured down to 7 days on Pro Bundle and Enterprise.

Fields containing PHI or special-category data can be flagged for field-level redaction before Wyse processes them. Healthcare customers processing PHI need a Business Associate Agreement in place; ask us for one before putting PHI into the Service.

Each side's liability under this DPA is subject to the limitation of liability in the Terms, and the caps there are aggregate across the Terms and this DPA rather than cumulative.

Order of precedence, where documents conflict: the SCCs first, then this DPA, then the Terms, then the Privacy Policy. A signed order form takes precedence over all of them where it says so.

This DPA is incorporated into the Terms and applies automatically when we process personal data on your behalf. You do not need to sign anything for it to be in force.

If your procurement process needs a countersigned copy, or you need the SCCs executed as a standalone document, email hi@wysera.ai with the subject DPA and the entity name and address to use. If your own DPA template must be used, send it and we will review it.

The authoritative, current list lives at /trust, which is updated when a subprocessor is added or removed. As at the date of this DPA: