Data Processing Addendum

01Definitions

• "Customer Personal Data" means personal data contained in Customer Data (as defined in the Agreement) that Vesso processes on Customer's behalf.
• "Data Protection Laws" means all laws applicable to the processing of Customer Personal Data, including, as applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as incorporated into United Kingdom law ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), and applicable US state privacy laws such as the California Consumer Privacy Act as amended ("CCPA").
• "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0).
• "Subprocessor" means a third party engaged by Vesso to process Customer Personal Data on Customer's behalf.
• "Controller", "processor", "data subject", "personal data", "personal data breach", and "processing" have the meanings given in the GDPR; "business", "service provider", "sell", and "share" have the meanings given in the CCPA.

02Roles and Scope of Processing

As between the parties, Customer is the controller (or a processor acting on behalf of a third-party controller) and Vesso is the processor of Customer Personal Data. Where the CCPA applies, Customer is the business and Vesso is a service provider. The subject matter, duration, nature and purpose of processing, and the categories of personal data and data subjects are described in Annex 1.

Customer is responsible for the accuracy and lawfulness of Customer Personal Data, for providing all required notices and obtaining all required consents from data subjects (including meeting participants), and for its instructions to Vesso complying with Data Protection Laws.

03Processing Instructions

Vesso will process Customer Personal Data only on Customer's documented instructions, including as necessary to provide the Service, as set out in the Agreement and this DPA, as configured by Customer and its users in the Service, and as otherwise instructed in writing, unless processing is required by law to which Vesso is subject (in which case Vesso will inform Customer of that legal requirement before processing, unless the law prohibits it). Vesso will inform Customer if, in its opinion, an instruction infringes Data Protection Laws.

Vesso does not sell or share Customer Personal Data, does not retain, use, or disclose it for any purpose other than providing the Service (including as permitted for service providers under the CCPA), does not combine it with personal data from other sources except as needed to provide the Service, and does not permit its AI infrastructure providers to use Customer Personal Data to train generalized machine-learning models. Vesso certifies that it understands and will comply with these restrictions.

04Confidentiality

Vesso ensures that personnel authorized to process Customer Personal Data are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality, and that access is limited to personnel who need it to provide the Service.

05Security

Vesso implements and maintains appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, as described in Annex 2. Vesso may update those measures from time to time, provided the updates do not materially reduce the overall protection of Customer Personal Data.

06Subprocessors

Customer provides general written authorization for Vesso to engage Subprocessors. The current, authoritative list of Subprocessors is published at www.vesso.ai/subprocessors, together with a mechanism to subscribe to change notifications. Vesso will update that page at least 30 days before a new Subprocessor begins processing Customer Personal Data (except emergency replacements necessary for security or continuity, notified as soon as reasonably possible).

Customer may object to a new Subprocessor on reasonable, documented data protection grounds within 30 days of the update by writing to privacy@vesso.ai. The parties will discuss the objection in good faith; if Vesso cannot offer a commercially reasonable alternative, Customer may terminate the affected portion of the Service and receive a pro-rata refund of prepaid, unused fees for it.

Vesso will impose data protection obligations on each Subprocessor that are no less protective than those in this DPA, and remains liable to Customer for its Subprocessors' performance of those obligations.

07Data Subject Requests

Taking into account the nature of the processing, Vesso will assist Customer by appropriate technical and organizational measures, insofar as this is possible, in fulfilling Customer's obligation to respond to data subject requests (access, correction, deletion, portability, restriction, and objection). If a data subject contacts Vesso directly about Customer Personal Data, Vesso will promptly forward the request to Customer and will not respond substantively except at Customer's direction or where required by law.

08Assistance and Cooperation

Taking into account the nature of the processing and the information available to Vesso, Vesso will provide reasonable assistance to Customer with its obligations under Articles 32 to 36 of the GDPR (security, breach notification, data protection impact assessments, and prior consultation with supervisory authorities).

09Personal Data Breach

Vesso will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably available to Vesso about the nature of the breach, the categories and approximate volume of data and data subjects concerned, the likely consequences, and the measures taken or proposed to address it, supplementing the notice as further information becomes available. Vesso's notification is not an acknowledgement of fault or liability.

10International Transfers

Vesso processes Customer Personal Data primarily in the United States, as described at www.vesso.ai/subprocessors. Where Customer Personal Data subject to the GDPR, UK GDPR, or FADP is transferred to Vesso in a country not recognized as providing an adequate level of protection, the parties enter into the SCCs, which are incorporated into this DPA by reference as follows:

• Module Two (controller to processor) applies where Customer is a controller; Module Three (processor to processor) applies where Customer is a processor.
• Clause 7 (docking) is included; Clause 9 option 2 (general authorization) applies with the notice period in Section 6; Clause 11 optional language does not apply; Clause 17 option 1 applies with Irish law governing; Clause 18(b) designates the courts of Ireland.
• Annex I and Annex III to the SCCs are completed by Annex 1 of this DPA and the subprocessor page; Annex II is completed by Annex 2 of this DPA. Customer is the data exporter and Vesso the data importer.
• For transfers subject to the UK GDPR, the UK Addendum is incorporated, with Tables 1 to 3 completed by the information above and Table 4 permitting either party to end the Addendum as set out in it.
• For transfers subject to the FADP, the SCCs apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner (references to the GDPR read as the FADP, the competent authority is the FDPIC, and the governing law and forum provisions apply as adapted).

11Audits and Information

Vesso will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, including responses to reasonable written security questionnaires and available third-party audit reports or certifications. Where Data Protection Laws grant Customer an audit right that cannot be satisfied by such information, Customer may conduct an audit through a mutually agreed independent auditor, no more than once per twelve months, on at least 30 days' written notice, during business hours, without disrupting Vesso's operations, subject to confidentiality obligations, and at Customer's expense.

12Return and Deletion

Upon termination or expiration of the Agreement, Vesso will, at Customer's choice, return Customer Personal Data (via the Service's export features, available to workspace administrators for up to 30 days after termination as described in the Agreement) and/or delete it, unless retention is required by law. Deletion from backups occurs on Vesso's standard backup expiration cycles. On Customer's written request, Vesso will confirm deletion.

13Liability, Order of Precedence, and Term

Each party's liability arising out of or related to this DPA (including the SCCs) is subject to the exclusions and limitations of liability in the Agreement. In case of conflict, the SCCs prevail over this DPA, and this DPA prevails over the Agreement with respect to the processing of Customer Personal Data. This DPA takes effect when the Agreement takes effect and remains in force for as long as Vesso processes Customer Personal Data. Vesso may update this DPA as described in the Agreement's terms on changes; material updates will be notified, and the version at www.vesso.ai/dpa is the current version.

14Annex 1 — Details of Processing

• Subject matter and duration: the processing of Customer Personal Data to provide the Service, for the term of the Agreement plus the return and deletion period in Section 12.
• Nature and purpose: hosting, storage, transmission, display, analysis, transcription, AI-assisted generation, enrichment, notification, backup, and related processing needed to provide, secure, support, and improve the Service as described in the Agreement and the Privacy Policy.
• Categories of data subjects: Customer's users and personnel; Customer's prospects, customers, contacts, and leads; meeting participants (including non-users); other individuals whose personal data Customer submits to or connects with the Service.
• Categories of personal data: identification and contact data (names, email addresses, phone numbers, employers, roles); business and CRM data (accounts, opportunities, notes, tasks, activity); communications data (emails logged from connected mailboxes, chat messages, forms); calendar and meeting data (events, attendees, recordings, audio, transcripts, summaries); usage and device data; and any other personal data Customer chooses to submit. Customer agrees not to submit special categories of data or data of children except as expressly permitted in the Agreement.
• Frequency: continuous, for the duration of the Agreement.
• Competent supervisory authority (where the SCCs apply): determined in accordance with Clause 13 of the SCCs.

15Annex 2 — Technical and Organizational Measures

• Encryption: TLS for data in transit; encryption at rest for databases, file storage, recordings, and backups; OAuth tokens and comparable credentials additionally encrypted at the application layer.
• Access control: role-based access within the Service (workspace, role, and permission scoping); least-privilege IAM for infrastructure; MFA for administrative access to production systems; logical tenant isolation enforced on every workspace-scoped query.
• Availability and resilience: managed cloud services with redundancy, point-in-time recovery for primary databases, and defined backup expiration cycles.
• Operations security: logging and monitoring of production systems, secrets kept in a managed secrets store, dependency and vulnerability management, and separation of production from development environments.
• Software development: code review, automated checks in CI, and security review of changes affecting authentication, authorization, or tenant isolation.
• Personnel: confidentiality obligations, access on a need-to-know basis, and prompt revocation on role change or departure.
• Incident response: procedures for detecting, investigating, containing, and notifying about security incidents, including the breach notification commitment in Section 9.
• Subprocessor management: written agreements with flow-down data protection obligations and the public list at www.vesso.ai/subprocessors.

16Execution

This DPA is effective and binding through Customer's acceptance of the Agreement, without signature. Where a countersigned copy is required, the parties may execute the PDF version of this DPA, which is identical in substance.

17Contact

Questions? Contact us at privacy@vesso.ai.

Vesso LLC
2525 Arapahoe Ave
Ste E4 #1074
Boulder, CO 80302