Data Processing Addendum

This Data Processing Addendum (“DPA”) is between Oshyn Inc (“Oshyn”) and the Customer identified in the execution particulars below. It supplements the identified agreement for ContextCloud (“Agreement”) when separately signed by both parties. Accepting the Customer Terms at Checkout does not execute this DPA. This page is a reading copy. The completed signing copy and identified schedules must be exchanged and countersigned through the parties' agreed signing process; downloading or completing the copy does not itself bind either party.

1. Scope, roles, and definitions

1.1 Scope. This DPA applies to personal data in Customer Data that Oshyn processes on Customer's behalf (“Customer Personal Data”). Capitalized terms not defined here have the meanings in the Agreement. “Data Protection Law” means privacy and data-protection law applicable to that processing. A “Personal Data Breach” is a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.

1.2 Roles. Customer acts as controller or, where it acts for another controller, as processor; Oshyn acts as Customer's processor or subprocessor accordingly. Customer is responsible for lawful instructions, required notices and permissions, and authority to appoint Oshyn, including any authorization required from its own controller. Oshyn remains responsible for its obligations under this DPA and the law applicable to its processing.

1.3 Separate records. Oshyn's processing for its own business-contact, subscription, billing, and other independently determined purposes is subject to applicable law and its Privacy Notice. An individual's relationship with Customer does not remove that individual's legal rights. This exception does not authorize Oshyn to repurpose Customer Personal Data as its own business records.

2. Processing details

The execution particulars and any signed schedules identify processing-specific restrictions, approved subprocessors, security measures, locations, and transfer instruments. They must be completed sufficiently to support the proposed processing before it begins.

3. Instructions, confidentiality, and assistance

Oshyn will process Customer Personal Data only on documented instructions in the Agreement, this DPA, Customer's authorized configuration and use, and other lawful written instructions agreed by the parties. This includes instructions concerning transfers. Where law requires different processing, Oshyn will notify Customer before processing unless prohibited by law. Oshyn will promptly inform Customer if it believes an instruction infringes Data Protection Law and may suspend the affected instruction while the parties resolve the issue.

Oshyn will ensure that authorized personnel are bound by confidentiality obligations and receive access only as needed for authorized purposes. It will not use Customer Personal Data for advertising or to train AI models. Customer-selected services remain subject to section 4.

Taking account of the processing and information available to it, Oshyn will provide reasonable assistance with individual rights, security assessments, breach response, data-protection impact assessments, and required consultation with authorities. It will provide information in time to permit compliance with applicable legal deadlines. Ordinary Service controls do not replace assistance needed where those controls cannot fulfill an applicable obligation.

4. Subprocessors and Customer-selected services

4.1 Authorization and confidential register. Customer generally authorizes the subprocessors identified in the confidential register supplied to Customer and incorporated by version in the completed execution particulars. The register identifies the relevant legal entities, processing functions and locations, and applicable routing restrictions. Oshyn will supply it before the affected processing begins and keep it available to Customer. The public subprocessor explanation describes the arrangements generally; it does not replace the confidential register. Listing a possible destination alone does not authorize unlisted processing or eliminate a required transfer safeguard.

Customer will treat nonpublic register information as Confidential Information under the Agreement. Customer may disclose it to personnel and professional advisers with a need to know and appropriate confidentiality duties, to an instructing controller as required to satisfy Customer's processing obligations, and to regulators or other recipients where law requires. Confidentiality must not prevent Customer from meeting a legal obligation or exercising its rights under this DPA. Customer is not required to enter into each subprocessor's service terms merely because Oshyn uses that subprocessor.

4.2 Changes. Oshyn will update the confidential register and notify affected Customer at least 30 days before adding or replacing a subprocessor that will process Customer Personal Data. Customer may object on reasonable data-protection grounds during that period. The parties will work in good faith to resolve the objection before the proposed processing begins. If they cannot resolve it, Customer may cancel the affected subscription without a cancellation penalty, and the Agreement's cancellation, export, and data-disposition terms apply. This does not waive properly incurred charges.

The notice will identify the provider, the affected processing and proposed start date, and how to raise a data-protection objection. Updating a website or making a register available on request does not replace this notice. Oshyn will also provide notice or obtain additional authorization for a change in processing where this DPA or applicable law requires it. Routine internal changes that do not alter a subprocessor or its relevant processing do not themselves trigger the addition-or-replacement notice period.

4.3 Safeguards. Oshyn will bind its subprocessors to written obligations that provide the protection required by this DPA and applicable law, and remains responsible to Customer for their performance of those obligations. Routing through an intermediary, including OpenRouter, does not remove the required controls on downstream processing or the change process in section 4.2.

4.4 Customer vendors. A BYOK model provider or other service independently contracted by Customer is Customer's vendor for that processing, rather than Oshyn's subprocessor merely because ContextCloud sends it an authorized request. Customer is responsible for that provider arrangement. Oshyn remains responsible for its own processing and transmission, and cannot reclassify a provider it engages to perform its obligations merely by calling it a Customer-selected service.

5. Security

Oshyn will maintain appropriate administrative, technical, and organizational measures for the risk presented by the processing, including the safeguards expressly committed to in the Agreement and the security schedule identified below. Those measures will address access control, confidentiality, integrity, availability, resilience, and restoration, and appropriate review of their effectiveness.

The security schedule must describe the applicable tenant separation, credential protection, authentication and revocation controls, logging, backup and recovery arrangements, personnel access, and provider data-use restrictions. Technical availability of a feature is distinct from its configuration for Customer. Customer must perform the configuration and account-security responsibilities expressly allocated to it; those responsibilities do not replace Oshyn's duties.

6. Personal Data Breaches

Oshyn will notify Customer's designated incident contact and its administrators and billing contact without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The deadline is a maximum, not a waiting period; a shorter applicable legal requirement controls.

The initial notice will contain the information then reasonably available about the nature and likely consequences of the breach, affected data and people, response measures, and a contact for follow-up. Oshyn will provide material updates as it learns more, take reasonable containment and remediation measures, and cooperate with Customer's legally required notifications. It need not delay initial notice until its investigation is complete. Notice is not an admission of liability.

7. Compliance information and audits

Once in any 12-month period, or after a Personal Data Breach, Customer may request information reasonably needed to verify compliance, and Oshyn will respond within 30 days. If that information is insufficient, Customer or an independent auditor bound by confidentiality may conduct a proportionate audit on 30 days' notice, during ordinary business hours, without unreasonable disruption or access to other customers' confidential information. Customer bears its audit costs unless the parties agree otherwise.

These ordinary limits do not prevent additional or expedited information, audits, or cooperation required by Data Protection Law or a competent authority, or reasonably necessary to investigate credible evidence of material noncompliance. The parties will agree practical safeguards for such access. Oshyn will make available information needed to demonstrate compliance and permit and contribute to required audits; an audit report does not eliminate those duties.

8. Service scope, locations, and international transfers

Our current marketing and solicitation are limited to Customers in the United States and Canada. This marketing focus does not by itself prohibit registration from elsewhere or determine which privacy laws apply to a particular use. Customer must not use the Service for processing that requires European Economic Area, United Kingdom, or Swiss transfer safeguards unless Oshyn has approved that processing in writing and the required safeguards are in place. A US or Canadian billing address does not establish that a proposed use falls within the supported scope.

Canadian Customers remain responsible for their applicable outsourcing and transparency obligations. Oshyn will provide the information and assistance required under this DPA. Where an assessment or additional contractual protection is required for processing outside Québec or another applicable jurisdiction, it must be completed before the affected processing begins. A US governing-law clause does not displace mandatory applicable privacy law.

The Service's principal hosting is in the United States. Provider processing may occur elsewhere as identified in the completed processing particulars and applicable register. A hosting location does not itself establish a restriction on all provider, support, or connected-service processing.

Before a transfer requiring a legal safeguard begins, the parties will execute or otherwise establish the applicable transfer instrument, complete its required particulars and assessments, and implement any required supplementary measures. A statement that an instrument is available on request does not authorize a transfer before those requirements are met. Oshyn will maintain the required safeguards for its onward transfers. If a lawful transfer cannot be maintained, the affected transfer will be suspended and the parties will address lawful return, deletion, or another compliant arrangement.

9. Individual requests

Oshyn will promptly forward to Customer requests concerning Customer Personal Data and will not substantively respond except on Customer's instructions or as legally required. It may direct the requester to Customer. Oshyn will assist Customer with verification, access, correction, restriction, export, and deletion as applicable, protecting other people's information in the process. Requests concerning Oshyn's own independently controlled records are handled under its Privacy Notice and applicable law.

10. Return, deletion, and continuing protection

Unless a controlling instruction, signed term, or legal requirement provides otherwise, Customer instructs Oshyn to apply the Agreement's default retention of 365 days after Organization closure for reinstatement or export. This default does not override a binding obligation to return or delete data earlier. At the end of processing, Oshyn will, at Customer's choice where Data Protection Law requires, return or securely delete Customer Personal Data and delete remaining copies unless law requires retention.

Residual backup copies may remain only for the documented backup cycle where legally permitted, subject to continued safeguards and restriction from ordinary use. If a backup is restored, applicable deletion instructions must be reapplied. Oshyn will identify any legally required retained records and the basis for retention on reasonable request, unless prohibited by law. Upon written request, Oshyn will confirm completed deletion and describe any permitted residual copies and their scheduled disposal. This DPA continues to protect retained Customer Personal Data.

11. California processing terms

This section applies where Oshyn processes personal information as a service provider or contractor for Customer under the California Consumer Privacy Act, as amended (“CCPA”). CCPA terms have their statutory meanings. Customer discloses that information only for the limited, specified business purposes described in section 2 and the execution particulars.

Oshyn will not sell or share that personal information; retain, use, or disclose it for purposes other than the specified business purposes or as otherwise permitted by the CCPA; use it outside the direct business relationship with Customer except as legally permitted; or combine it with information received from another person or collected through Oshyn's own interactions with an individual, except as expressly permitted by the CCPA and its regulations.

Oshyn will comply with applicable CCPA obligations, provide the same level of privacy protection the CCPA requires, and notify Customer if it determines it can no longer meet those obligations. Customer may take reasonable and appropriate steps to ensure compliant use, and, on notice, stop and remediate unauthorized use. These rights include proportionate reviews, assessments, and audits under section 7. Oshyn will assist with applicable consumer requests, assessments, and audits, and will require any engaged downstream recipient to accept the written restrictions and protections required by the CCPA. Oshyn certifies that it understands and will comply with these restrictions.

12. Precedence and liability

This DPA controls conflicts with the standard Customer Terms concerning its processing subject matter. A separately signed agreement covering ContextCloud takes priority on every matter it addresses, subject to mandatory law and the required precedence of any applicable transfer instrument. The Agreement governs liability and remedies except to the extent applicable law or mandatory transfer provisions require otherwise. Signing this DPA does not itself create an uncapped category of liability or remove an exception to a liability limit in the Agreement. Subject to those qualifications, this DPA is governed by the laws of the State of Delaware.

13. Execution particulars and signatures

Complete these particulars and attach the identified schedules before signing. Any departure from the standard processing details must be expressly identified and agreed by both parties. Signatures may be exchanged in counterparts through an agreed written or electronic signing process. The DPA takes effect on the last signature date unless both parties specify another date.

Either party may update its designated privacy and incident contact details by written notice to the other party without amending the other terms of this DPA.

Contact

Oshyn Inc · Privacy Enforcement Representative · privacy@contextcloud.works