Data Processing
Addendum.

1. Definitions

In this Data Processing Addendum ("DPA"), the following terms shall have the meanings set out below:

• "Subscriber Data" means any Personal Data that WUF.AI processes on behalf of Subscriber via the Service.
• "Data Controller" means the entity which determines the purposes and means of the Processing of Personal Data.
• "Data Processor" means the entity which Processes Personal Data on behalf of the Data Controller.
• "Data Protection Laws" means all laws and regulations applicable to the Processing of Personal Data under the Agreement, including the GDPR and CCPA.
• "Personal Data" means any information relating to an identified or identifiable natural person.

2. Processing of Personal Data

2.1 Roles of the Parties. The parties acknowledge and agree that with regard to the Processing of Subscriber Data, Subscriber is the Data Controller, WUF.AI is the Data Processor and that WUF.AI will engage Subprocessors pursuant to the requirements set forth in Section 5.

2.2 Subscriber's Processing of Personal Data. Subscriber shall, in its use of the Service, Process Personal Data in accordance with the requirements of Data Protection Laws. Subscriber shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Subscriber acquired Personal Data.

2.3 WUF.AI's Processing of Personal Data. WUF.AI shall treat Personal Data as Confidential Information and shall only Process Personal Data on behalf of and in accordance with Subscriber's documented instructions for the following purposes: (i) Processing in accordance with the Agreement and applicable Order Form(s); (ii) Processing initiated by Users in their use of the Service; and (iii) Processing to comply with other documented reasonable instructions provided by Subscriber.

3. Subscriber Obligations

Subscriber agrees that (i) it shall comply with its obligations as a Controller under Data Protection Laws in respect of its processing of Personal Data and any processing instructions it issues to WUF.AI; and (ii) it has provided notice and obtained (or shall obtain) all consents and rights necessary under Data Protection Laws for WUF.AI to process Personal Data and provide the Service pursuant to the Agreement and this DPA.

4. WUF.AI Obligations

WUF.AI shall:

• Process Personal Data only on documented instructions from Subscriber.
• Ensure that persons authorized to process the Personal Data have committed themselves to confidentiality.
• Take all measures required pursuant to Article 32 of the GDPR (Security of processing).
• Assist Subscriber in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR.

5. Subprocessing

Subscriber provides a general authorization for WUF.AI to engage Subprocessors to process Personal Data on Subscriber's behalf. WUF.AI will maintain an up-to-date list of its Subprocessors and provide notice of any new Subprocessor engagements. WUF.AI shall enter into a written agreement with each Subprocessor imposing data protection terms that require the Subprocessor to protect the Personal Data to the standard required by Data Protection Laws.

6. Security

WUF.AI shall implement and maintain appropriate technical and organizational security measures to protect Personal Data from Security Incidents and to preserve the security and confidentiality of the Personal Data, in accordance with WUF.AI's security standards described in the Agreement.

7. Incident Management

WUF.AI shall notify Subscriber without undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Subscriber Data, including Personal Data, transmitted, stored or otherwise Processed by WUF.AI or its Subprocessors of which WUF.AI becomes aware (a "Security Incident").

8. Return or Deletion of Data

Upon termination or expiration of the Agreement, WUF.AI shall (at Subscriber's election) delete or return to Subscriber all Subscriber Data (including copies) in its possession or control, save that this requirement shall not apply to the extent WUF.AI is required by applicable law to retain some or all of the Subscriber Data.