Data Processing Addendum

This Data Processing Addendum (the "DPA") forms part of the agreement between you (the "Customer") and Tenfold Research ("Tenfold", "we", "us") governing your use of our services, including w00t.ai (the "Services"). It applies wherever Tenfold processes personal data on the Customer's behalf. Where this DPA conflicts with the main agreement on the subject of data processing, this DPA controls.

1. Definitions

Personal data means any information relating to an identified or identifiable person. Processing means any operation performed on personal data. Controller and processor have the meanings given under applicable Privacy Laws. Customer Data is the personal data the Customer provides to, or generates within, the Services. Account Data is data about the Customer's own account and users. Usage Data is data about how the Services are accessed and perform. Subprocessor means a third party engaged by Tenfold to process Customer Data. Privacy Laws means the data protection laws that apply to a party, which may include the EU and UK GDPR and the CCPA. Placeholder: the definitive list of applicable Privacy Laws will be confirmed once Tenfold's operating jurisdictions are finalized.

2. Roles and scope of processing

For Customer Data, the Customer acts as controller and Tenfold acts as processor, processing only on the Customer's documented instructions. We process Customer Data as necessary to provide, secure, and support the Services. The subject matter is the Customer's use of the Services; the duration is the term of the agreement plus any period required by law; the types of data and categories of data subjects are those the Customer chooses to submit through the Services.

3. Customer obligations

The Customer is responsible for ensuring that its use of the Services, and the personal data it submits, comply with applicable Privacy Laws. This includes having a lawful basis to provide the data to us and to have it processed as instructed. The Customer's instructions must not require Tenfold to process data in a way that breaches applicable law.

4. Use of personal data

We do not sell or share Customer Data, and we do not use it for our own purposes. Specifically, we will not retain, use, disclose, or combine Customer Data outside the direct relationship of providing the Services, and we will not build or enrich unrelated datasets from it, except as the Customer instructs or applicable law requires. Any research corpus derived from activity in the Services is aggregated and anonymised so that it no longer identifies any individual.

5. Subprocessors

The Customer authorises Tenfold to engage subprocessors to help deliver the Services, such as cloud hosting and AI model providers. We remain responsible for each subprocessor's performance under this DPA. We will give the Customer at least ten days' notice before adding or replacing a subprocessor, and the Customer may object on reasonable data-protection grounds so the parties can work through it in good faith. Placeholder: a current subprocessor list will be maintained and linked here.

6. Confidentiality and security

We keep Customer Data confidential and maintain technical and organisational measures appropriate to the risk of the processing, covering access control, encryption in transit and at rest where appropriate, and separation of environments. People who process Customer Data on our behalf are bound by confidentiality obligations.

7. Personal data breach

If we become aware of a breach affecting Customer Data, we will notify the Customer without undue delay and provide the information reasonably needed to meet its own notification obligations. This does not apply to incidents caused by the Customer or its own users.

8. Data protection assessments

We will provide reasonable cooperation and information to help the Customer carry out data protection impact assessments or prior consultations with a regulator, where applicable law requires them and they relate to the Services.

9. Data subject and consumer requests

The Customer is responsible for responding to requests from individuals to access, correct, or delete their personal data. If such a request reaches us directly, we will forward it to the Customer where we can identify the relevant account, and assist the Customer in responding as required by law.

10. International transfers

Where providing the Services involves transferring personal data across borders, we will put an appropriate transfer mechanism in place as required by applicable Privacy Laws. Placeholder: the specific mechanism, such as Standard Contractual Clauses, will be confirmed with legal counsel.

11. Audit

On reasonable notice and no more than once per calendar year, the Customer may review our then-current compliance certifications and summaries, or request a proportionate audit of our processing of Customer Data. Audits are at the Customer's cost and must not disrupt our operations or the confidentiality owed to others.

12. Return or deletion

On termination of the Services, we will delete or return Customer Data at the Customer's choice, except where applicable law requires us to retain it. Anonymised, aggregated data that no longer identifies any individual may be retained.

13. Tenfold as controller of Account and Usage Data

Separately from the processing above, Tenfold acts as an independent controller of Account Data and Usage Data, which we use to operate, secure, support, and improve the Services. Our handling of that data is described in our Privacy Policy.

Changes to this DPA

We may update this DPA as the Services and applicable law evolve. We will update the effective date above when we do.

Governing law

This DPA is governed by the laws of Singapore.

Contact

Questions about this DPA: hello@tenfoldresearch.com.

This page is a first-draft placeholder prepared for Tenfold and is not legal advice. It should be reviewed and completed by qualified legal counsel before it is relied upon, particularly the definitions, international-transfer, and subprocessor sections above.