1. Scope
1.1. Roles of Parties. With respect to Customer Data in connection with the Software that constitutes “personal data,” “personal information,” “personally identifiable information,” or any analogous term under applicable Data Protection Law (“Licensee Personal Data”), Licensee is the “controller” and “business” (as such terms are defined under applicable Data Protection Law), and SandboxAQ is the “processor” and “service provider” (as such terms are defined under applicable Data Protection Law). Each Party will comply with its respective obligations under applicable privacy and data protection law (“Data Protection Law”) in connection with the Software and Licensee Personal Data. 1.2. Scope of Processing. The subject matter, nature, duration and purpose of SandboxAQ’s processing of Licensee Personal Data as a processor in connection with the Software, the types of Licensee Personal Data processed by SandboxAQ in connection with the Software, and categories of applicable data subjects are set out in Schedule I. 1.3. Conflicts in Interpretation. If there is any inconsistency or conflict between terms of this DPA and the other terms of the Agreement, the terms of this DPA will control to the extent of such inconsistency or conflict.2. Licensee Personal Data
2.1. Licensee Personal Data Processing. SandboxAQ will only process Licensee Personal Data to provide the Software and in accordance with Licensee’s documented instructions, which are set forth in this DPA, the Agreement, or otherwise provided by Licensee to SandboxAQ in writing (“Documented Instructions”), unless required by applicable law to which SandboxAQ is subject, in which case SandboxAQ will inform Licensee of this requirement prior to processing unless legally prohibited from doing so. SandboxAQ will promptly inform Licensee if, in SandboxAQ’s opinion, a Documented Instruction infringes Data Protection Law. Licensee’s use and configuration of the Software (including any retention settings made available by SandboxAQ) are also Documented Instructions, and SandboxAQ is not required to follow an instruction that is inconsistent with the functionality of the Software. 2.2. SandboxAQ Processing Responsibilities. SandboxAQ will not (a) “sell” or “share” Licensee Personal Data (as such terms, or any analogous terms, are defined under applicable Data Protection Law), (b) retain, use, or disclose Licensee Personal Data for any purpose other than in accordance with the Documented Instructions, (c) retain, use, or disclose Licensee Personal Data outside of the direct business relationship between Licensee and SandboxAQ, nor (d) except as otherwise permitted under applicable Data Protection Law, combine Licensee Personal Data with personal data that SandboxAQ receives from or on behalf of any third party or collects from its own interaction with the data subject. SandboxAQ will comply with Data Protection Law applicable to it in its role as a processor or service provider and will promptly inform Licensee if it determines that it can no longer comply with its obligations under this DPA. 2.3. Confidentiality. SandboxAQ will ensure that each person it authorizes to process Licensee Personal Data is subject to an appropriate duty of confidentiality. 2.4. Data Deletion or Return. Following the expiration or termination of the Agreement, SandboxAQ will, at Licensee’s instruction, return or delete Licensee Personal Data and existing copies, unless retention of Licensee Personal Data is required under applicable laws, in which case SandboxAQ will continue to protect such Licensee Personal Data in accordance with this DPA and will process it only to the extent and for as long as required by such laws. To the extent permitted by Data Protection Law, SandboxAQ may also retain Licensee Personal Data (a) as necessary to resolve a dispute between the Parties, (b) as necessary to prevent, detect, or investigate fraud, abuse, security incidents, or violations of the Agreement, and (c) in backup, archival, or disaster recovery systems, until such data is deleted or overwritten in accordance with SandboxAQ’s standard backup rotation and retention practices. 2.5. Additional Permitted Processing. Notwithstanding Sections 2.1 and 2.2, and to the extent permitted by Data Protection Law, SandboxAQ may process Licensee Personal Data (a) to detect, prevent, or investigate security incidents, fraud, abuse, or violations of the Agreement; (b) to comply with applicable law or legal process, or to establish, exercise, or defend legal claims; and (c) to maintain and improve the Software provided to Licensee, provided that SandboxAQ does not use Licensee Personal Data to perform services on behalf of any other person. 2.6. Licensee Responsibilities. Licensee is responsible for (a) providing all notices and obtaining all consents and rights required under Data Protection Law for SandboxAQ’s processing of Licensee Personal Data as a processor as described in this DPA; (b) ensuring that its instructions comply with Data Protection Law; and (c) configuring the Software (including any retention settings) in a manner that complies with Data Protection Law. Licensee will not provide Licensee Personal Data to SandboxAQ in exchange for monetary or other valuable consideration, or take any action that would cause SandboxAQ not to qualify as a “processor” or “service provider” under Data Protection Law. 2.7. No Training. SandboxAQ will not use Licensee Personal Data to train, fine-tune, or otherwise modify the weights of any artificial intelligence or machine learning model, except (a) with Licensee’s prior consent (including by accepting Supplemental Terms or otherwise authorizing such use under Section 7(e) of the Agreement or in writing) or (b) as provided in Section 2.8. 2.8. Usage Data. Usage Data (as defined in the Agreement) is not Licensee Personal Data. To the extent SandboxAQ derives Usage Data from Licensee Personal Data, SandboxAQ will, before using such data for its own purposes as permitted by Section 7(b) of the Agreement (including to train, test, or fine-tune any model), aggregate or de-identify it so that it does not identify, and cannot reasonably be used to identify, Licensee or any individual.3. Subprocessors
3.1. Authorization. Licensee provides general authorization for SandboxAQ to engage third parties (including SandboxAQ’s affiliates and Third-Party Model Providers, as defined in the Agreement) to process Licensee Personal Data (“Subprocessors”), including those listed in Schedule II, as updated from time to time in accordance with Section 3.2 (the “Subprocessor List”). SandboxAQ will (a) enter into a contractual agreement with each Subprocessor that imposes data protection obligations that are substantially as protective as SandboxAQ’s obligations under this DPA to the extent applicable to the nature of the services provided by such Subprocessor, and that otherwise satisfy the requirements of Data Protection Law applicable to subcontractors, and (b) remain responsible for the acts and omissions of the Subprocessors’ processing of Licensee Personal Data under this DPA, consistent with the limitation of liability provided in the Agreement. Connected Agents (as defined in the Agreement), and the third-party platforms and systems on which they operate, are not Subprocessors, and SandboxAQ’s exchange of Licensee Personal Data with any such Connected Agent or platform in accordance with the Agreement is a Documented Instruction. 3.2. Notice of New Subprocessors. SandboxAQ will provide Licensee at least thirty (30) days’ notice (by updating the Subprocessor List and, if Licensee has subscribed to updates on the Subprocessor List, by email) before giving any new Subprocessor access to Licensee Personal Data. Licensee may object to the appointment of such new Subprocessor within fifteen (15) days of the date of such notice on reasonable privacy or security grounds by providing SandboxAQ written notice of its objection. If Licensee does not object within that period, Licensee is deemed to have authorized the new Subprocessor. In the event that Licensee objects to SandboxAQ’s appointment of a new Subprocessor, Licensee and SandboxAQ will work together in good faith, including by SandboxAQ offering commercially reasonable alternatives, to address any such objection.4. Assistance
4.1. Data Subject and Consumer Rights. SandboxAQ will (a) promptly forward to Licensee any request it receives from “data subjects” or “consumers” (as such terms are defined under applicable Data Protection Law) to exercise their rights under applicable Data Protection Law relating to Licensee Personal Data, (b) advise such data subjects and consumers to submit such requests directly to Licensee, and (c) provide Licensee with reasonable assistance, insofar as possible and taking into account the nature of the processing, as necessary for Licensee to fulfil its obligations under applicable Data Protection Law to respond to such requests. 4.2. Cooperation. Taking into account the nature of the processing and the information available to SandboxAQ, SandboxAQ will provide Licensee with reasonable assistance as necessary for Licensee to fulfil its obligations under applicable Data Protection Law, including the preparation of data protection impact assessments and, where necessary, Licensee’s consultations with regulatory authorities with jurisdiction over such processing, if such consultation is required by Data Protection Law. SandboxAQ may charge Licensee a reasonable fee for assistance under this Section 4.2 that goes beyond providing its standard documentation. Where reasonably sufficient, SandboxAQ may satisfy a request under this Section by providing its then-current standard documentation and is not required to disclose information that would compromise the security of the Software or of other customers’ data, and its assistance is limited to information in its possession, custody, or control.5. Security
5.1. Security Measures. SandboxAQ will use commercially reasonable efforts to implement and maintain reasonable and appropriate technical and organizational security measures designed to ensure a level of security of Licensee Personal Data appropriate to the risk of the processing, as described in Section 11 of Schedule I (“Security Measures”). The Parties acknowledge that the Security Measures provide an appropriate level of security for the risks of the processing of Licensee Personal Data under the Agreement. SandboxAQ may update or modify the Security Measures provided that such updates and modifications do not materially decrease the overall security of the Software. 5.2. Security Incident. SandboxAQ will notify Licensee without undue delay and in any case within seventy-two (72) hours after becoming aware of any accidental or unauthorized access to, or disclosure, loss, or use of, Licensee Personal Data (“Security Incident”). SandboxAQ will assist Licensee in complying with Licensee’s obligations under applicable Data Protection Law by making reasonable efforts to provide Licensee with information relating to the Security Incident. SandboxAQ will also use reasonable efforts to investigate the Security Incident and mitigate the effects and remediate the causes of the Security Incident. 5.3. Audits. Upon Licensee’s written request, SandboxAQ will to the extent required by applicable law permit Licensee to audit SandboxAQ’s controls applicable to its processing of Licensee Personal Data and compliance with this DPA (“Audit”) in accordance with mutually agreed upon scope and terms. SandboxAQ may satisfy such a request for an Audit in the first instance by making available reasonable information to Licensee, and Licensee may conduct additional Audits only to the extent that such information is not reasonably sufficient to demonstrate SandboxAQ’s compliance with this DPA.6. International Data Transfers
6.1. Data Transfers. Licensee authorizes SandboxAQ to conduct transfers of Licensee Personal Data to countries deemed to have an adequate level of data protection by the European Commission or the applicable competent regulatory authority or otherwise on the basis of appropriate safeguards in accordance with Data Protection Law, including pursuant to (a) the contractual clauses annexed to the European Commission’s Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as amended, superseded, or replaced from time to time (“EU SCCs”) or (b) the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner, Version B1.0, in force 21 March 2022, as amended, superseded or replaced from time to time (“UK Addendum”). 6.2. EU Data Transfers. For transfers of Licensee Personal Data from the European Economic Area, SandboxAQ and Licensee conclude Module 2 (controller-to-processor) of the EU SCCs and, if Licensee is a processor on behalf of a third-party controller, Module 3 (processor-to-processor) of the EU SCCs, which are incorporated herein and completed as follows: (a) the “data exporter” is Licensee, (b) the “data importer” is SandboxAQ, (c) the optional docking clause in Clause 7 does not apply, (d) option 2 of Clause 9(a) is implemented and the time period therein is specified in Section 3.2, (e) the optional redress clause in Clause 11(a) is struck, (f) option 1 in Clause 17 is implemented, (g) the governing law is the law of Ireland and the courts in Clause 18(b) are the Courts of Dublin, Ireland, and (h) Annex I and Annex II to Module 2 and 3 of the EU SCCs are Schedule I, and the “agreed list” of sub-processors referred to in Clause 9(a) is the Subprocessor List. 6.3. UK Data Transfers. For transfers of Licensee Personal Data from the United Kingdom, SandboxAQ and Licensee conclude the UK Addendum, which is incorporated herein and completed as follows: (a) in Table 1, the “Exporter” is Licensee and the “Importer” is SandboxAQ, and their details are set forth in this DPA and the Agreement, (b) in Table 2, the first option is selected and the “Approved EU SCCs” are the EU SCCs referred to in Section 6.2, (c) in Table 3, Annexes 1 (A and B) and II to the “Approved EU SCCs” are Schedule I; and (d) in Table 4, both the “Importer” and the “Exporter” can terminate the UK Addendum. 6.4. Swiss Data Transfers. For transfers of Licensee Personal Data subject to the Swiss Federal Act on Data Protection (“Swiss DPA”), the EU SCCs apply as modified by this Section: (a) references to the GDPR are to the Swiss DPA; (b) the Federal Data Protection and Information Commissioner is the competent supervisory authority under Clause 13 insofar as the transfer is governed by the Swiss DPA; (c) the law specified in Clause 17 is Swiss law insofar as the transfer is governed exclusively by the Swiss DPA, and otherwise as specified in Section 6.2; and (d) the term “Member State” will not be interpreted to exclude data subjects habitually resident in Switzerland from suing for their rights in their place of habitual residence in accordance with Clause 18(c).7. Liability; Changes in Law
7.1. Liability. Each Party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability in the Agreement, to the maximum extent permitted by applicable law. 7.2. Changes in Law. If a change in Data Protection Law requires an amendment to this DPA, SandboxAQ may update this DPA on reasonable prior notice to the extent required by that change, provided that no such update will modify the EU SCCs or the UK Addendum.Schedule I
Description of Processing1. List of Parties
Data exporter: Name: Licensee. Address, contact person, and (if appointed) data protection officer or EU/UK representative: as set out in the applicable Order Form or otherwise notified to SandboxAQ. Activities relevant to the data transferred under these Clauses: Licensee receives the Software as described in the Agreement and Licensee provides Licensee Personal Data to SandboxAQ in that context. Role (controller/processor): Controller. Licensee’s acceptance of the Agreement constitutes a signature of the EU SCCs, and the date of acceptance is the signature date. Data importer: Name: SB Technology, Inc. d/b/a SandboxAQ Contact: privacy@sandboxaq.com. Activities relevant to the data transferred under these Clauses: SandboxAQ provides the Software to Licensee as described in the Agreement and processes Licensee Personal Data on behalf of Licensee in that context. Role (controller/processor): Processor on behalf of Licensee. SandboxAQ is deemed to have signed the EU SCCs on the date of Licensee’s acceptance of the Agreement.2. Categories of Data Subjects
Licensee and Licensees’ users.3. Categories of Personal Data Transferred
Licensee Personal Data, the content of which is determined and controlled by Licensee.4. Sensitive Data Transferred (If Applicable)
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: N/A.5. Frequency of the Transfer
The frequency of the international data transfer (e.g. whether the Personal Data is transferred on a one-off or continuous basis): On a continuous basis.6. Nature of the Processing
The Licensee Personal Data will be processed and transferred as described in the Agreement and DPA.7. Purpose(s) of the International Data Transfer and Further Processing
The Licensee Personal Data will be transferred and further processed for the provision of the Software as described in the Agreement and DPA.8. Duration of Processing
The period for which the Personal Data will be retained, or, if that is not possible, the criteria used to determine that period: Licensee Personal Data will be retained for as long as necessary taking into account the purpose of the processing, and in compliance with applicable laws, including laws on the statute of limitations and Data Protection Law.9. Sub-Processor Transfers
For international data transfer to (Sub)Processors, also specify subject matter, nature and duration of the processing: For the subject matter and nature of the processing, reference is made to the Agreement and DPA. The processing will take place for the duration of the Agreement.10. Competent Supervisory Authority
The competent authority for the processing of Licensee Personal Data relating to data subjects located in the EEA is the Supervisory Authority of Ireland. The competent authority for the processing of Licensee Personal Data relating to data subjects located in the UK is the UK Information Commissioner. The competent authority for the processing of Licensee Personal Data relating to data subjects located in Switzerland is the Swiss Federal Data Protection and Information Commissioner.11. Technical and Organizational Measures
SandboxAQ has implemented and will maintain the technical and organizational measures described below to protect the security, confidentiality, and integrity of Licensee Personal Data. SandboxAQ may update these measures from time to time in accordance with Section 5.1.- Encryption. Data transmitted to the Software is encrypted in transit using TLS 1.2 or higher, and stored data is encrypted at rest using AES-256 or equivalent industry-standard encryption. Authentication credentials, including API keys, are encrypted before storage.
- Access controls. Only authorized SandboxAQ personnel may access Licensee Personal Data, and only as needed for support or operations. Access is based on the principle of least privilege and restricted by job function through role-based access controls, and multi-factor authentication is required for personnel accessing production systems.
- Network security. Production infrastructure is protected by firewalls and network segmentation, automated monitoring for unauthorized access attempts, and distributed denial-of-service mitigation.
- Monitoring and incident response. SandboxAQ maintains automated security monitoring and a documented incident response plan to detect, contain, and remediate Security Incidents.
- Vulnerability management and training. SandboxAQ conducts regular vulnerability assessments and penetration testing, and provides data security and privacy training to its personnel.
- Audits. SandboxAQ undergoes regular security audits and assessments.