Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the SignalPilot Terms of Service or other agreement between SignalPilot Inc. ("SignalPilot"), and the customer (the "Agreement"). It applies when SignalPilot processes Customer Personal Data on the customer's behalf. It takes effect automatically when the customer accepts the Agreement. Customers that need a countersigned copy can request one at tarik@signalpilot.ai.

1. Definitions

• "Customer Personal Data" means personal data in Customer Data (as defined in the Agreement) that SignalPilot processes on the customer's behalf.
• "Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under the Agreement, including the California Consumer Privacy Act as amended ("CCPA"), other U.S. state privacy laws, the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection, where applicable.
• "Subprocessor" means a third party that SignalPilot engages to process Customer Personal Data.
• "Controller", "processor", "data subject", "personal data breach", "business", "service provider" and "contractor" have the meanings given in the Data Protection Laws.

2. Roles and instructions

The customer is the controller (or business) and SignalPilot is the processor (or service provider) of Customer Personal Data. SignalPilot processes Customer Personal Data only on the customer's documented instructions, which are the Agreement, this DPA and the customer's use and configuration of the Service, unless the law requires otherwise; in that case SignalPilot will tell the customer first unless the law forbids it. SignalPilot will tell the customer if it believes an instruction violates Data Protection Laws.

Details of processing:

3. CCPA service-provider terms

SignalPilot will not: (a) sell or share Customer Personal Data; (b) retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, including for any commercial purpose other than providing the Service; (c) retain, use or disclose it outside the direct business relationship with the customer; or (d) combine it with personal information that SignalPilot receives from other sources, except as the CCPA permits. SignalPilot will comply with the CCPA's obligations that apply to service providers, give the same level of privacy protection the CCPA requires, and notify the customer if it can no longer meet its obligations. The customer may take reasonable steps to stop and remediate unauthorized use. SignalPilot certifies that it understands these restrictions.

4. Confidentiality and personnel

SignalPilot ensures that people authorized to process Customer Personal Data are bound by confidentiality obligations and have access only as needed to provide the Service.

5. Security

SignalPilot maintains the technical and organizational measures in Annex 1, which are designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. SignalPilot may update these measures if the update does not materially reduce overall security.

6. Subprocessors

The customer authorizes SignalPilot to use the Subprocessors listed at signalpilot.ai/legal/subprocessors. SignalPilot will impose data protection terms on each Subprocessor that are at least as protective as this DPA and remains responsible for its Subprocessors. SignalPilot will update the list at least 30 days before a new Subprocessor processes Customer Personal Data. The customer may object on reasonable data-protection grounds within that period. The parties will discuss the objection in good faith; if they cannot resolve it, the customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it.

7. Assistance

Taking into account the nature of the processing, SignalPilot will help the customer to respond to data subjects' requests, and with data protection impact assessments and consultations with authorities, to the extent the customer cannot do so through the Service. If SignalPilot receives a request directly from a data subject about Customer Personal Data, it will forward it to the customer and will not respond except to direct the person to the customer.

8. Personal data breaches

SignalPilot will notify the customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the breach, the data and people affected where known, the likely consequences, and the measures taken or proposed, and SignalPilot will update it as more information becomes available. SignalPilot will take reasonable steps to contain and remedy the breach.

9. Return and deletion

During the term, the customer can delete Customer Data in the Service or ask SignalPilot to delete it. After the Agreement ends, SignalPilot will, at the customer's choice, return or delete Customer Personal Data within 30 days after the customer's request, or within 90 days after termination if the customer makes no request, except where the law requires SignalPilot to keep it. Copies in backups are deleted on the normal backup schedule.

10. Audits

On written request, no more than once a year, SignalPilot will answer a reasonable security questionnaire and provide information needed to show compliance with this DPA, and will provide third-party audit reports when it has them. If that information is not enough to show compliance, or a regulator requires it, the customer may conduct an audit, at its own cost, on 30 days' notice, during business hours, in a way that does not disrupt SignalPilot's operations or breach its confidentiality obligations to others.

11. International transfers

Where Customer Personal Data subject to the GDPR is transferred to SignalPilot in the United States or another country without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor) and, where the customer is a processor, Module Three, which are incorporated by reference with these choices: Clause 7 (docking) applies; Clause 9 option 2 (general authorization) with the notice period in Section 6; the optional language in Clause 11 does not apply; Clauses 17 and 18: the law and courts of Ireland. Annexes I and II of the Clauses are completed by Section 2 and Annex 1 of this DPA. For UK transfers, the UK International Data Transfer Addendum applies; for Swiss transfers, the Clauses apply with references to the Swiss FADP.

12. General

If this DPA conflicts with the Agreement, this DPA controls for the processing of Customer Personal Data. The limitations of liability in the Agreement apply to this DPA.

Annex 1: Security measures

• Encryption: TLS for data in transit; warehouse and integration credentials and secrets encrypted at rest with application-level encryption; storage encrypted at rest by our cloud providers.
• Isolation: agent code runs in isolated, short-lived sandboxes; each organization's data is separated logically in the Service.
• Query governance: queries are parsed and checked before they run, and read-only by default.
• Access control: organization roles; access by SignalPilot personnel limited to those who need it to operate and support the Service; multi-factor authentication for administrative access to production systems.
• Logging: audit logs of queries and administrative actions, available to customer administrators.
• Secure development: code review before release, dependency updates for security advisories, and a vulnerability disclosure program at security@signalpilot.ai.
• Incident response: a documented process to detect, contain, investigate and notify on security incidents.
• Backups and recovery: managed database backups with point-in-time recovery.
• Subprocessor management: written contracts with security and confidentiality obligations.