Data Processing Addendum

This Data Processing Addendum ("DPA") sets out proposed contractual terms between TukaSolutions LLC ("Company") and a business customer ("Customer"). It becomes effective only when incorporated into an executed Customer Agreement. Browsing or reading this page does not create a contract.

Customer acts as controller (or processor on behalf of its own controller). Company acts as processor (or subprocessor, where Customer is a processor). "Personal Data" means personal data processed by Company on Customer's behalf under the Customer Agreement. Terms such as "processing," "controller" and "data subject" have the meanings given in applicable data protection law.

Company processes Personal Data to provide the CortexAI Service for the duration of the Customer Agreement and any agreed post-termination period, for the purposes described in Annex A.

Company processes Personal Data only on Customer's documented instructions, including with respect to international transfers, unless required otherwise by law, in which case Company will inform Customer before processing unless legally prohibited. The Customer Agreement, this DPA and Customer's configuration of the Service constitute instructions. Company will inform Customer if it believes an instruction infringes applicable law.

Company ensures that persons authorized to process Personal Data are bound by confidentiality obligations and access it only as necessary.

Company will implement technical and organizational measures appropriate to the risk, taking into account the nature of processing and the state of the art. Annex B describes proposed commitments; these are not certifications or statements of completed implementation. The actual measures for a deployment are confirmed in Annex C.

Customer authorizes Company to engage subprocessors listed in a subprocessor list, including their names, locations and functions, which Company will make available to Customer before signature. Company will give notice of intended additions or replacements, and Customer may object on reasonable data-protection grounds; the parties will then work in good faith on a resolution.

Company will impose data protection obligations on subprocessors no less protective than this DPA and remains responsible for their performance.

Company will notify Customer without undue delay after becoming aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Personal Data. Company will provide information as it becomes available, in phases if necessary, and take reasonable steps to contain and mitigate the incident. Notification is not an admission of fault.

Taking into account the nature of processing, Company will assist Customer by appropriate measures in responding to data subject requests, and will forward requests it receives to Customer without responding substantively except as instructed. Company will provide reasonable assistance with data protection impact assessments, prior consultations and regulator inquiries relating to the processing.

On termination, Company will return or delete Personal Data according to the schedule agreed in Annex C, unless law requires retention. Data subject to legal hold or residing in backups will be isolated from further active processing and deleted in the ordinary backup cycle or when the hold ends.

Company will make available information reasonably necessary to demonstrate compliance with this DPA. Audits will be proportionate and will first rely on confidential documentation and questionnaire responses. Where that is insufficient, or where an inspection is required by law or a regulator, on-site or remote audits may occur on reasonable notice, subject to confidentiality and scope limits.

Where Personal Data is transferred across borders in a manner requiring a transfer mechanism, the parties will select and execute an appropriate safeguard before that transfer occurs. No transfer mechanism, including standard contractual clauses, is incorporated by this page itself.

Where applicable, Company acts as a service provider or processor and will not sell or share Personal Data, retain, use or disclose it for any purpose other than the business purposes specified in the Customer Agreement, or combine it with personal data from other sources, except as permitted by applicable law. Company will notify Customer if it can no longer meet these obligations.

With respect to the processing of Personal Data, this DPA prevails over conflicting terms in the Customer Agreement; otherwise the executed Customer Agreement controls. Any mandatory transfer terms executed by the parties prevail to the extent required. Liability under this DPA is subject to the limitations in the Customer Agreement. See also the Terms of Service and Privacy Policy. Contact: privacy@tukatek.com.

Data subjects: Customer's personnel and users; Customer's applicants, clients, customers and business contacts; other individuals whose data appears in Customer content.

Categories of data: identifiers and contact details; work and case records; documents, prompts, outputs, communications and, where configured, voice data. Special or sensitive categories only where explicitly authorized by Customer in Annex C.

Processing operations: collection, organization, storage, retrieval, AI-assisted analysis and generation, workflow automation, transmission to Customer-authorized systems, and deletion.

Duration: the term of the Customer Agreement and any agreed return or deletion period.

The following are proposed commitments, subject to the deployment model and a responsibility matrix agreed between the parties. They are not claims of current implementation or certification.

• Access control based on least privilege and role-based permissions.
• Encryption appropriate to the risk for data in transit and at rest.
• Logging and monitoring of administrative and security-relevant events.
• Logical isolation of customer environments or data.
• Backup and recovery procedures.
• Documented incident response process.
• Vendor and subprocessor oversight.

This annex must be completed and agreed before execution. No values are pre-filled.