Data Processing Agreement

1. Definitions

Capitalized terms not defined here have the meanings given in the Terms. "GDPR" means Regulation (EU) 2016/679. "UK GDPR" means the retained EU law version of the GDPR as it applies in the UK. "Applicable Data Protection Law" means the GDPR, the UK GDPR, the Swiss FADP, the California Consumer Privacy Act (as amended), and any other data-protection or privacy law applicable to the Processor's processing under this DPA. "Personal Data", "Controller", "Processor", "Data Subject", and "Processing" have the meanings given in the GDPR.

2. Scope, roles, and subject matter

ONTHEBIAS acts as a Processor of Personal Data that Controller submits or that is generated on Controller's behalf when Controller uses the ONTHEBIAS platform. The subject-matter of the Processing is the provision of the ONTHEBIAS design, generation, and marketplace platform under the Terms. The duration is the term of the Terms plus any wind-down period described below. The nature and purpose of the Processing are described in the Terms and in Annex 1. The categories of Personal Data and of Data Subjects are described in Annex 1.

3. Processor's obligations

The Processor will:

• process Personal Data only on the documented instructions of the Controller, including with regard to international transfers, unless required to do otherwise by applicable law (in which case the Processor will inform the Controller unless the law prohibits such disclosure);
• ensure that persons authorized to process the Personal Data are subject to a binding duty of confidentiality;
• implement appropriate technical and organizational measures to protect the Personal Data (see Annex 2);
• assist the Controller, taking into account the nature of the Processing, in fulfilling the Controller's obligation to respond to Data Subject requests;
• assist the Controller with data-protection impact assessments and prior consultations with supervisory authorities;
• notify the Controller without undue delay (and in any event within 72 hours) after becoming aware of a Personal Data Breach affecting the Controller's data;
• at the Controller's choice, delete or return all Personal Data at the end of the provision of services, and delete existing copies unless retention is required by applicable law;
• make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA.

4. Sub-processors

The Controller grants a general authorization for the Processor to engage sub-processors, subject to the following. The Processor will maintain a current list of sub-processors on the Privacy Policy page and will give the Controller at least 30 days' prior notice in-app of any addition or replacement. The Controller may object to a new sub-processor on reasonable data-protection grounds within that notice period; if the Processor cannot reasonably accommodate the objection, the Controller may terminate the affected part of the service and receive a pro-rated refund of any unused prepaid period. The Processor will impose data-protection obligations on each sub-processor that are at least as protective as those in this DPA.

5. International transfers

Where the Processor transfers Personal Data of Data Subjects in the EEA, UK, or Switzerland outside those jurisdictions to a country that does not benefit from an adequacy decision, the transfer is governed by the European Commission's Standard Contractual Clauses (Module 2, Controller to Processor, or Module 3, Processor to Sub-Processor, as applicable), the UK International Data Transfer Addendum, and the equivalent Swiss instrument, each of which is incorporated into this DPA by reference and takes precedence in case of conflict. The Controller and the Processor act as the data exporter and data importer respectively, and the appropriate optional clauses (including Clause 7 docking, Clause 11 without option, Clause 17 Option 1 (law of a Member State to be agreed) and Clause 18(b) forum in that Member State) apply.

6. Data-subject requests

If the Processor receives a request from a Data Subject regarding Personal Data processed on behalf of the Controller, the Processor will not respond directly (except to acknowledge receipt) and will forward the request to the Controller without undue delay. The Processor will assist the Controller in responding, taking into account the nature of the Processing.

7. Audits

The Processor will make available to the Controller information reasonably necessary to demonstrate compliance with this DPA, including summaries of independent audits and certifications (where the Processor has obtained them). Where the Controller reasonably requires further information or an on-site audit, the Controller may audit the Processor once per year, on at least 60 days' written notice, during business hours, subject to reasonable confidentiality and security constraints, and at the Controller's cost. Where a supervisory authority requires an audit, the Processor will cooperate as required by law.

8. Term and termination

This DPA takes effect on the date stated at the top, remains in effect for the duration of the Terms, and terminates automatically on termination of the Terms. On termination, the Processor will, at the Controller's choice, return or delete all Personal Data within 30 days, except where retention is required by applicable law (in which case the Processor will maintain the confidentiality of that data and process it only as required).

9. Liability and precedence

The liability caps and exclusions in the Terms apply to this DPA. In case of conflict between this DPA and the Terms, this DPA prevails for matters relating to the Processing of Personal Data. In case of conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

10. How to countersign

By accepting the Terms, the Controller is deemed to have accepted this DPA. If a signed counterpart is required for the Controller's records (for example, for a procurement file), download this page as PDF, add signature blocks, and email a signed copy to info@onthebias.co. ONTHEBIAS will countersign and return it within 10 business days.

Annex 1 - Description of Processing

Subject matter. Provision of the ONTHEBIAS design, AI generation, and marketplace platform.

Duration. The term of the Terms plus up to 30 days for return or deletion.

Nature and purpose. Hosting, storage, database, authentication, AI generation, email delivery, payment processing, marketplace routing, analytics, security monitoring.

Categories of Personal Data. Account data (email, name, workspace), design content, chat and RFQ content, usage telemetry, IP address, commercial data (subscription, credit, order, invoice), and (only with consent) marketing preferences.

Special categories. None intended. Controller must not submit special-category Personal Data (health, biometric, political opinion, etc.) through the service unless expressly agreed in a separate written amendment.

Categories of Data Subjects. Controller's workforce, contractors, and any other individuals whose data the Controller submits to the platform.

Frequency. Continuous, for as long as the Controller uses the service.

Recipients. Sub-processors listed in the Privacy Policy, and law-enforcement or supervisory authorities where legally required.

Annex 2 - Technical and organizational measures

The Processor implements the following measures:

Encryption. TLS 1.2 or higher for data in transit; AES-256 for data at rest in the primary database and file storage.

Access control. Role-based access control, SSO with MFA for staff, principle of least privilege, and row-level security on user data.

Logging and monitoring. Audit logs for administrative actions; error and performance monitoring via Sentry; alerting on anomalies.

Hardening. Regular dependency updates, vulnerability scanning, and code review; secrets stored in a managed secret store, not source control.

Backup and recovery. Automated daily backups with encrypted storage and tested restore.

Incident response. Documented procedures for detection, containment, notification, and post-incident review.

Personnel. Confidentiality obligations in employment contracts, background checks where lawful, and periodic security training.

Physical security. Primary hosting and sub-processor infrastructure is located in secure data centers operated by our sub-processors (see Privacy Policy for the current list); we do not operate our own data center.