Data Processing Addendum

1. Definitions

2. Scope

This Addendum applies to Libra AI's Processing of Customer Personal Data under the Agreement to the extent such Processing is subject to Data Protection Laws. Except as modified by this Addendum, the terms of the Agreement remain in full force and effect. In the event of any conflict between this Addendum and the Agreement with respect to data protection matters, this Addendum shall prevail.

3. Party Roles

For the purposes of Data Protection Laws:

• Customer acts as the Controller (or Business, as applicable under CCPA) with respect to Customer Personal Data.
• Libra AI acts as the Processor (or Service Provider, as applicable under CCPA) with respect to Customer Personal Data.

Customer is responsible for ensuring that any communications and notifications required under this Addendum are provided to its Affiliates and data subjects as necessary. Customer shall be responsible for coordinating all communications with Libra AI on behalf of its Affiliates.

4. Data Processing Obligations

With respect to Customer Personal Data, Libra AI shall:

1. Process Customer Personal Data solely in accordance with Customer's documented instructions for the purpose of providing the Services under the Agreement, unless required to do so by applicable law.
2. Ensure that all personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations, whether contractual or statutory.
3. Implement and maintain appropriate technical and organizational security measures to protect Customer Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, or damage, as described in Section 6 of this Addendum.
4. Engage Sub-processors only in accordance with Section 7 of this Addendum, providing Customer with at least 30 days' advance notice before engaging any new Sub-processor.
5. Promptly notify Customer of any legally binding request for disclosure of Customer Personal Data by a law enforcement authority, unless otherwise prohibited by law.
6. Notify Customer without undue delay upon becoming aware of any Security Incident involving Customer Personal Data, as further described in Section 8.
7. Provide reasonable assistance to Customer in responding to data subject rights requests, including requests for access, rectification, erasure, restriction, portability, and objection, to the extent Libra AI is able to do so.
8. Upon termination or expiry of the Agreement, and at Customer's election, return or securely delete all Customer Personal Data in Libra AI's possession, unless retention is required by applicable law.
9. Make available to Customer all information reasonably necessary to demonstrate compliance with this Addendum and allow for, and contribute to, audits and inspections conducted by Customer or a mandated auditor.

5. International Data Transfers

Where Customer Personal Data originating from the EU Area is transferred to a country outside the EU Area that has not been deemed adequate by the relevant authority, the parties agree that the following safeguards shall apply:

• GDPR Transfers: The Standard Contractual Clauses (Module Two: Controller to Processor) as approved by the European Commission shall be incorporated by reference and shall apply to such transfers.
• UK Transfers: The UK International Data Transfer Addendum to the EU SCCs, issued by the UK Information Commissioner, shall apply to transfers of Personal Data subject to the UK GDPR.
• Swiss Transfers: The SCCs shall apply with modifications necessary to comply with the Swiss Federal Act on Data Protection (FADP), including references to the competent Swiss supervisory authority.
• AI/ML Processing: Where applicable, AI and machine learning processing of Customer Personal Data shall be performed within secure infrastructure regions as specified in the Agreement. Libra AI does not use Customer Personal Data to train external AI/ML models.

6. Security Measures

Libra AI implements and maintains the following technical and organizational measures to protect Customer Personal Data:

6.1 Information Security Management

• Designated qualified security personnel responsible for security program oversight.
• Annual reviews of security policies and risk assessments.
• Regular penetration testing and vulnerability management.
• Compliance with ISO/IEC 27001:2022 standards.

6.2 Personnel Security

• Background checks for employees with access to Customer Personal Data.
• Mandatory confidentiality agreements for all personnel.
• Regular privacy and security awareness training.

6.3 Access Controls

• Multi-factor authentication for access to systems processing Customer Personal Data.
• Principle of least privilege enforced across all systems and services.
• Unique user identifiers and strong password policies.
• Regular access reviews and prompt revocation upon role changes or termination.

6.4 Infrastructure & Network Security

• Cloud infrastructure hosted on AWS with multi-availability zone redundancy.
• Encryption of data in transit (HTTPS/TLS 1.2+) and at rest (AES-256).
• Regular backup testing and disaster recovery planning.
• Server hardening, secure code review processes, and automated vulnerability scanning.
• Continuous security monitoring and incident detection.

7. Sub-processors

Customer hereby provides general authorization for Libra AI to engage and appoint Sub-processors to process Customer Personal Data, subject to the following conditions:

1. Libra AI shall provide Customer with at least 30 days' prior written notice before engaging any new Sub-processor, including the name and nature of the processing.
2. Libra AI shall enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those set forth in this Addendum.
3. Libra AI shall remain fully liable to Customer for the performance of each Sub-processor's obligations.
4. If Customer objects to a new Sub-processor on reasonable data protection grounds, Customer shall notify Libra AI in writing within 15 days of receiving notice. The parties shall work in good faith to resolve the objection. If no resolution is reached, Customer may terminate the affected Services without penalty.

A current list of Sub-processors is provided in Annex 2 of this Addendum.

8. Security Incident Notification

Libra AI shall notify Customer without undue delay (and in any event within 72 hours) upon becoming aware of any Security Incident involving Customer Personal Data. Such notification shall include, to the extent available:

• A description of the nature of the Security Incident, including the categories and approximate number of data subjects and records affected.
• The name and contact details of the point of contact for further information.
• A description of the likely consequences of the Security Incident.
• A description of the measures taken or proposed to be taken to address the Security Incident, including measures to mitigate its adverse effects.

Libra AI shall cooperate with Customer and take reasonable steps to assist in the investigation, mitigation, and remediation of each Security Incident.

9. Data Subject Rights

Libra AI shall provide reasonable assistance to Customer in fulfilling its obligations to respond to requests from data subjects exercising their rights under applicable Data Protection Laws, including rights of access, rectification, erasure, restriction, portability, and objection. Requests may be directed to: privacy@letslibra.com.

10. Indemnification

Customer shall indemnify, defend, and hold harmless Libra AI and its officers, directors, employees, and agents from and against any third-party claims, damages, losses, costs, and expenses (including reasonable legal fees) arising out of or in connection with Customer's breach of this Addendum or its obligations under applicable Data Protection Laws.

11. Compliance Standards

Libra AI shall comply with all applicable statutory and regulatory requirements relating to the protection of Customer Personal Data, including but not limited to the EU GDPR, UK GDPR, CCPA/CPRA, and applicable industry standards such as SOC 2 Type II.

12. Term and Termination

This Addendum shall remain in effect for the duration of the Agreement and shall automatically terminate upon termination or expiry of the Agreement. Sections of this Addendum that by their nature should survive termination (including confidentiality, indemnification, and data deletion obligations) shall survive.