Data Processing Addendum Template

This page is a review template, not a self-executing agreement. It becomes binding only when an Annot8 contracting entity and the customer execute it or an order form expressly incorporates this version. The executed copy must identify both legal entities, addresses, effective date, transfer modules, notice contacts, and any negotiated changes. Request an execution copy at privacy@annot8.app.

This Data Processing Addendum ("DPA") supplements the agreement for the Annot8 Service. For Customer Personal Data, Customer is the controller or processor that appoints Annot8, and Annot8 is the processor or subprocessor, as applicable. "Customer Personal Data" means personal data processed by Annot8 on the customer’s documented instructions through customer workspaces, widgets, public links, portals, chat, Analytics, recordings, integrations, and customer-configured AI.

Annot8 remains an independent controller for its own account administration, billing, fraud/security, legal compliance, and business-contact processing as described in the Privacy Policy.

Annot8 will process Customer Personal Data only to provide, secure and support the contracted Service in accordance with documented customer instructions, including the agreement and enabled configuration, unless law requires otherwise. Customer instructions do not authorize unrelated advertising, general-purpose model training, or independent reuse of identifiable customer content. Annot8 will inform Customer if an instruction appears to violate applicable data-protection law and may suspend the affected processing while the parties resolve it.

Customer is responsible for lawful instructions, notices, legal bases, consent, participant recording permission, data accuracy, rights responses, permitted data categories, and configuring roles, domains, retention, AI, Analytics, and integrations.

Annot8 will limit access to authorized personnel with a need to know, bind them to confidentiality, provide appropriate privacy/security training, and remove access when no longer required. Support access to customer content will be limited to providing support, security, or legally required assistance.

Annot8 will maintain measures appropriate to risk, including encrypted transport, managed authentication, role/workspace authorization, domain allowlists, short-lived origin-bound widget sessions, verified webhooks, encrypted integration credentials, restricted production access, dependency and vulnerability management, data minimization, backup/recovery controls, incident response, and deletion procedures. Measures may evolve without materially reducing overall protection.

Customer gives general authorization for the subprocessors identified in the execution copy and the incorporated Subprocessors list. Annot8 will impose the applicable processor obligations on each subprocessor by written contract and remains responsible for its performance as required by law. Unless a different period is agreed in the execution copy, Annot8 will give the registered customer privacy contact at least 30 days' advance notice before a new or replacement subprocessor processes Customer Personal Data. Customer may raise a reasonable data-protection objection during that period. The parties will seek an alternative; if none is available, Customer may terminate the affected Service before that processing begins and receive a prorated refund of unused prepaid fees for it. If law or an urgent security need prevents advance notice, Annot8 will notify Customer as soon as possible, explain the reason, and preserve applicable objection rights. Customer-selected integrations follow the role allocation in the execution copy; a customer selecting a destination does not remove Annot8's duties for its own subprocessors.

Taking into account the nature of processing, Annot8 will provide reasonable technical and organizational assistance for access, correction, deletion, restriction, objection, portability, consent withdrawal, automated-decision safeguards, DPIAs, prior consultation, and regulator inquiries. Annot8 will direct a request concerning customer-controlled data to Customer unless law requires another response. Additional work beyond standard product controls may be subject to reasonable fees where legally permitted.

Annot8 will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Initial notice will provide information then available, with further details supplied in phases as the investigation progresses; notice will not wait for a complete investigation. Information will include the nature of the breach, affected data and people where known, likely consequences, containment and contact details. Each party remains responsible for notifications required of it by applicable law. Notice is not an admission of fault.

During the term, Customer may use available export and deletion controls. On termination or documented request, Annot8 will delete or return Customer Personal Data according to the executed schedule, except data retained by law or in protected backups that age out under the applicable cycle. Shared content, external integration copies, billing records, security evidence, legal holds, and de-identified data are handled according to their documented role and exception. Annot8 will not actively process isolated backup data except for security, restoration, or legal requirements.

Annot8 will make available information necessary to demonstrate its compliance with the applicable processor obligations and allow for and contribute to audits, including inspections, by Customer or its mandated auditor as required by applicable data-protection law. Reasonable confidentiality, security, scheduling and scope arrangements must not prevent a legally required audit or regulator access. An audit must protect other customers' data. Independent reports may assist the review when available; this template does not imply that Annot8 currently holds such a report.

The execution copy must identify exporter/importer roles and incorporate the applicable 2021 EU Standard Contractual Clause module, UK Addendum or IDTA, and Swiss adaptations where required. The parties will complete the annexes, transfer description, security measures, competent authority, governing member-state law, and supplementary-measures assessment. Brazilian ANPD clauses, Turkish standard contracts and any required filings, or other local safeguards must be added where applicable; EU clauses are not a universal substitute. Conflicting mandatory transfer clauses control for the restricted transfer. No restricted transfer is authorized merely by publishing this template.

Where applicable US state privacy law treats Annot8 as a processor, service provider or contractor, Annot8 will process Customer Personal Data only for the limited and specified purposes in this DPA and the documented instructions. Annot8 will not sell or share it for cross-context behavioral advertising, retain, use or disclose it outside those purposes or the direct business relationship, or combine it with personal information from other customers or Annot8's independent activities except as permitted by applicable law. Annot8 will provide the required level of privacy protection, notify Customer if it can no longer meet its applicable obligations, and enable Customer to take reasonable steps to monitor compliance and stop or remediate unauthorized processing. Annot8 will bind authorized subprocessors to the required written terms and cooperate with applicable consumer-rights and assessment obligations. These terms do not apply to processing for which Annot8 is an independent controller as disclosed in the Privacy Policy.

• Subject and duration: provision of the configured Service for the agreement term plus the approved deletion/backup period.
• Nature and purposes: collect, host, organize, display, search, transmit, notify, analyze, transcribe, generate, integrate, secure, support, export, and delete customer-controlled data.
• Visitor email on the customer's behalf: where the customer enables these features, Annot8 sends transactional emails to the customer's visitors who opt in, namely status changes, official replies and changelog updates for feedback-portal posts they follow, and live-chat replies they have not yet read. Each visitor opts in individually, by following a post or ticking an unchecked checkbox; every email carries an unsubscribe link, and the customer can switch live-chat follow-ups off.
• People: customer personnel, contractors, invitees, website visitors, feedback authors, portal users, chat participants, recording participants, and other people appearing in submitted content.
• Data: identifiers/contact details; account/workspace roles; feedback/messages; page/DOM/device/diagnostic data; visitor follow, email-preference and unsubscribe records; pseudonymous Analytics identifiers/events; screenshots, files, voice/video and transcripts; AI prompts/outputs; integration destinations; notification endpoints; and support/security metadata.
• Sensitive data: not intended by default. Customer must not submit special-category, highly sensitive, child, payment, biometric, or government-ID data without an executed written schedule and appropriate safeguards. HIPAA-regulated PHI is not supported; this DPA is not a business associate agreement and does not authorize healthcare processing.
• Frequency: continuous or event-driven according to customer configuration and user actions.

The execution copy should record permitted domains/audience, approved countries, retention periods, whether public portals are enabled, whether portal email updates and live-chat email follow-ups are enabled, consent mechanism, recording exclusions, AI/Analytics status, approved integrations, support-access contacts, deletion/export contacts, and any prohibited pages or data categories.

• Identify both contracting parties, their addresses, signatures or other binding incorporation, the DPA version, effective date, and notice contacts.
• Attach the actual approved subprocessors, receiving entities, processing countries, hosting/support locations, enabled workloads, and each applicable transfer mechanism.
• Complete security measures with actual access, encryption, recovery, logging, incident, deletion, backup and supplier controls; a provider's certification does not certify Annot8.
• Specify export/return and live-system deletion timing, backup expiry, lawful retention exceptions, rights-request assistance, and the notice/objection process.
• Complete required jurisdictional schedules and assessments before the relevant processing begins. Archive the agreed text and acceptance evidence; a blank checklist is not an executed DPA.