Skip to main content
Meet Ace, your AI teammate
Ace on Product Hunt

Workforce

DATA PROCESSING ADDENDUM

This Data Processing Addendum (including its Exhibits) (this “DPA”) forms part of and is subject to the terms and conditions of the Master Services Agreement, or other agreement between you (“Customer”) and Automat, Inc. (“Automat”) governing Customer’s use of the Services (the “Agreement”). All capitalized terms that are not expressly defined in this DPA will have the meanings given to them in the Agreement. If and to the extent any language in this DPA or any of its Exhibits conflicts with the Agreement, this DPA shall control.

Part of the Master Services Agreement

01 DEFINITIONS.

For the purposes of this DPA, the following terms and those defined within the body of this DPA apply.

1.1. “Customer Personal Data” means Customer Materials that are Personal Data Processed by Automat on behalf of Customer under the Agreement.

1.2. “Data Protection Laws” means the privacy and data protection laws, rules, and regulations applicable to a party’s Processing of Customer Personal Data under the Agreement. “Data Protection Laws” may include, but are not limited to, the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act) (“CCPA”); the EU General Data Protection Regulation 2016/679 (“GDPR”) and its respective national implementing legislations; other comprehensive U.S. state privacy laws; the Swiss Federal Act on Data Protection (“FADP”); the United Kingdom General Data Protection Regulation (“UK GDPR”); and the United Kingdom Data Protection Act 2018 (in each case, as amended, adopted, or superseded from time to time).

1.3. “Personal Data” has the meaning assigned to the term “personal data” or “personal information” under applicable Data Protection Laws.

1.4. “Process” or “Processing” means any operation or set of operations that is performed on Personal Data or sets of Personal Data, whether or not by automated means, such as collection; recording; organization; structuring; storage; adaptation or alteration; retrieval; consultation; use; disclosure by transmission, dissemination, or otherwise making available; alignment or combination; restriction; erasure; or destruction.

1.5. “Security Incident(s)” means the breach of security leading to the accidental or unlawful destruction, loss, or alteration of, or the unauthorized disclosure of or access to, Customer Personal Data attributable to Automat.

1.6. “Services” means the services that Automat performs under the Agreement.

1.7. “Subprocessor” means a vendor that Automat has engaged to Process Customer Personal Data.

02 PROCESSING TERMS FOR CUSTOMER PERSONAL DATA.

2.1. Documented Instructions.

Automat shall Process Customer Personal Data to provide the Services in accordance with the Agreement, this DPA, and any instructions agreed upon by the parties. If applicable law requires that Automat Process Customer Personal Data for other purposes, Automat shall inform Customer of that legal requirement before engaging in such Processing, unless that law prohibits such information on important grounds of public interest.

2.2. Authorization to Use Subprocessors.

Customer grants Automat a general, ongoing authorization to engage Subprocessors with respect to the Services, including the Subprocessors listed in Exhibit B (as updated in accordance with Section 2.4). Customer acknowledges that Subprocessors may further engage their own vendors to Process Customer Personal Data.

2.3. Service Provider and Subprocessor Compliance.

Automat shall (i) enter into a written agreement with Subprocessors that imposes data protection requirements for Customer Personal Data on such Subprocessors that are consistent with this DPA; and (ii) remain responsible to Customer for the Subprocessors’ failure to perform their obligations with respect to the Processing of Customer Personal Data. For clarity, Automat’s Subprocessors are not permitted to Process Customer Personal Data to train their artificial intelligence models.

2.4. New and Updated Subprocessors.

Automat shall notify Customer prior to engaging any new Subprocessor by sending an email to the email address that is listed as Customer’s account owner or administrator. Within ten (10) days after notice is sent, Customer may reasonably object to the new Subprocessor if such Subprocessor would cause Customer to be in material breach of Data Protection Laws. If Customer objects to the appointment of any new Subprocessor in accordance with the preceding sentence, the Parties shall work together in good faith to resolve the grounds for the objection.

2.5. Confidentiality.

Any person authorized to Process Customer Personal Data shall be subject to a duty of confidentiality, contractually agree to maintain the confidentiality of such information, or be under an appropriate statutory obligation of confidentiality.

2.6. Personal Data Inquiries and Requests.

Automat shall provide reasonable assistance to Customer as required by applicable Data Protection Laws in response to any requests from individuals exercising their rights in Customer Personal Data granted to them under applicable Data Protection Laws.

2.7. Data Protection Assessment, Data Protection Impact Assessment, and Prior Consultation.

Automat shall provide reasonable assistance and information to Customer as required by applicable Data Protection Laws where, in Customer’s judgment, the type of Processing performed by Automat requires a data protection assessment, data protection impact assessment, and/or prior consultation with the relevant data protection authorities. Customer shall reimburse Automat for all non-negligible costs Automat incurs in performing its obligations under this Section 2.7.

2.8. Demonstrable Compliance.

Automat shall provide information reasonably necessary to demonstrate compliance with this DPA as required by applicable Data Protection Laws upon Customer’s reasonable request.

2.9. California-Specific Terms.

To the extent that Automat’s Processing of Customer Personal Data is subject to the CCPA, this Section 2.9 also applies. Customer discloses or otherwise makes available Customer Personal Data to Automat for the limited and specific purpose of enabling Automat to provide the Services to Customer in accordance with the Agreement and this DPA. Automat shall (i) comply with its applicable obligations under the CCPA; (ii) provide the same level of protection as required under the CCPA; (iii) notify Customer if it can no longer meet its obligations under the CCPA; (iv) not “sell” or “share” (as such terms are defined by the CCPA) Customer Personal Data; (v) not retain, use, or disclose Customer Personal Data for any purpose (including any commercial purpose) other than to provide the Services under the Agreement or as otherwise permitted under the CCPA; (vi) not retain, use, or disclose Customer Personal Data outside of the direct business relationship between Customer and Automat; and (vii) unless otherwise permitted by the CCPA, not combine Customer Personal Data with Personal Data that Automat (a) receives from, or on behalf of, another person, or (b) collects from its own, independent consumer interaction. Automat will permit Customer, upon reasonable request, to take reasonable and appropriate steps to ensure that Automat Processes Customer Personal Data that is subject to this Section 2.9 in a manner consistent with the obligations of a “business” under the CCPA by requesting that Automat attest to its compliance with this Section 2.9. Following any such request, Automat will promptly provide that attestation or an explanation of why it cannot provide it. If Customer reasonably believes that Automat is engaged in unauthorized Processing of Customer Personal Data that is subject to this Section 2.9, Customer will notify Automat of such belief, and the parties will work together in good faith to remediate the allegedly violative Processing activities, if necessary.

2.10. Service Optimization.

Where permitted by Data Protection Laws, Automat may Process Customer Personal Data (i) for its internal uses to build or improve the quality of the Services, provided that Automat shall not use Customer Personal Data to train, fine-tune, or otherwise develop any artificial intelligence or machine learning model; (ii) to prevent, detect, or investigate Security Incidents; or (iii) to protect against malicious, deceptive, fraudulent, or illegal activity.

2.11. Aggregation and De-Identification.

Automat may (i) compile aggregated and/or de-identified information in connection with providing the Services provided that such information cannot reasonably be used to identify Customer or any data subject to whom Customer Personal Data relates (“Aggregated and/or De-Identified Data”); and (ii) use Aggregated and/or De-Identified Data for its lawful business purposes.

2.12. No Sale; No Model Training.

Automat shall not sell Customer Personal Data, and shall not use Customer Personal Data to train, fine-tune, or otherwise develop any artificial intelligence or machine learning model, whether Automat’s or a third party’s.

03 INFORMATION SECURITY PROGRAM.

Automat shall implement and maintain reasonable administrative, technical, and physical safeguards designed to protect Customer Personal Data.

04 SECURITY INCIDENTS.

Upon becoming aware of a Security Incident, Automat shall provide written notice without undue delay and within the time frame required under applicable Data Protection Laws to Automat’s primary contact at Customer’s organization, or the email address that is listed as Customer’s account owner or administrator. Where possible, such notice will include all available details required under applicable Data Protection Laws for Customer to comply with its own notification obligations to government authorities and/or individuals affected by the Security Incident.

05 CROSS-BORDER TRANSFERS OF CUSTOMER PERSONAL DATA.

5.1. Cross-Border Transfers of Customer Personal Data.

Customer authorizes Automat and its Subprocessors to transfer Customer Personal Data across international borders, including from the European Economic Area (“EEA”), Switzerland, and/or the United Kingdom (“UK”) to the United States.

5.2. EEA, Swiss, and UK Standard Contractual Clauses.

If Customer Personal Data originating in the EEA, Switzerland, and/or the UK is transferred by Customer to Automat in a country that has not been found to provide an adequate level of protection under applicable Data Protection Laws, the parties agree that the transfer shall be governed by Module Two’s (where Customer acts as a controller) and/or Module Three’s (where Customer acts as a processor on behalf of its own customers) obligations in the Annex to the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (“Standard Contractual Clauses”) as supplemented by Exhibit A attached hereto, the terms of which are incorporated herein by reference. Each party’s execution of the Agreement shall be considered a signature to the Standard Contractual Clauses to the extent that the Standard Contractual Clauses apply hereunder.

06 AUDITS AND ASSESSMENTS.

Where Data Protection Laws afford Customer an audit or assessment right, Customer (or its appointed representative) may carry out an audit or assessment of Automat’s policies, procedures, and records relevant to the Processing of Customer Personal Data. Any audit or assessment must be (i) conducted during Automat’s regular business hours; (ii) done with reasonable advance notice to Automat; (iii) carried out in a manner that prevents unnecessary disruption to Automat’s operations; and (iv) subject to reasonable confidentiality procedures. In addition, any audit or assessment shall be limited to once per year, unless an audit or assessment is carried out at the direction of a government authority with jurisdiction over the Processing of Customer Personal Data.

07 CUSTOMER PERSONAL DATA DELETION.

At the expiry or termination of the Agreement, Automat shall delete all Customer Personal Data within thirty (30) days (excluding any backup or archival copies, which shall be deleted in accordance with Automat’s data retention schedule), except where Automat is required to retain copies under applicable laws, in which case Automat will isolate that Customer Personal Data and restrict any further Processing of it except to the extent required by applicable laws.

08 CUSTOMER’S OBLIGATIONS.

Customer represents and warrants that (i) it has complied and will comply with Data Protection Laws; (ii) it has obtained and will obtain and continue to have, during the term, all necessary rights, lawful bases, authorizations, consents, and licenses for the Processing of Customer Personal Data as contemplated by the Agreement; and (iii) Automat’s Processing of Customer Personal Data in accordance with the Agreement will not violate Data Protection Laws or cause a breach of any agreement or obligations between Customer and any third party.

09 PROCESSING DETAILS.

9.1. Subject Matter.

The subject matter of the Processing is the Services pursuant to the Agreement.

9.2. Duration.

The Processing will continue until the expiration or termination of the Agreement.

9.3. Categories of Data Subjects.

Data subjects whose Customer Personal Data will be Processed pursuant to the Agreement.

9.4. Nature and Purpose of the Processing.

The purpose of the Processing of Customer Personal Data by Automat is the performance of the Services.

9.5. Types of Customer Personal Data.

Customer Personal Data that is Processed pursuant to the Agreement.

10 ACCOUNT DATA.

Automat may Process Personal Data about Customer’s Authorized Users, including their business contact information and information about their use of the Services (“Account Data”) in accordance with its Privacy Notice available at https://privacy.runautomat.com/ (as updated from time to time). Account Data is not Customer Personal Data or Customer Materials.

A EXHIBIT A TO THE DATA PROCESSING ADDENDUM

This Exhibit A forms part of the DPA and supplements the Standard Contractual Clauses. Capitalized terms not defined in this Exhibit A have the meaning set forth in the DPA.

The parties agree that the following terms shall supplement the Standard Contractual Clauses:

A.1 SUPPLEMENTAL TERMS.

The parties agree that (i) a new Clause 1(e) is added to the Standard Contractual Clauses, which shall read as follows: “To the extent applicable hereunder, these Clauses also apply mutatis mutandis to the Parties’ processing of personal data that is subject to the Swiss Federal Act on Data Protection. Where applicable, references to EU Member State law or EU supervisory authorities shall be modified to include the appropriate reference under Swiss law as it relates to transfers of personal data that are subject to the Swiss Federal Act on Data Protection.”; (ii) a new Clause 1(f) is added to the Standard Contractual Clauses, which shall read as follows: “To the extent applicable hereunder, these Clauses, as supplemented by Annex III, also apply mutatis mutandis to the Parties’ processing of personal data that is subject to UK Data Protection Laws (as defined in Annex III).”; (iii) the optional text in Clause 7 is deleted; (iv) Option 1 in Clause 9 is struck and Option 2 is kept, and data importer must notify data exporter of any new subprocessors in accordance with Section 2.4 of the DPA; (v) the optional text in Clause 11 is deleted; and (vi) in Clauses 17 and 18, the governing law and the competent courts are those of Ireland (for EEA transfers), Switzerland (for Swiss transfers), or England and Wales (for UK transfers).

A.2 ANNEX I.

Annex I to the Standard Contractual Clauses shall read as follows:

A. List of Parties:

Data exporter: Customer.

Address: As set forth in the Notices section of the Agreement.

Contact person’s name, position, and contact details: As set forth in the Notices section of the Agreement.

Activities relevant to the data transferred under these Clauses: The Services.

Role: Controller (Module Two), Processor (Module Three).

Data importer: Automat.

Address: As set forth in the Notices section of the Agreement.

Contact person’s name, position, and contact details: As set forth in the Notices section of the Agreement.

Activities relevant to the data transferred under these Clauses: The Services.

Role: Processor.

B. Description of the Transfer:

Categories of data subjects whose personal data is transferred: Data exporter may submit personal data to the Services about certain data subjects, the extent of which is determined and controlled by data exporter in its sole discretion.

Categories of personal data transferred: Data exporter may submit personal data to the Services, the extent of which is determined and controlled by data exporter in its sole discretion.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: To the parties’ knowledge, no sensitive data is transferred.

The frequency of the transfer (e.g., whether the data is transferred on a one-off or continuous basis): Personal data is transferred in accordance with the standard functionality of the Services, or as otherwise agreed upon by the parties.

Nature of the processing: The Services.

Purpose(s) of the data transfer and further processing: The Services.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: Data importer will retain personal data in accordance with the DPA.

For transfers to (sub-) processors, also specify subject matter, nature, and duration of the processing: The subject matter, nature, and duration are identified above.

C. Competent Supervisory Authority:

The supervisory authority mandated by Clause 13. If no supervisory authority is mandated by Clause 13, then the supervisory authority is the Irish Data Protection Commission, and if this is not possible, then the supervisory authority is as otherwise agreed by the parties consistent with the conditions set forth in Clause 13.

D. Clarifying Terms:

The parties agree that (i) the certification of deletion required by Clause 8.5 and Clause 16(d) of the Clauses will be provided upon data exporter’s written request; (ii) the measures data importer is required to take under Clause 8.6(c) of the Clauses will only cover data importer’s impacted systems; (iii) the audit described in Clause 8.9 of the Clauses shall be carried out in accordance with Section 6 of the DPA; (iv) the termination right contemplated by Clause 14(f) and Clause 16(c) of the Clauses will be limited to the termination of the Clauses; (v) unless otherwise stated by data importer, data exporter will be responsible for communicating with data subjects pursuant to Clause 15.1(a) of the Clauses; (vi) the information required under Clause 15.1(c) of the Clauses will be provided upon data exporter’s written request; and (vii) notwithstanding anything to the contrary, data exporter will reimburse data importer for all costs and expenses incurred by data importer in connection with the performance of data importer’s obligations under Clause 15.1(b) and Clause 15.2 of the Clauses without regard for any limitation of liability set forth in the Agreement.

A.3 ANNEX II.

Annex II of the Standard Contractual Clauses shall read as follows:

Data importer shall implement and maintain technical and organizational measures designed to protect personal data in accordance with this DPA. Such measures shall include:

  • Measures of pseudonymization and encryption of personal data (as appropriate);
  • Measures designed to ensure ongoing confidentiality, integrity, availability, and resilience of the Services that process personal data;
  • Measures designed to ensure the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
  • Processes for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures designed to ensure the security of the Processing of personal data;
  • Measures for user identification and authorization.
  • Measures designed to protect personal data during transmission;
  • Measures designed to protect personal data during storage;
  • Measures designed to ensure the physical security of locations at which personal data are Processed (as appropriate);
  • Measures for events logging (as appropriate);
  • Measures regarding system configuration, including default configuration (as appropriate);
  • Measures regarding internal IT and IT security governance and management;
  • Measures regarding certification/assurance of the Services (as appropriate);
  • Measures designed to ensure data minimization for personal data (as appropriate);
  • Measures designed to ensure data quality (as appropriate, and to the extent within data importer’s control);
  • Measures for data retention of personal data;
  • Measures for accountability regarding the Processing of personal data; and
  • Measures for allowing data portability and ensuring erasure of personal data.

The parties acknowledge and agree that Automat uses independent, third-party auditors to verify the adequacy of its Processing of Customer Personal Data. This audit will: (i) be performed at least annually; (ii) be performed against the SOC 2 Type II framework and ISO/IEC 27001; (iii) be performed by a qualified professional at Automat’s selection and expense; and (iv) result in the generation of audit reports confirming that Automat’s security controls are consistent with the SOC 2 Type II framework and ISO/IEC 27001 (the “Reports”). Upon Customer’s written request, Automat will provide Customer with an executive summary of its Reports so that Customer can reasonably verify Automat’s compliance with the security obligations in this DPA. The Reports are Automat’s Confidential Information.

Pursuant to Clause 10(b), data importer will provide data exporter assistance with data subject requests in accordance with the DPA.

A.4 ANNEX III.

A new Annex III shall be added to the Standard Contractual Clauses and shall read as follows:

The UK Information Commissioner’s Office International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (“UK Addendum”) is incorporated herein by reference.

Table 1: The start date in Table 1 is the effective date of the DPA. All other information required by Table 1 is set forth in Annex I, Section A of the Clauses.

Table 2: The UK Addendum forms part of the version of the Approved EU SCCs which this UK Addendum is appended to, including the Appendix Information, effective as of the effective date of the DPA.

Table 3: The information required by Table 3 is set forth in Annex I and II to the Clauses.

Table 4: The parties agree that Importer may end the UK Addendum as set out in Section 19.

B EXHIBIT B TO THE DATA PROCESSING ADDENDUM

LIST OF SUBPROCESSORS

Subprocessor – Purpose – Location – Transfer mechanism

Anthropic, PBC – AI model provider – United States – Standard Contractual Clauses

OpenAI OpCo, LLC – AI model provider – United States – Standard Contractual Clauses

Google LLC – AI model provider (Gemini) – United States – EU-U.S. Data Privacy Framework

Supabase – Database and file storage (conversation history, files, logs) – United States – Standard Contractual Clauses

MacStadium, Inc. – Dedicated agent computing infrastructure – United States – EU-U.S. Data Privacy Framework

Vercel Inc. – Application hosting (metadata) – United States – EU-U.S. Data Privacy Framework

PostHog, Inc. – Product analytics (metadata only) – United States – EU-U.S. Data Privacy Framework

Relay Innovations, Inc. (d/b/a AgentPhone) – Telephony and messaging – United States – Standard Contractual Clauses

Exa Labs, Inc. – Web search (query strings only) – United States – Standard Contractual Clauses

LiveKit, Inc. – Real-time voice infrastructure – United States – Standard Contractual Clauses