Data Processing Addendum

1. Definitions

“Data Protection Laws” means all data protection and privacy laws applicable to a party’s processing of Customer Personal Data under this DPA, in each case as amended or replaced from time to time.

“Customer Personal Data” means personal data that CarbonAI processes on behalf of the Customer in connection with the Services. The terms “controller”, “processor”, “personal data”, “processing”, “data subject” and “personal data breach” have the meanings given in the Data Protection Laws.

“Subprocessor” means a third party engaged by CarbonAI to process Customer Personal Data on its behalf in connection with the Services.

2. Roles and scope

For the purposes of this DPA, the Customer is the controller and CarbonAI is the processor of Customer Personal Data. The subject matter, duration, nature and purpose of processing, the types of personal data and the categories of data subjects are set out in Schedule 1. The Customer determines what (if any) personal data is included in prompts, queries, uploads or other inputs to the Services and will limit such inputs to personal data that is strictly necessary for the authorised use of the Services. CarbonAI does not use Customer Personal Data processed as a processor under this DPA for its own independent purposes.

CarbonAI processes certain categories of personal data (including account administration data, authentication data, billing information, security logs, and service telemetry and analytics) as an independent controller.

In carrying out such processing, CarbonAI applies appropriate safeguards, including data minimisation, purpose limitation and access controls, and will not use such data to identify individuals beyond what is necessary for security, service delivery, performance monitoring and product improvement purposes. This is covered in more detail in the CarbonAI Privacy Policy.

3. Customer obligations

The Customer warrants that it has obtained and will maintain all consents, notices and other rights necessary to lawfully transfer Customer Personal Data to CarbonAI and to permit CarbonAI to process it as contemplated by the Agreement and this DPA. The Customer is responsible for the accuracy, quality and legality of Customer Personal Data and for the lawfulness of its instructions to CarbonAI.

The Customer should not submit special category personal data (such as health, biometric, racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership data) or criminal offence data through the Services unless this is strictly necessary, proportionate and lawful and the Customer has identified an appropriate legal basis and, where required, satisfied applicable conditions for processing such data under Data Protection Laws.

Where the Customer submits such data, CarbonAI will apply appropriate safeguards, including restricting access, applying enhanced security measures where feasible, and deleting or anonymising such data where it is not required to provide the Services.

4. CarbonAI obligations

4.1 Documented instructions

CarbonAI will process Customer Personal Data only on the documented instructions of the Customer, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by applicable law. In such a case, CarbonAI will inform the Customer of that legal requirement before processing, unless prohibited by law from doing so. CarbonAI will immediately inform the Customer if, in its opinion, an instruction infringes applicable Data Protection Laws. The Customer’s documented instructions to CarbonAI are set out in Schedule 1 (Processing details), together with the Agreement (including this DPA, any applicable order document and the Customer’s ordinary use of the Services in accordance with the Agreement), which together constitute the Customer’s complete and final instructions to CarbonAI in respect of the processing of Customer Personal Data. Additional instructions outside this scope require the prior written agreement of the parties. If CarbonAI is required by law to process Customer Personal Data otherwise than in accordance with those instructions, it will inform the Customer of that legal requirement before processing, unless prohibited by law from doing so.

CarbonAI will not use Customer Personal Data for any purpose other than to deliver the Services. In particular, CarbonAI will not use Customer Personal Data to train, retrain or fine‑tune its AI models, except where strictly necessary to generate outputs in real time as part of the provision of the Services and without retaining such data for training purposes, unless the Customer has provided prior written consent or such processing is required by law.

CarbonAI implements safeguards designed to reduce the risk of inaccurate, biased or inappropriate outputs from AI systems, including evaluation, testing and monitoring processes appropriate to the nature of the Services.

4.2 Confidentiality of personnel

CarbonAI will ensure that personnel authorised to process Customer Personal Data are bound by appropriate confidentiality obligations and are trained on their data protection responsibilities.

4.3 Security

CarbonAI will implement and maintain appropriate technical and organisational measures designed to ensure a level of security appropriate to the risks presented by the processing, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing. The measures CarbonAI maintains at the date of this DPA are described in Schedule 2. CarbonAI may update those measures from time to time, provided that the overall level of protection is not materially reduced.

4.4 Subprocessors

The Customer provides CarbonAI with general authorisation to engage Subprocessors to process Customer Personal Data, subject to this clause 4.4. CarbonAI maintains a current list of its Subprocessors in Schedule 3.

CarbonAI will impose on each Subprocessor data protection obligations that are no less protective than those set out in this DPA. CarbonAI remains responsible to the Customer for the acts and omissions of its Subprocessors as if they were its own.

CarbonAI will give the Customer reasonable prior notice (whether by email, by an in-product notice or by updating the subprocessor list page) of any intended addition or replacement of a Subprocessor processing Customer Personal Data. The Customer may object on reasonable data protection grounds within thirty (30) days of being notified. If the parties cannot in good faith resolve the objection, the Customer may terminate the affected Services by written notice; that termination right is the Customer’s sole and exclusive remedy in respect of the objection.

4.5 Assistance with data subject rights

CarbonAI will provide reasonable assistance without undue delay to the Customer, taking into account the nature of the processing and the information available to CarbonAI, to enable the Customer to respond to requests from data subjects exercising rights under the Data Protection Laws. If CarbonAI receives a request from a data subject relating to Customer Personal Data, it will, unless prohibited by law, promptly direct the data subject to the Customer or forward the request to the Customer and will not respond on the Customer’s behalf.

4.6 Assistance with the Customer’s obligations

Taking into account the nature of the processing and the information available to CarbonAI, CarbonAI will provide reasonable assistance to the Customer in relation to the Customer’s obligations under the Data Protection Laws concerning:

• security of processing;
• personal data breach notification;
• communications to data subjects;
• data protection impact assessments; and
• prior consultation with supervisory authorities where required under applicable Data Protection Laws.

4.7 Personal data breaches

CarbonAI will notify the Customer without undue delay after becoming aware of a confirmed personal data breach affecting Customer Personal Data and, where feasible, within seventy-two (72) hours of such awareness. The notification will include the information then available to CarbonAI, including the nature of the breach, the categories and approximate numbers of data subjects and records concerned (where known), the likely consequences, and the measures taken or proposed to address it. CarbonAI will provide reasonable cooperation and information to assist the Customer in meeting its own notification obligations to supervisory authorities and data subjects.

4.8 Return or deletion

On termination or expiry of the Agreement, or on earlier written request by the Customer, CarbonAI will, at the Customer’s choice, return or delete Customer Personal Data held in the systems used to provide the Services. Upon written request, CarbonAI will provide written certification that it has complied with this clause. Unless otherwise agreed or technically infeasible, such return or deletion will be completed within thirty (30) to sixty (60) days following termination of the Agreement or receipt of the request.

CarbonAI may retain Customer Personal Data only:

1. (i)to the extent required by applicable law; and
2. (ii)in routine backups, provided that such data is put beyond use, is not actively processed, and is deleted in accordance with CarbonAI’s standard backup retention schedule.

Personal data that CarbonAI processes as a controller (such as account administration, billing or security records) is governed by the CarbonAI Privacy Policy and is not subject to this clause.

4.9 Records and information

CarbonAI will make available to the Customer the information reasonably necessary to demonstrate compliance with its obligations under this DPA and the applicable Data Protection Laws. This will normally include CarbonAI’s most recent security and data protection questionnaire responses, current certifications and summaries of third-party audit reports, in each case to the extent that disclosure does not compromise security or breach obligations of confidentiality to third parties.

4.10 Audits

Where the information made available under clause 4.9 is not sufficient to demonstrate compliance with this DPA, CarbonAI will, on reasonable prior written notice (and not more than once in any 12-month period, unless required by a supervisory authority or where the Customer reasonably suspects a material breach of this DPA), allow for and contribute to an audit, including by way of a remote inspection, conducted by the Customer or by an independent auditor mandated by the Customer (subject to confidentiality and security obligations no less protective than those in the Agreement). Audits will be conducted during normal business hours, will be scoped to information and systems relevant to the processing of Customer Personal Data, and will be conducted in a manner that does not unreasonably disrupt CarbonAI’s operations or access the data, systems or confidential information of other customers. The Customer bears its own costs and CarbonAI’s reasonable costs of cooperation, except where the audit reveals a material breach of this DPA by CarbonAI. CarbonAI will permit a further audit on shorter notice and with greater frequency where reasonably required by a supervisory authority or following a confirmed personal data breach materially affecting Customer Personal Data.

Nothing in this clause limits the Customer’s right to conduct audits where required by applicable law or a competent supervisory authority. In such cases, the parties will cooperate in good faith to facilitate such audit in a manner that is reasonable, proportionate, and respects the security and confidentiality of CarbonAI’s systems and other customers.

4.11 AI Processing Safeguards

Taking into account the nature of the Services, CarbonAI implements appropriate safeguards designed to protect individuals in relation to AI-enabled processing, including:

• processes to test, monitor and evaluate system outputs for accuracy and reliability;
• measures to mitigate risks of bias or inappropriate outputs;
• human oversight in contexts where outputs may materially affect individuals; and
• controls to limit the use of Customer Personal Data to what is necessary to provide the Services.

CarbonAI does not use Customer Personal Data to train or improve its AI models except as expressly permitted under clause 4.1.

5. International transfers

Where the provision of the Services involves a transfer of Customer Personal Data to a country that does not benefit from a recognised adequacy regulation or equivalent decision under the applicable Data Protection Laws (a “Restricted Transfer”), whether by CarbonAI or by a Subprocessor, the safeguards set out in Schedule 4 (Restricted Transfers) apply and are incorporated into this DPA. Where Schedule 4 does not cover a particular Restricted Transfer, CarbonAI will not make that transfer unless and until an appropriate transfer mechanism has been agreed in writing between the parties.

CarbonAI will monitor developments affecting international transfers and update its transfer risk assessments where required. CarbonAI will implement additional safeguards where necessary to ensure an essentially equivalent level of protection.

CarbonAI will, to the extent permitted by law, promptly notify the Customer of any legally binding request from a public authority for disclosure of Customer Personal Data and will take reasonable steps to challenge such requests where appropriate.

CarbonAI will document its transfer risk assessments and, upon reasonable request, make available a summary of the outcome of such assessments sufficient to demonstrate compliance with applicable Data Protection Laws, subject to confidentiality and security restrictions.

6. Liability

Except as stated below, each party’s liability under this DPA is subject to the limitations and exclusions set out in the Agreement.

Nothing in this DPA limits or excludes liability where such limitation or exclusion is not permitted under applicable Data Protection Laws.

7. General

This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising out of or in connection with it. If any provision of this DPA is held invalid or unenforceable, the remainder will continue in full force.

Schedule 1 — Processing details

Schedule 2 — Technical and Organisational Measures

CarbonAI maintains technical and organisational measures designed to protect Customer Personal Data against unauthorised access, loss, misuse, alteration and disclosure. These measures cover the following areas:

• access controls, including role-based access, multi-factor authentication for administrative access and least-privilege principles;
• encryption of personal data in transit over public networks and at rest in primary data stores;
• network and infrastructure security, including segregation of environments and protection against common web application threats;
• vulnerability management, including monitoring of dependencies, regular patching and periodic vulnerability testing;
• logging and monitoring of access to systems holding Customer Personal Data;
• an incident response process covering identification, investigation, containment, remediation and notification of personal data breaches;
• personnel measures, including pre-engagement checks where appropriate, confidentiality obligations and regular data protection and security training;
• secure software development practices, including code review and use of source control;
• backup and disaster recovery procedures appropriate to the nature of the Services;
• vendor management, including assessment of Subprocessors and contractual data protection obligations; and
• regular testing, assessment and evaluation of the effectiveness of technical and organisational security measures.

CarbonAI may update these measures from time to time, provided that the overall level of protection is not materially reduced.

Schedule 3 — Subprocessors

CarbonAI’s current Subprocessors are listed below.

New or replacement Subprocessors are notified, and may be objected to, in accordance with clause 4.4.

Schedule 4 — Restricted Transfers

This Schedule applies where the provision of the Services involves a Restricted Transfer, whether from the Customer to CarbonAI or onward from CarbonAI to a Subprocessor. The safeguards in this Schedule are incorporated into this DPA and self-execute on commencement of the relevant Restricted Transfer.

A. UK Restricted Transfers

Where the UK GDPR applies to a Restricted Transfer, the parties incorporate by reference the UK International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner (the “UK Addendum”). For transfers from the Customer to CarbonAI, the Customer is the data exporter and CarbonAI is the data importer. For onward transfers from CarbonAI to a Subprocessor located in a third country, CarbonAI is the data exporter and the Subprocessor is the data importer, and CarbonAI will procure that the Subprocessor enters into the UK Addendum (or an equivalent safeguard recognised under the UK GDPR) on terms no less protective than those in this DPA.

B. EU Restricted Transfers

Where the EU GDPR applies to a Restricted Transfer, the parties incorporate by reference the Standard Contractual Clauses set out in Commission Implementing Decision (EU) 2021/914 (the “EU SCCs”). Module 2 (controller-to-processor) applies to transfers from the Customer to CarbonAI; Module 3 (processor-to-processor) applies to onward transfers from CarbonAI to a Subprocessor. For each Module: the optional docking clause (Clause 7) applies; Option 2 of Clause 9(a) (general written authorisation for subprocessors, as set out in clause 4.4 of this DPA, with at least 30 days’ notice of changes) applies; the optional language in Clause 11(a) is not included; Clause 17 Option 1 applies, with the law of the EU Member State in which the data exporter is established (or, where no such law is available, the law of the Republic of Ireland) governing; and the courts of that Member State (or, in the alternative, the Republic of Ireland) have jurisdiction under Clause 18(b).

C. Completion of clauses

The annexes and tables of the UK Addendum and the EU SCCs are completed as follows: (i) the parties are CarbonAI and the Customer; (ii) the subject matter, duration, nature and purpose of processing, the types of personal data and the categories of data subjects are as set out in Schedule 1; (iii) the technical and organisational measures are as set out in Schedule 2; and (iv) the authorised Subprocessors are as set out in Schedule 3 (as updated from time to time in accordance with clause 4.4).

D. Transfer risk assessment

The parties have considered the risks associated with each Restricted Transfer, taking into account: (i) the nature and limited categories of personal data in scope (being personal data that the Customer chooses to include in prompts or uploads, which the Customer is required to keep to the minimum strictly necessary, and which excludes special category and criminal offence data); (ii) the destination countries identified by reference to the Subprocessor list in Schedule 3; (iii) the legal regime applicable to the data importer in each such country, including any laws or practices that could undermine the safeguards in the UK Addendum or EU SCCs; and (iv) the supplementary measures set out in Schedule 2 and elsewhere in this DPA, including encryption of personal data in transit and at rest, role-based access controls, contractual confidentiality and security obligations, and management of Subprocessors.

The parties have conducted and will maintain transfer risk assessments for Restricted Transfers in accordance with applicable Data Protection Laws. CarbonAI will periodically review the legal and regulatory environment in relevant third countries and assess whether any changes impact the level of protection afforded to Customer Personal Data. Where necessary, CarbonAI will implement supplementary technical, contractual or organisational measures to ensure that Customer Personal Data benefits from a level of protection that is essentially equivalent to that guaranteed under UK GDPR and EU GDPR.