Data Processing Addendum

For Customer Personal Data, the Customer acts as the controller (or, where the Customer is itself a processor for a third party, as a processor) and Stelaah acts as the processor (or, under the CCPA, as a service provider). The subject matter and details of the processing are set out in Appendix 1.

Each party will comply with its own obligations under Data Protection Law in respect of the processing of Customer Personal Data. The Customer is responsible for the lawfulness of the Customer Content it submits and for having a valid legal basis to provide it to us.

Where the Customer is a processor acting for a separate controller, the Customer warrants that its instructions and authorizations to us, including its consent to our use of Subprocessors and onward transfers, have been authorized by that controller.

By entering into this DPA, the Customer instructs Stelaah to process Customer Personal Data only: (a) to provide and maintain the Services; (b) as set out in the Agreement, this DPA, and our Privacy Policy; and (c) as further documented in any other written instruction the Customer gives and that we acknowledge in writing.

We will process Customer Personal Data only on those instructions unless Data Protection Law requires otherwise, in which case we will tell the Customer before processing, unless that law prohibits us from doing so on important grounds of public interest. We will inform the Customer if, in our opinion, an instruction infringes Data Protection Law.

Purpose limitation. We will not (a) sell or share Customer Personal Data; (b) retain, use, or disclose it for any purpose other than providing the Services or as otherwise permitted by Data Protection Law; (c) process it outside the direct business relationship between the parties; or (d) combine it with personal data from other sources except as permitted for a service provider under the CCPA.

Aria AI. The Aria assistant processes Customer Content to generate responses and take actions inside the workspace at the Customer's direction. Customer Content is not used to train third-party foundation models. AI requests are routed to the model providers listed as Subprocessors, and the Customer can choose its AI provider in workspace settings.

We implement and maintain the technical and organizational measures described in Appendix 2 to protect Customer Personal Data, taking into account the state of the art, the costs of implementation, and the nature, scope, and purposes of the processing, as well as the risk to data subjects. We may update these measures provided the overall level of security is not materially reduced.

Central to our model is tenant isolation enforced at the database: every record is scoped to a single workspace and protected by row-level security, on a default-deny basis, so one workspace can never reach another's data. Access additionally follows each user's plan, workspace, and membership.

The Customer is responsible for its own use of the Services, including configuring access for its users, securing its account credentials and devices, and deciding what Customer Content to store. We are not responsible for data the Customer chooses to store or transfer outside the Services.

If we become aware of a Personal Data Breach affecting Customer Personal Data, we will notify the Customer without undue delay and take reasonable steps to identify the cause, contain it, and prevent recurrence.

Our notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point for more information. We will provide further detail as it becomes available.

The Customer is responsible for any notifications it must make to supervisory authorities or data subjects. Our notice or assistance is not an acknowledgement of fault or liability.

The Customer gives a general authorization for us to engage Subprocessors to process Customer Personal Data. A current list of Subprocessors, including their function and location, is at stelaah.com/legal/subprocessors.

Before a Subprocessor processes Customer Personal Data, we enter into a written contract imposing data protection obligations no less protective than those in this DPA, to the extent applicable to the services it provides. We remain responsible for each Subprocessor's performance of its obligations.

We will give at least 30 days' notice before a new Subprocessor begins processing Customer Personal Data, by updating the Subprocessors page and, where the Customer has subscribed, by email. The Customer may object on reasonable, data protection–related grounds within that period; we will work in good faith to address the objection, and if we cannot, the Customer may, as its sole remedy, terminate the affected Services.

The Services give the Customer self-service tools to access, correct, export, and delete Customer Personal Data, so the Customer can respond to requests from data subjects to exercise their rights.

If we receive a request from a data subject relating to Customer Personal Data, we will, where legally permitted, direct the data subject to the Customer rather than respond directly, and let the Customer know. Taking into account the nature of the processing, we will provide reasonable assistance for the Customer to meet its obligations to respond.

We and our Subprocessors may store and process Customer Personal Data in any country where we or they maintain facilities, subject to this Section.

Where a transfer of Customer Personal Data from the EEA, the United Kingdom, or Switzerland to a country without an adequacy decision is subject to Data Protection Law, we will make that transfer under an appropriate safeguard. The transfer mechanisms in Appendix 3 (including the EU SCCs and the UK IDTA) apply to those transfers and are incorporated into this DPA by reference.

Throughout the Term the Customer can export its Customer Content from the Services at any time in a structured, commonly used format.

On expiry or termination, the Customer may retrieve its Customer Content for 30 days. After that period, the Customer instructs us to delete Customer Personal Data. Consistent with our local-first, recoverable model, deletions are first soft-deleted and recoverable for a limited window before permanent removal, and residual copies in encrypted backups are deleted on our standard backup cycle. We may retain data where Data Protection Law requires.

We will make available the information reasonably necessary to demonstrate our compliance with this DPA, including the documentation referenced in Appendix 2 and any audit reports or certifications we hold from time to time.

Where Data Protection Law gives the Customer a right to audit, the Customer may audit our compliance no more than once per year (and as a supervisory authority requires) on reasonable prior notice, during business hours, in a way that does not unreasonably disrupt our operations and subject to confidentiality. Where the requested scope is covered by a current independent audit report or certification, the Customer agrees to accept that report in place of an on-site audit. Each party bears its own costs.

This DPA takes effect when the Customer accepts the Agreement or this DPA and remains in effect for the Term, after which it expires automatically once all Customer Personal Data has been deleted.

If there is any conflict, the SCCs prevail over the rest of this DPA, this DPA prevails over the rest of the Agreement, and the Agreement prevails over the Privacy Policy, in each case only on the conflicting point.

Contact. Questions about this DPA or to request a countersigned copy: privacy@stelaah.com.