CLAYFACE DATA PROCESSING ADDENDUM

Version 1.0
Effective Date: 01st September 2026

This Data Processing Addendum (“DPA”) forms part of the agreement between PHYLLO INC (“Clayface”) and the Customer identified in the applicable agreement or Work Order (“Customer”) governing the Customer’s access to and use of the Clayface Services (the “Agreement”).

This DPA applies where Clayface Processes Personal Data on behalf of the Customer in connection with the Services.

Capitalised terms that are not defined in this DPA have the meanings given to them in the Agreement.

1. DEFINITIONS

1.1 Applicable Data Protection Law

“Applicable Data Protection Law” means any law, regulation or binding legal requirement concerning privacy, data protection, the Processing of Personal Data or the rights of individuals that applies to the Processing covered by this DPA.

Applicable Data Protection Law includes, where applicable, Regulation (EU) 2016/679 (“EU GDPR”), the EU GDPR as incorporated into the laws of the United Kingdom (“UK GDPR”), the UK Data Protection Act 2018, the California Consumer Privacy Act as amended (“CCPA”), and other substantially equivalent privacy or data protection laws applicable to the Processing.

1.2 Controller

“Controller” means the Person that determines the purposes and means of Processing Personal Data and includes a “business” or substantially equivalent responsible entity under Applicable Data Protection Law.

1.3 Customer Personal Data

“Customer Personal Data” means Personal Data contained in Customer Content that Clayface Processes on behalf of the Customer in connection with the Services.

Customer Personal Data does not include Personal Data contained in Clayface External Intelligence solely because the Customer accesses such information through the Services, or Account and Business Data or Service Data that Clayface Processes independently for its own administrative, security, operational or legal purposes.

1.4 Data Subject

“Data Subject” means an identified or identifiable individual to whom Personal Data relates and includes a “consumer” or substantially equivalent term under Applicable Data Protection Law.

1.5 Personal Data

“Personal Data” means information relating to an identified or identifiable individual and includes “personal information” and substantially equivalent terms under Applicable Data Protection Law.

1.6 Process and Processing

“Process”, “Processes” and “Processing” have the meanings given to them under Applicable Data Protection Law and include any operation performed on Personal Data, whether or not by automated means.

1.7 Processor

“Processor” means a Person that Processes Personal Data on behalf of a Controller and includes a service provider, contractor, subprocessor or substantially equivalent entity under Applicable Data Protection Law, as the context requires.

1.8 Restricted Transfer

“Restricted Transfer” means a transfer of Personal Data that requires an adequacy decision, approved contractual safeguard or other transfer mechanism under Applicable Data Protection Law.

1.9 Security Incident

“Security Incident” means an actual breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data Processed by Clayface.

A Security Incident does not include an unsuccessful attempt or activity that does not compromise the security of Customer Personal Data, including unsuccessful login attempts, network scans, pings, denial-of-service attempts that do not result in unauthorised access, or other unsuccessful attacks.

1.10 Standard Contractual Clauses or SCCs

“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses approved by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914, as amended or replaced from time to time.

1.11 Subprocessor

“Subprocessor” means a third party or Clayface Affiliate engaged by Clayface to Process Customer Personal Data on behalf of the Customer in connection with the Services.

1.12 UK Addendum

“UK Addendum” means the International Data Transfer Addendum to the European Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as amended, replaced or superseded from time to time.

2. SCOPE AND ROLES OF THE PARTIES

2.1

This DPA applies only to the Processing of Customer Personal Data by Clayface on behalf of the Customer.

The subject matter, nature, purpose and duration of such Processing, together with the categories of Data Subjects and Customer Personal Data concerned, are described in Schedule 1.

2.2

Where the Customer determines the purposes and means of Processing Customer Personal Data, the Customer acts as Controller and Clayface acts as Processor.

2.3

Where the Customer Processes Customer Personal Data on behalf of another Controller and engages Clayface to Process that Personal Data in connection with the Services, the Customer acts as Processor and Clayface acts as Subprocessor.

The Customer represents that it is authorised by the relevant Controller to appoint Clayface as a Subprocessor and to provide the instructions contemplated by the Agreement and this DPA.

2.4

Where Applicable Data Protection Law uses different terminology to describe the parties’ roles, including “business”, “service provider” or “contractor”, those terms shall apply to the extent required by that law without changing the underlying allocation of responsibility described in this DPA.

2.5

The parties acknowledge that their roles are determined by the factual circumstances of the relevant Processing activity and Applicable Data Protection Law. A contractual designation shall not override a role imposed by Applicable Data Protection Law.

3. CUSTOMER INSTRUCTIONS

3.1

Clayface shall Process Customer Personal Data only on documented instructions from the Customer and only to the extent necessary to provide, secure, maintain and support the Services and perform Clayface’s obligations under the Agreement.

3.2

The Customer’s documented instructions include:

(a) the Agreement and applicable Work Order;

(b) the Customer’s configuration and authorised use of the Services;

(c) instructions submitted through functionality made available within the Services; and

(d) other written instructions mutually agreed by the parties.

3.3

Clayface shall not Process Customer Personal Data for a purpose materially outside the scope of the Agreement without the Customer’s prior written instruction, except where Processing is required by Applicable Law.

Where Clayface is required by law to Process Customer Personal Data other than on the Customer’s instructions, Clayface shall notify the Customer of that legal requirement before Processing unless Applicable Law prohibits such notification.

3.4

If Clayface reasonably believes that an instruction from the Customer infringes Applicable Data Protection Law, Clayface shall notify the Customer without undue delay, unless prohibited by law, and may suspend the affected Processing until the parties have resolved the issue.

3.5

The Customer is responsible for ensuring that its instructions to Clayface comply with Applicable Data Protection Law.

The Customer is also responsible for determining whether it has the legal basis, authority, notices, permissions or consents required to collect, use and provide Customer Personal Data to Clayface for Processing in accordance with the Agreement.

4. PROCESSING OBLIGATIONS

4.1 Purpose Limitation

Clayface shall not retain, use or disclose Customer Personal Data for purposes other than providing and supporting the Services, performing its obligations under the Agreement, complying with the Customer’s documented instructions or complying with Applicable Law.

4.2 Confidentiality

Clayface shall ensure that personnel authorised to Process Customer Personal Data are subject to appropriate confidentiality obligations and receive access only where required for the performance of their responsibilities.

4.3 Access Limitation

Clayface shall limit access to Customer Personal Data to personnel and Subprocessors that require such access for purposes authorised under this DPA.

Access shall be subject to appropriate technical and organisational controls designed to prevent unauthorised access, use or disclosure.

4.4 Compliance

Clayface shall comply with Applicable Data Protection Law applicable to Clayface in its capacity as Processor or Subprocessor.

The Customer shall comply with Applicable Data Protection Law applicable to the Customer in its capacity as Controller or Processor.

5. INFORMATION SECURITY

5.1

Taking into account the nature, scope, context and purposes of the Processing and the risks to individuals, Clayface shall maintain appropriate technical and organisational measures designed to protect Customer Personal Data against Security Incidents.

5.2

The measures maintained by Clayface shall include the measures described in Schedule 2, subject to any additional security commitments expressly agreed in a Work Order or security addendum.

5.3

Clayface may update its security measures from time to time to reflect technological development, changes to the Services, security threats and good industry practice, provided that Clayface shall not materially reduce the overall level of protection afforded to Customer Personal Data during the applicable Term.

5.4 Customer Environment

Each production Customer shall be provided with an individual logically isolated Customer Environment. Customer Content belonging to one Customer shall not be made available to another Customer except where expressly directed or authorised by the Customer.

5.5 Customer-Controlled Encryption Keys

Where Customer-controlled encryption keys are used to protect Customer Content, such keys shall remain under the Customer’s control. Clayface shall not independently own or control those keys or obtain independent access to them.

5.6 Support Access

Where support requires access to the Customer Environment or Customer Personal Data, such access shall be initiated or expressly authorised by the Customer, restricted to authorised personnel and limited to what is reasonably necessary to address the relevant support request.

Where reasonably practicable, such access shall be time-bound and logged.

5.7 Customer Responsibilities

The Customer remains responsible for protecting account credentials, managing Authorised User access, securely administering Customer-controlled encryption keys, configuring the Services appropriately and promptly notifying Clayface of suspected unauthorised access relating to the Customer’s systems or accounts.

6. SECURITY INCIDENTS

6.1

Clayface shall notify the Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data.

6.2

The initial notification may be provided in stages as information becomes available and shall, to the extent known at the relevant time, include:

(a) a description of the nature of the Security Incident;

(b) the categories of Customer Personal Data and Data Subjects affected or reasonably believed to be affected;

(c) the approximate number of affected records or Data Subjects, where known;

(d) the date or estimated period of the Security Incident;

(e) the likely consequences of the Security Incident;

(f) containment, mitigation and remediation measures taken or proposed;

(g) any action reasonably recommended for the Customer; and

(h) a contact point for further information.

6.3

Clayface shall investigate, contain, mitigate and remediate a Security Incident within its control and shall provide the Customer with material updates as additional information becomes available.

6.4

Clayface shall reasonably cooperate with the Customer in connection with legally required notifications, investigations and regulatory communications arising from a Security Incident.

7. SUBPROCESSORS

7.1

The Customer provides Clayface with general written authorisation to engage Subprocessors to Process Customer Personal Data in connection with the Services, subject to this Clause 7.

7.2

Clayface shall maintain a current list of Subprocessors that Process Customer Personal Data.

The current Subprocessor list shall be set out in Schedule 3 or made available through another location notified to the Customer.

7.3

Clayface shall provide reasonable prior notice before appointing a new Subprocessor that will Process Customer Personal Data or replacing an existing material Subprocessor.

Unless another period is agreed in the applicable Work Order, Clayface shall endeavour to provide at least thirty (30) days’ prior notice.

7.4

Clayface shall enter into a written agreement with each Subprocessor imposing data protection obligations that are no less protective in material respects than those applicable to Clayface under this DPA, to the extent relevant to the services provided by that Subprocessor.

7.5

Clayface shall remain responsible for the performance of its obligations under this DPA notwithstanding its engagement of a Subprocessor.

8. DATA SUBJECT REQUESTS

8.1

Taking into account the nature of the Processing, Clayface shall provide reasonable assistance to the Customer in responding to requests from Data Subjects to exercise rights available under Applicable Data Protection Law in relation to Customer Personal Data.

8.2

If Clayface receives a request directly from a Data Subject concerning Customer Personal Data, Clayface shall, where reasonably identifiable and legally permitted, refer the Data Subject to the relevant Customer or notify the Customer of the request.

Clayface shall not respond substantively to such request on the Customer’s behalf unless instructed by the Customer or required by Applicable Law.

9. AUDIT AND COMPLIANCE INFORMATION

9.1

Clayface shall make available to the Customer information reasonably necessary to demonstrate Clayface’s compliance with its obligations under this DPA.

9.2

Where available and appropriate, Clayface may satisfy an audit or diligence request by providing relevant security documentation, independent audit reports, certifications, penetration-test summaries or other third-party assurance materials, subject to appropriate confidentiality restrictions.

9.3

Where the information provided under Clause 9.2 is not reasonably sufficient to demonstrate compliance, or where an audit is required by Applicable Data Protection Law, the Customer may conduct an audit of Clayface’s relevant Processing activities no more than once in any twelve-month period.

9.4

An audit shall be conducted on reasonable prior written notice of thirty (30) days, during normal business hours and in a manner that does not unreasonably interfere with Clayface’s business operations or compromise the security or confidentiality of another customer.

9.5

Each party shall bear its own costs of an ordinary audit.

10. RETURN AND DELETION OF CUSTOMER PERSONAL DATA

10.1

Following expiry or termination of the relevant Services, Clayface shall return or delete Customer Personal Data in accordance with the Agreement, the Customer’s instructions and Clayface’s applicable deletion procedures.

Customer Personal Data shall be deleted from active systems within 30 days after termination.

10.2

Residual copies contained in routine backups may remain until they are overwritten or deleted through Clayface’s normal backup cycle.

Maximum backup retention period: 60 days.

During that period, retained Customer Personal Data shall remain protected in accordance with this DPA and shall not be restored or otherwise Processed except where reasonably necessary for disaster recovery, security, legal compliance or another purpose permitted under the Agreement.

10.3

Where Applicable Law requires Clayface to retain Customer Personal Data after termination, Clayface shall retain only the information required, continue to protect it under this DPA and shall not Process it for any unrelated purpose.

10.4

Upon reasonable written request following completion of deletion, Clayface shall provide written confirmation that Customer Personal Data has been deleted in accordance with this Clause, subject to any residual backup copies.

11. INTERNATIONAL TRANSFERS

11.1

Neither party shall make a Restricted Transfer of Customer Personal Data unless a lawful transfer mechanism required by Applicable Data Protection Law is in place.

11.2 EU Transfers

Where Customer Personal Data subject to the EU GDPR is transferred to Clayface or a Subprocessor in a country that does not benefit from an applicable adequacy decision and the SCCs are required, the SCCs shall be incorporated into this DPA and shall apply as follows:

(a) Module Two shall apply where the Customer is a Controller and Clayface is a Processor;

(b) Module Three shall apply where the Customer is a Processor and Clayface is a Subprocessor;

(c) the docking clause shall apply;

(d) for general written authorization for Subprocessors shall apply together with the notice mechanism under Clause 7 of this DPA;

(e) for Clause 17, Option 1 shall apply and the governing law shall be the law of Ireland; and

(f) for Clause 18(b), the courts of Ireland shall have jurisdiction.

11.3

The information required to complete Annexes I, II and III to the SCCs shall be provided through Schedules 1, 2, 3 and 4 to this DPA and the applicable Work Order.

11.4 UK Transfers

Where Customer Personal Data subject to the UK GDPR is transferred in circumstances requiring an appropriate safeguard, the parties shall apply the UK Addendum to the EU SCCs or another lawful transfer mechanism agreed by the parties.

The applicable UK Addendum details shall be completed using Schedule 4.

If the UK Information Commissioner issues a mandatory replacement or amendment to the applicable transfer mechanism, the parties shall cooperate in good faith to implement any changes required to maintain a valid Restricted Transfer.

11.5 Swiss Transfers

Where Customer Personal Data subject to the Swiss Federal Act on Data Protection is transferred in circumstances requiring contractual safeguards, the SCCs shall apply with references to the EU GDPR and competent supervisory authorities interpreted to include corresponding provisions of Swiss law and the Swiss Federal Data Protection and Information Commissioner, to the extent required.

11.6 Other Restricted Transfers

Where another Applicable Data Protection Law requires a contractual transfer mechanism, the parties shall cooperate in good faith to implement the applicable mechanism.

11.7 Sub-processor Transfers

Clayface shall ensure that a Restricted Transfer of Customer Personal Data to a Subprocessor is supported by an appropriate transfer mechanism required by Applicable Data Protection Law.

12. UNITED STATES STATE PRIVACY REQUIREMENTS

12.1

To the extent Clayface Processes Customer Personal Data as a service provider, contractor or processor under an applicable United States state privacy law, the provisions of this Clause 12 shall apply.

12.2

Clayface shall Process Customer Personal Data only for the limited and specified purposes described in the Agreement, the applicable Work Order and this DPA.

12.3

Except to the extent expressly permitted by Applicable Data Protection Law, Clayface shall not:

(a) sell or share Customer Personal Data;

(b) retain, use or disclose Customer Personal Data outside the direct business relationship between Clayface and the Customer;

(c) retain, use or disclose Customer Personal Data for a commercial purpose other than providing the Services or another purpose expressly permitted under the Agreement;

(d) use Customer Personal Data for cross-context behavioural advertising or targeted advertising on behalf of another Person.

12.4

Clayface shall comply with applicable obligations imposed directly upon service providers, contractors or processors under Applicable Data Protection Law.

12.5

If Clayface determines that it can no longer comply with an applicable obligation under this Clause, Clayface shall notify the Customer as required by Applicable Data Protection Law.

The Customer may take reasonable and appropriate steps to stop and remediate unauthorised use of Customer Personal Data.

12.6

Clayface shall provide reasonable assistance to the Customer with consumer requests concerning Customer Personal Data to the extent required by Applicable Data Protection Law.

12.7

This Clause applies only to Customer Personal Data Processed by Clayface on behalf of the Customer.

13. LIABILITY

13.1

Except to the extent that Applicable Data Protection Law, the SCCs or another mandatory transfer mechanism requires otherwise, each party’s liability arising out of or relating to this DPA shall be subject to the limitations, exclusions and allocation of liability contained in the Agreement.

13.2

Nothing in the Agreement or this DPA limits any rights of a Data Subject under the SCCs or another mandatory transfer mechanism to the extent such rights cannot lawfully be limited.

14. TERM AND TERMINATION

14.1

This DPA shall take effect when incorporated into or executed in connection with the Agreement and shall continue for so long as Clayface Processes Customer Personal Data on behalf of the Customer.

14.2

Termination or expiry of the Agreement does not relieve either party of obligations under this DPA that are intended to continue while Customer Personal Data remains in that party’s possession or control.

14.3

Clauses concerning confidentiality, deletion, liability, Restricted Transfers and other provisions that by their nature apply after termination shall survive for so long as relevant.

15. ORDER OF PRECEDENCE

15.1

In the event of a conflict concerning the Processing, privacy or security of Customer Personal Data, the following order of precedence shall apply:

(a) the SCCs, UK Addendum or another mandatory transfer mechanism, solely to the extent applicable to the relevant Restricted Transfer;

(b) this DPA;

(c) the applicable Work Order; and

(d) the Terms of Service.

15.2

The Clayface Privacy Policy describes Clayface’s privacy practices but does not modify the parties’ contractual obligations concerning Customer Personal Data under this DPA.

Where the Privacy Policy and this DPA address the same Processing of Customer Personal Data and are inconsistent, this DPA shall govern the contractual relationship between Clayface and the Customer to the extent permitted by Applicable Data Protection Law.

16. GENERAL

16.1

Except as modified by this DPA, the Agreement remains unchanged and in full force.

16.2

If any provision of this DPA is held invalid or unenforceable, that provision shall be modified to the minimum extent necessary to make it enforceable while preserving its intended effect, and the remaining provisions shall continue in full force.

16.3

An amendment to this DPA shall be effective only if agreed in writing by authorised representatives of both parties, except where a change is required solely to implement a mandatory change in Applicable Data Protection Law or an approved international transfer mechanism.

16.4

This DPA may be executed electronically and in counterparts.

SCHEDULE 1

DETAILS OF PROCESSING

1. Subject Matter

Provision of the Clayface Services described in the Agreement and applicable Work Order.

2. Duration

The applicable Term, together with the period reasonably necessary to return or delete Customer Personal Data.

3. Nature of Processing

1. We process the data to make it AI-ready and queryable.

2. We allow agentic access to the data based on access controls, ensuring each user can only access the data they would have had access to originally.

3. The agents analyze the data for insights, alerts, and other actionable material autonomously for organizational benefit.

4. Purpose of Processing

To provide, secure, maintain and support the Services requested by the Customer and perform Clayface’s obligations under the Agreement and the Customer’s documented instructions.

5. Categories of Data Subjects

Customer Personal Data may relate to:

(a) the Customer’s employees, personnel, representatives, contractors and Authorised Users;

(b) the Customer’s customers, clients, prospective customers and business contacts;

(c) creators, professionals, business representatives or other individuals whose information the Customer elects to include in Customer Content; and

(d) other individuals whose Personal Data is submitted by or on behalf of the Customer through the Services.

The precise categories will depend on the Customer’s use of the Services.

6. Categories of Customer Personal Data

Customer Personal Data may include:

(a) identifiers and contact information;

(b) business and professional information;

(c) employment and organisational information;

(d) communications and correspondence;

(e) documents, records, databases and files uploaded by the Customer;

(f) prompts, instructions, queries and messages;

(g) information contained in Customer-specific outputs, embeddings and indexes;

(h) account-related information included within Customer Content; and

(i) other Personal Data submitted by or on behalf of the Customer through the Services.

7. Sensitive Personal Data

The Customer shall not submit special categories of Personal Data, sensitive Personal Data or equivalent regulated information unless such Processing is permitted by the Agreement and the Customer has established the conditions required under Applicable Data Protection Law.

Where such Processing is expressly contemplated, the applicable Work Order or other written documentation may specify additional safeguards.

8. Frequency

Processing may occur continuously or intermittently throughout the Term depending on the Customer’s use of the Services.

9. Retention

Customer Personal Data shall be retained in accordance with the Agreement, Customer instructions and Clause 10 of this DPA.

Active-system deletion period following termination: 30 days.

Maximum residual backup period: 60 days.

SCHEDULE 2

TECHNICAL AND ORGANISATIONAL MEASURES

Clayface shall maintain technical and organisational measures appropriate to the risks associated with the Processing of Customer Personal Data.

The measures below reflect the current contractual baseline and must be read with any additional security documentation or security addendum agreed with the Customer.

1. Customer Isolation

Production Customer Environments are logically isolated from each other.

Access controls are designed to prevent one Customer from accessing another Customer’s Customer Content.

2. Encryption

Customer Personal Data is protected using encryption in transit and at rest as appropriate to the Services and architecture.

Where Customer-controlled encryption keys apply, Clayface does not independently own or control such keys or obtain independent access to them.

3. Identity and Access Management

Clayface maintains access controls designed to limit access to systems Processing Customer Personal Data to authorised personnel with a legitimate business need.

Controls may include role-based access control, least-privilege access, multi-factor authentication and periodic access review.

4. Support Access

Access to the Customer Environment for support purposes must be initiated or expressly authorised by the Customer where such access is required.

Support access is limited to personnel requiring access for the relevant support purpose and, where reasonably practicable, is time-bound and logged.

5. Logging and Monitoring

Clayface maintains logging and monitoring appropriate to the nature of the Services to support security monitoring, investigation of suspected misuse and detection of unauthorised activity.

6. Secure Development and Vulnerability Management

Clayface maintains processes designed to identify, assess and remediate material vulnerabilities affecting systems used to Process Customer Personal Data and applies security controls through its development and change-management processes.

7. Incident Response

Clayface maintains processes for identifying, investigating, containing, mitigating and responding to Security Incidents.

8. Backup and Recovery

Clayface maintains backup and recovery measures appropriate to the Services and intended to support restoration of availability following an operational or security incident.

The applicable backup retention and deletion cycle shall be confirmed before external issue of this DPA.

9. Personnel

Personnel authorised to Process Customer Personal Data are subject to appropriate confidentiality obligations and access restrictions.

10. Subprocessor Security

Clayface conducts reasonable privacy and security diligence appropriate to the nature of the Processing before engaging a material Subprocessor and requires relevant Subprocessors to maintain appropriate security and confidentiality measures.

SCHEDULE 3

AUTHORISED SUBPROCESSORS

The final Schedule shall identify, for each Subprocessor:

1. legal entity name;

2. service provided;

3. country of establishment;

4. Processing location or locations, where relevant;

5. categories of Customer Personal Data Processed;

6. purpose of Processing; and

7. applicable Restricted Transfer mechanism.

Current items requiring confirmation include:

Cloud / infrastructure provider: Azure

Artificial intelligence inference provider: Azure Foundry

Database / storage providers: Databricks

Security / monitoring providers with access to Customer Personal Data: Azure Monitor

SCHEDULE 4

INTERNATIONAL TRANSFER DETAILS

1. EU SCCs

Where the SCCs apply:

Data exporter: the Customer or relevant Customer Affiliate identified in the Agreement or Work Order.

Data importer: Phyllo Inc

Applicable Module: Module Two where the Customer acts as Controller; Module Three where the Customer acts as Processor.

Description of Transfer: as set out in Schedule 1.

Technical and Organisational Measures: as set out in Schedule 2 and any applicable security documentation.

Subprocessors: as set out in Schedule 3.

Competent Supervisory Authority: determined in accordance with Clause 13 of the SCCs based on the circumstances of the relevant exporter.

Clause 9: general written authorisation.

Clause 17: Option 1; law of Ireland.

Clause 18(b): courts of Ireland.

2. UK Transfers

Where the UK Addendum applies, the parties shall complete the applicable tables using the information contained in the Agreement and Schedules 1 to 3 of this DPA.

3. Other Transfers

The parties shall supplement this Schedule where another jurisdiction requires additional information or contractual provisions to validate a Restricted Transfer.