Data Processing Agreement

Capitalized terms not defined here have the meanings given in the Agreement. In this DPA:

• “Customer” means the entity that has entered into the Agreement and, through its use of the Services, causes Eniyan to process personal data on its behalf.
• “Customer Personal Data” means personal data within Customer Data that Eniyan processes on the Customer’s behalf in providing the Services, as described in Annex I.
• “Data Protection Laws” means all laws on the processing of personal data that apply to a party’s processing under the Agreement, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as it forms part of UK law together with the UK Data Protection Act 2018 (“UK GDPR”), the Swiss Federal Act on Data Protection (“FADP”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), and other US state privacy laws, each as amended or replaced.
• “Controller,” “processor,” “data subject,” “personal data,” “processing,” and “supervisory authority” have the meanings given in the GDPR, and “business,” “service provider,” “sell,” and “share” have the meanings given in the CCPA. Where another Data Protection Law uses an equivalent term, it applies accordingly.
• “Sub-processor” means any third party that Eniyan engages to process Customer Personal Data on the Customer’s behalf.
• “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data that Eniyan or its Sub-processors process. It does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, blocked sign-in attempts or denial of service attacks.
• “SCCs” means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914, and “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022), each as amended or replaced.

For Customer Personal Data, the Customer is the controller (or a processor acting for its own controller) and Eniyan is a processor (or a sub-processor). Where the Customer is a processor, it warrants that its controller has authorized the Customer’s instructions, including the appointment of Eniyan as a sub-processor, and the Customer remains our sole point of contact.

Eniyan is an independent controller, not a processor, for personal data it processes for its own purposes in running the business: the names, contact and sign-in details of the Customer’s account users; billing and payment records; information used to secure the Services and prevent fraud and abuse; support and sales communications; aggregated or de-identified information about how the Services are used; and records we keep to meet our legal obligations. That processing is described in our Privacy Policy and is not governed by Sections 3 to 14 of this DPA.

Eniyan will process Customer Personal Data only on the Customer’s documented instructions, including for transfers to a third country, unless the law to which Eniyan is subject requires otherwise. In that case we will inform the Customer of the legal requirement before processing, unless that law prohibits it on important grounds of public interest.

The Customer instructs Eniyan to process Customer Personal Data to provide, secure and support the Services in accordance with the Agreement, the Documentation and this DPA, and as the Customer further directs through its configuration and use of the Services, including the settings, Agents, connected systems and files its users choose. Those are the Customer’s complete instructions. Any additional or different instruction must be agreed in writing, and Eniyan may charge for work it requires.

Eniyan will tell the Customer promptly if, in its opinion, an instruction infringes Data Protection Laws. We are not obliged to carry out a legal review of an instruction, and we may suspend the processing the instruction concerns until the Customer confirms or changes it.

The Customer is responsible for, and warrants that:

• it has, and will maintain, a lawful basis for the processing it instructs, and its instructions comply with Data Protection Laws;
• it has given every notice and obtained every consent that Data Protection Laws require for the processing, including any explicit consent required before the Customer configures an identity check that compares a selfie with an identity document;
• it will not submit to the Services, and will configure its Agents and the Local Software so that they do not submit, special categories of personal data, data relating to criminal convictions or offenses, or personal data of children under 16, except identity-check results described in Annex I;
• the Customer Personal Data it provides is accurate and limited to what the Customer needs for its purposes;
• it keeps its account credentials, API keys and Agent credentials confidential and controls who in its organization can use the Services; and
• it will notify us promptly if it becomes aware of a Security Incident or of any unauthorized use of its accounts.

The Customer is solely responsible for its use of the Services, including what its Agents do and the configuration it chooses for the Local Software, and for determining whether the Services meet its own legal and regulatory obligations.

Eniyan will:

• process Customer Personal Data only as described in Section 3;
• ensure that the persons it authorizes to process Customer Personal Data are bound by confidentiality obligations or are under an appropriate statutory obligation of confidentiality, and have access only as needed to perform their roles;
• implement and maintain the technical and organizational measures described in Section 7 and Annex II;
• engage Sub-processors only as permitted by Section 6;
• assist the Customer as described in Sections 8, 9 and 10, taking into account the nature of the processing and the information available to us;
• make available the information described in Section 11; and
• return or delete Customer Personal Data as described in Section 13.

How the Local Software limits what we receive

The Local Software runs on the Customer’s own devices. By design, it sends Eniyan metadata about each decision, such as web domains, folder names chosen by the Customer, hashes and outcome codes, and it does not send file contents, web page content, full web addresses, prompts or payment card numbers. Two exceptions are information the Customer’s users type into the dashboard themselves: test cases and expected and actual outcomes entered for agent testing, and the list of folder locations a user enters for an Agent. These features are described in the Documentation.

When a Customer uploads a human resources file to compare with its account, the file is read in memory and is not saved. Only the rows that match an existing account member and the findings they produce are kept, and those findings are deleted on the retention schedule the Customer sets, between 30 and 730 days.

The Customer gives Eniyan general written authorization to engage Sub-processors. The Sub-processors we use, what each does and where it processes data are listed on our Sub-processors page, which forms Annex III of this DPA. The Customer approves the Sub-processors listed there on the date it accepts this DPA.

Changes

We will give at least 30 days’ notice before a new Sub-processor begins processing Customer Personal Data, by updating the Sub-processors page and by email to Customers who ask to be notified by writing to privacy@eniyantrust.com. The Customer may object on reasonable grounds relating to the protection of Customer Personal Data by writing to us within that notice period. We will then discuss the objection in good faith and may offer a change to the Customer’s configuration or use of the Services that avoids the new Sub-processor. If we cannot resolve the objection within 30 days, the Customer may terminate the part of the Services that depends on the new Sub-processor by written notice and receive a refund of any prepaid fees for the terminated part covering the period after termination. That termination and refund are the Customer’s sole and exclusive remedy for an objection.

Where a Sub-processor must be replaced urgently for security or continuity reasons, we may do so immediately and will notify the Customer as soon as practicable, after which the objection process above applies.

Our responsibility for Sub-processors

We will impose on each Sub-processor, by written contract, data protection obligations that provide at least the same level of protection for Customer Personal Data as this DPA, to the extent applicable to the services it provides. We remain liable to the Customer for each Sub-processor’s performance of its obligations as Data Protection Laws require, subject to Section 15.

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risks to individuals, Eniyan will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against Security Incidents. Our current measures are described in Annex II.

We may update these measures from time to time, provided that the updates do not materially reduce the overall protection of Customer Personal Data. The Customer is responsible for the security settings it controls, including who may access its account, whether its users use passkeys or two-step verification, how it stores credentials and API keys, and how it configures its Agents and the Local Software. Reports of suspected vulnerabilities can be sent to the address on our security page.

Eniyan will notify the Customer without undue delay after becoming aware of a Security Incident. Our notice will describe, to the extent the information is reasonably available to us, the nature of the Security Incident, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed to address it. Where we cannot provide all of this at once, we will provide it in phases as it becomes available.

We will take reasonable steps to contain, investigate and mitigate the Security Incident and will provide reasonable assistance to help the Customer meet its own obligations to notify supervisory authorities and affected individuals. The Customer is responsible for deciding whether and how to make those notifications for Customer Personal Data. Notices will be sent to the email addresses of the Customer’s account administrators.

Our notification of, or response to, a Security Incident is not an acknowledgment by Eniyan of any fault or liability.

Many requests can be handled by the Customer directly in the Services, for example by updating or removing a member, exporting audit records, or changing what an Agent may use. Where the Customer cannot do so itself, Eniyan will, taking into account the nature of the processing, provide reasonable assistance through appropriate technical and organizational measures to help the Customer respond to requests to exercise data subject rights under Data Protection Laws.

If we receive a request directly from a data subject that relates to Customer Personal Data, we will, where we can identify the Customer from the request, forward it to the Customer and will not respond ourselves except to confirm that the request has been passed on, unless the law requires otherwise. The Customer is responsible for responding.

Taking into account the nature of the processing and the information available to us, Eniyan will provide reasonable assistance to the Customer with data protection impact assessments and prior consultations with supervisory authorities that Data Protection Laws require of the Customer, in each case solely in relation to the Customer’s processing of Customer Personal Data through the Services. We will first make available the information in this DPA, the Documentation and the materials described in Section 11. Assistance beyond that may be charged at our then current rates.

Eniyan will make available to the Customer, on written request and subject to appropriate confidentiality obligations, the information reasonably necessary to demonstrate compliance with this DPA. This includes written responses to reasonable security and privacy questionnaires and summaries of our relevant policies. The Customer agrees to rely on this information first, and to request it no more than once a year unless a supervisory authority requires otherwise or a Security Incident has occurred.

Where the information provided does not reasonably demonstrate our compliance, or where a supervisory authority requires it, the Customer may carry out an audit, including an inspection, subject to the following conditions:

• the Customer gives at least 30 days’ written notice and the parties agree in advance a reasonable scope, timing and duration;
• the audit takes place no more than once in any 12 month period, during normal business hours, and without unreasonable disruption to our operations;
• the auditor is the Customer or an independent third party that is not a competitor of ours and that has agreed to confidentiality obligations acceptable to us;
• the audit does not give access to other customers’ data, to systems or information that would compromise the security of the Services or our other customers, or to our Sub-processors’ facilities, for which we will provide the information our Sub-processors make available to us; and
• the Customer bears its own costs and reimburses our reasonable costs of supporting the audit, and provides us with a copy of any report, which is our confidential information.

The once a year limit does not apply to an audit that a supervisory authority requires or that follows a Security Incident affecting the Customer’s data.

The Services are hosted in the United States, and the Customer authorizes Eniyan and its Sub-processors to transfer Customer Personal Data to, and process it in, the United States and any other country in which they operate, subject to this Section.

Transfers from the European Economic Area

To the extent the Customer’s transfer of Customer Personal Data to Eniyan is a transfer to a third country subject to Chapter V of the GDPR and no other lawful transfer mechanism applies, the parties agree to the SCCs, which are incorporated into this DPA by reference as follows:

• Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) applies where the Customer is a processor;
• the optional docking clause in Clause 7 applies;
• in Clause 9, Option 2 (general written authorization) applies, and the time period for prior notice of Sub-processor changes is the one in Section 6 of this DPA;
• the optional language in Clause 11 does not apply;
• in Clause 13, the competent supervisory authority is the one determined in accordance with that Clause and identified in Annex I, Part C;
• in Clauses 17 and 18, the SCCs are governed by the law of Ireland, and disputes are resolved by the courts of Ireland; and
• Annexes I, II and III of the SCCs are completed with the information in Annexes I, II and III of this DPA.

Transfers from the United Kingdom

For transfers of Customer Personal Data subject to the UK GDPR, the UK Addendum applies and is incorporated by reference. Tables 1 to 3 of the UK Addendum are completed with the information in this DPA and its Annexes and the SCC options in this Section, and in Table 4 both parties may end the UK Addendum as allowed by its Section 19.

Transfers from Switzerland

For transfers subject to the FADP, the SCCs apply as set out above with these changes: references to the GDPR are read as references to the FADP as applicable; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; the term “Member State” is not read so as to exclude data subjects in Switzerland from exercising their rights in their place of habitual residence; and the SCCs also protect the data of legal entities for as long as Swiss law requires it.

Requests from public authorities

If Eniyan receives a legally binding request from a public authority for Customer Personal Data, we will, unless the law prohibits it, promptly notify the Customer and direct the authority to request the data from the Customer. We will review the legality of the request, challenge it where we conclude after careful assessment that there are reasonable grounds to do so, and disclose only the minimum information the request lawfully requires.

Precedence and other mechanisms

If the SCCs or the UK Addendum conflict with this DPA, they prevail to the extent of the conflict. If Eniyan adopts another lawful transfer mechanism recognized by Data Protection Laws, that mechanism applies instead of the SCCs to the extent it covers the transfer.

During the term, the Customer can export or delete Customer Personal Data using the features of the Services. After the Agreement ends, the Customer may export Customer Personal Data for 30 days. After that period, Eniyan will delete or anonymize Customer Personal Data within 90 days, except:

• data we must keep to comply with applicable law, which we will continue to protect under this DPA and process only for that purpose;
• records we keep to demonstrate our compliance and to establish, exercise or defend legal claims, including audit logs and consent records, for the periods described in our Privacy Policy; and
• copies in backups, which are deleted on our hosting provider’s backup schedule and are not restored except to recover from a failure.

On written request, we will confirm in writing that deletion has been carried out. The Customer agrees that this Section satisfies any request to return Customer Personal Data, and that any return beyond the export features of the Services will be at the Customer’s cost.

To the extent the CCPA or another US state privacy law applies to Customer Personal Data, Eniyan acts as the Customer’s service provider or processor and receives Customer Personal Data solely to perform the Services. Eniyan will:

• not sell or share Customer Personal Data;
• not retain, use or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the business purposes of providing the Services specified in the Agreement, or as otherwise permitted by the CCPA and its regulations;
• not retain, use or disclose Customer Personal Data outside the direct business relationship between the Customer and us;
• not combine Customer Personal Data with personal data we receive from or on behalf of another person, or collect from our own interactions with individuals, except as the CCPA and its regulations permit;
• comply with the obligations that apply to us under those laws and provide the same level of privacy protection they require; and
• notify the Customer if we determine that we can no longer meet our obligations under those laws.

The Customer may, on reasonable notice, take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data, and to confirm that we use it in a manner consistent with the Customer’s obligations under those laws. We certify that we understand and will comply with the restrictions in this Section.

To the extent permitted by Data Protection Laws, each party’s liability arising out of or relating to this DPA, the SCCs and the UK Addendum, whether in contract, tort or any other theory, is subject to the exclusions and limitations of liability in the Agreement. Those limitations apply in the aggregate to all claims under the Agreement and this DPA together, and not separately to each.

Nothing in this Section limits either party’s liability to data subjects under the third-party beneficiary rights of the SCCs, or any liability that cannot be limited under applicable law.

This DPA takes effect when the Customer accepts the Agreement and continues for as long as Eniyan processes Customer Personal Data on the Customer’s behalf, including during the export and deletion periods in Section 13. Sections that by their nature should survive will survive the end of the Agreement.

On matters of data protection, if there is a conflict between the documents, the order of precedence is: first the SCCs and the UK Addendum where they apply, then this DPA, then the Agreement. In all other respects the Agreement governs.

We may update this DPA from time to time, for example to reflect changes in Data Protection Laws, guidance from supervisory authorities, or changes to our Sub-processors, by posting the new version on this page with a new effective date. During a paid subscription term, no update will materially reduce the protection of Customer Personal Data under this DPA without the Customer’s agreement, unless the change is required by law or by a supervisory authority.

Questions and notices about this DPA, including Sub-processor objections and audit requests, should be sent to privacy@eniyantrust.com or by post to Eniyan, Inc., 99 Wall Street #2444, New York, NY 10005, United States. We send notices under this DPA to the email addresses of the Customer’s account administrators, and the Customer is responsible for keeping them current.

A. The parties

• Data exporter: the Customer, as identified in its account or Order Form. Contact: the Customer’s account administrators. Activities: use of the Services. Role: controller, or processor on behalf of its own controller.
• Data importer: Eniyan, Inc., 99 Wall Street #2444, New York, NY 10005, United States. Contact: privacy@eniyantrust.com. Activities: providing the Services. Role: processor, or sub-processor.

B. Description of the processing

Categories of data subjects whose personal data may be processed:

• the Customer’s employees, contractors, members and other users of its account;
• people the Customer names as accountable operators of its Agents;
• people listed in human resources or directory data the Customer provides or connects, including through single sign-on, user provisioning or an entitlement feed;
• where the Customer uses consumer delegation features, the Customer’s own customers on whose behalf Agents act; and
• where the Customer uses customer access features, the people the Customer names to manage an Agent for one of its own customers.

Categories of personal data:

• identification and contact details, such as names, email addresses and job titles;
• employment and directory details, such as department, level, employee identifier, status, and group memberships or entitlements;
• account, security and audit records, such as sign-in events, IP addresses, browser and device user agents, actions taken in the dashboard and decisions made about Agents;
• Agent configuration and activity metadata, such as the permissions granted, approvals, and the domains, folder names, hashes and outcome codes reported by the Local Software;
• for consumer delegation, pseudonymous identifiers derived from the Customer’s own customer identifiers, consent and approval records, and transaction amounts, limits and counterparties; and
• where the Customer configures identity checks, the results of those checks, such as whether a document and selfie were verified and any fraud signals. The identity document images, selfies and any facial geometry are collected and held by our identity verification Sub-processor and are not stored by Eniyan.

Sensitive data: none is intended, other than identity-check results that may relate to a biometric comparison performed by our identity verification Sub-processor. The safeguards for that data are explicit consent collected before the check begins, restricted access, and the measures in Annex II.

Frequency of the transfer: continuous, for as long as the Customer uses the Services.

Nature and purpose of the processing: hosting, storage, analysis, display and transmission of Customer Personal Data to provide, secure and support the Services, including registering and governing Agents, enforcing the permissions the Customer sets, recording audit trails, reconciling directory data, and performing the other functions described in the Documentation, in each case as the Customer instructs.

Retention: for the term of the Agreement and the export and deletion periods in Section 13, subject to the retention settings the Customer chooses in the Services and the exceptions in Section 13.

Transfers to Sub-processors: for the subject matter, nature and duration described on the Sub-processors page.

C. Competent supervisory authority

The supervisory authority of the EU Member State in which the Customer is established or, where the Customer is not established in the EU and has appointed a representative, of the Member State in which its representative is established. Otherwise, the supervisory authority of the Member State in which the data subjects concerned are located. For the UK Addendum, the UK Information Commissioner, and for Swiss transfers, the Swiss Federal Data Protection and Information Commissioner.

Eniyan maintains the following measures, which it may update under Section 7:

• Encryption in transit: connections to the website, dashboard and APIs use TLS.
• Hosting: the Services run on a managed cloud hosting provider that controls physical security and access to its facilities and maintains regular backups of our databases.
• Access control: our staff access production systems and customer accounts only through defined platform roles granted on a least privilege basis, and staff actions on customer accounts are recorded.
• Account security for users: passkeys and two-step verification are available to every user, and organizations can require two-step verification for their members.
• Credentials: passwords are stored only as salted hashes, and API keys and emailed sign-in and reset links are stored as hashes rather than in readable form.
• Audit logging: security-relevant events are recorded in audit logs that are sealed into a tamper-evident hash chain and checked regularly.
• Data minimization in the Local Software: the Local Software sends metadata rather than content, as described in Section 5, and keeps its own secrets in the device’s credential store.
• Monitoring: application errors are monitored with request bodies, cookies, query strings and sensitive headers removed before they leave our systems.
• Separation: each customer’s data is logically separated, and access is checked against the requesting account on every request.
• Vulnerability reporting: we accept reports of suspected vulnerabilities through our security page and investigate them.
• Sub-processor management: we select Sub-processors with appropriate security practices and bind them by written contract as described in Section 6.

The list of Sub-processors, with each one’s function and processing location, is published on our Sub-processors page and is incorporated into this DPA by reference. Changes are made under Section 6.