Data Protection Addendum
1. Introduction and Scope
1.1. This Data Protection Addendum (“Addendum” or “DPA”) is entered into by and between Voltai Inc. (“Voltai”) and the Customer (as defined in the Agreement). This Addendum forms part of the Voltai Inc. Terms and Conditions or other written agreement governing your use of the Services (the “Agreement”).
1.2. Customer enters into this Addendum on behalf of itself and its Affiliates. References to “Customer” shall be deemed to include such Affiliates, except where otherwise indicated.
1.3. The Parties hereby agree that the terms and conditions set out below shall be added as an Addendum to the Agreement.
2. Definitions
2.1. For purposes of this Addendum, the capitalized terms below have the meanings set forth in the table. Cognate terms shall be construed accordingly.
Term | Definition |
|---|---|
Affiliate | Any entity that owns or controls, is owned or controlled by, or is under common control or ownership with either Customer or Voltai (as context allows), where “control” is the direct or indirect possession of the power to direct or cause the direction of an entity’s management or policies. |
Customer Personal Data | Any Personal Data provided by or made available by Customer to Voltai or collected by Voltai on behalf of Customer which is Processed by Voltai to perform the Services. |
Controller to Processor SCCs | The standard contractual clauses for cross-border transfers published by the European Commission on June 4, 2021 governing the transfer of European Area Personal Data to Third Countries, along with the Swiss FDPIC and UK ICO variations, or any successor clauses thereto. |
Data Protection Laws | Any local, state, or national law regarding the processing of Personal Data applicable to Voltai in the jurisdictions in which the Services are provided, including, without limitation, privacy, security, and data protection laws. |
EU Area | The European Union, European Economic Area, United Kingdom, and Switzerland. |
EU Area Law | (i) Directive 95/46/EC and, from May 25, 2018, Regulation (EU) 2016/679 (“EU GDPR”) together with applicable legislation implementing or supplementing the same or relating to the processing of Personal Data; (ii) Data Protection Act 1998 of the UK and the UK GDPR; (iii) Swiss DPA; (iv) any other applicable law in the EU Area; (v) any amendments or successors thereto. |
Services | The services to be supplied by Voltai to Customer or Customer’s Affiliates pursuant to the Agreement. |
Third Country | Countries that have not received an adequacy decision for data transfers from the applicable regulatory authority (e.g., the European Commission, UK ICO, or Swiss FDPIC). |
2.2. The terms “Business,” “Business Purpose,” “commercial purpose,” “Contractor,” “Controller,” “Data Subject,” “Personal Data,” “Personal Data Breach,” “Process,” “Processor,” “Sell,” “Service Provider,” “Share,” “Subprocessor,” “Supervisory Authority,” and “Third Party” have the same meanings as described in applicable Data Protection Laws.
2.3. Any capitalized term not otherwise defined herein shall have the meaning ascribed to it in the Agreement.
3. Roles of the Parties
3.1. As more fully described in Annex 1, Customer acts as a Business or Controller, and Voltai acts as a Service Provider or Processor in the Processing of Customer Personal Data. This Addendum applies solely to the Processing of Customer Personal Data by Voltai in its capacity as a Processor, Subprocessor, or Third Party as specified in Annex 1.
3.2. Customer is responsible for ensuring timely communications to any relevant Affiliates or Controllers insofar as such communications may be required to comply with applicable Data Protection Laws.
4. Description and Purpose of Personal Data Processing
4.1. Annex 1 sets out details of the Processing activities under this Addendum. 4.2. The purpose of Processing is for Voltai to provide the Services pursuant to the Agreement and any associated Order Form(s).
5. Data Processing Terms
5.1. Customer Obligations
Customer shall comply with all applicable Data Protection Laws in the collection, transfer, and use of Customer Personal Data.
Customer agrees not to provide Voltai with any data concerning a natural person’s health, religion, or any special categories of data as defined in Article 9 of the GDPR.
5.2. Voltai Obligations Voltai shall comply with all applicable Data Protection Laws in its Processing of Customer Personal Data and:
Process Only per Instructions. Voltai will Process Customer Personal Data only on documented instructions from Customer, including as set out in the Agreement, this Addendum, or via Customer’s use of the Services’ features and functionality.
Limitations. Voltai will not Sell or Share Customer Personal Data. Voltai will not process Customer Personal Data outside its business relationship with Customer or for its own commercial purposes, except as required or permitted by law. Voltai will promptly inform Customer if it believes Customer’s instructions infringe applicable Data Protection Laws.
Confidentiality. Voltai will ensure that personnel authorized to process Customer Personal Data are subject to confidentiality obligations.
Security. Voltai will maintain appropriate technical and organizational security measures, taking into account the nature, scope, context, and purposes of Processing, and the risks of varying likelihood and severity for the rights of natural persons (see also Section 11 of this Addendum).
Subprocessors.
Customer consents to Voltai’s use of Subprocessors listed in Annex 2 Voltai will provide at least thirty (30) days’ prior notice of intended changes, giving Customer the opportunity to object on reasonable data protection grounds.
Voltai will impose contractual data protection obligations on its Subprocessors that are materially the same as those in this Addendum.
Voltai remains liable for any acts or omissions of Subprocessors.
Legally Binding Requests. Where legally permissible, Voltai will notify Customer of any disclosure request by law enforcement or other authority before disclosing Customer Personal Data.
Data Subject Requests. If Voltai receives any communication from a Data Subject regarding the Processing of Customer Personal Data, Voltai will promptly inform Customer. Voltai will not respond to such requests unless authorized by Customer or required by law. Voltai will assist Customer with Data Subject rights, to the extent reasonably possible. Customer will reimburse Voltai for reasonable expenses associated with such assistance.
Personal Data Breach. Voltai will notify Customer without undue delay in the event of a Personal Data Breach involving Customer Personal Data, providing sufficient detail to allow Customer to comply with its breach-reporting obligations.
Assistance. Voltai will provide reasonable assistance to Customer in meeting its obligations under Articles 32–36 of the GDPR (security, breach notification, data protection impact assessments, and prior consultations).
Return or Deletion. Upon termination or expiry of the Agreement, Voltai will, at Customer’s choice, return or securely delete Customer Personal Data, unless retention is required by law. Any retained Customer Personal Data remains subject to confidentiality.
Records; Audit Rights.
Voltai shall maintain records to demonstrate its compliance with this Addendum.
Customer (or an appointed auditor) may audit Voltai’s compliance with this Addendum once per year, or more frequently if required by law or a Supervisory Authority, subject to reasonable notice and minimal disruption to Voltai’s business.
Customer agrees to pay Voltai for its time and out-of-pocket expenses incurred in assisting with such audits.
6. Restricted Transfers
6.1. Use of Controller to Processor SCCs If Customer Personal Data is transferred from the EU Area to a Third Country, and no lawful data transfer mechanism is in place, the relevant modules of the Controller to Processor SCCs will apply (incorporated herein by reference) with the following clarifications:
Module Two (Controller to Processor) will apply.
Clause 7 (Docking) is incorporated, Clause 9 (Subprocessors) Option 2 is chosen, and the notice period is 30 days.
Clauses 17 and 18 are governed by Irish law and the courts of Ireland.
Annex I of the EU SCCs is completed with the information set out in Annex 1 to this Addendum.
Annex II of the EU SCCs is completed with the technical and organizational measures set out in Section 11 of this Addendum.
6.2. Swiss DPA and UK Addendum Appropriate adaptations will be made to comply with Swiss DPA and UK GDPR, including the UK International Data Transfer Addendum requirements.
6.3. Voltai shall not conduct any Restricted Transfers except in compliance with this Section and any lawful data transfer mechanism required by applicable Data Protection Laws.
7. Precedence
7.1. This Addendum supplements the Agreement. If any conflict arises between this Addendum and the Agreement, this Addendum prevails. If any conflict arises between the terms of this Addendum and the Controller to Processor SCCs, the SCCs will prevail.
8. Indemnity
8.1. Customer Indemnification. To the fullest extent permissible by law, Customer shall defend and indemnify Voltai and its Affiliates against any third-party claims and related damages, liabilities, fines, or expenses (including reasonable legal fees) arising from Customer’s breach of this Addendum or Data Protection Laws.
8.2. Voltai may choose its own counsel to participate in defense and settlement of claims at its own expense.
9. Severability
9.1. If any provision of this Addendum is held to be invalid or unenforceable by a court of competent jurisdiction, the remaining provisions remain in full force and effect.
10. Miscellaneous
10.1. Privacy by Design. Voltai considers privacy by design and by default in all relevant processes. 10.2. Security of Processing. Voltai shall maintain a formal information security program as outlined in Section 11. 10.3. Breach Notification. Voltai will promptly notify Customer and relevant Supervisory Authorities (where required) of data breaches involving Customer Personal Data. 10.4. Assistance. Voltai will assist Customer in performing privacy impact assessments, if required, at Customer’s expense. 10.5. ISO Standards. Voltai shall comply with statutory and regulatory requirements, including but not limited to ISO 27001:2013, ISO 27701:2019, and EU GDPR requirements, as applicable.
10.6. Data Subject Rights. Data Subjects can exercise their rights by contacting Voltai’s Data Protection Officer:
10.7. No Temporary Files. Voltai confirms no unencrypted temporary files are generated during processing of Customer Personal Data, or if any are used, they are secured and promptly deleted.
11. Technical and Organizational Measures
Voltai maintains robust security measures to protect Customer Personal Data. Below is a summary Table of Key Security Measures:
Measure Category | Description |
|---|---|
Security Management | 1. Designated security personnel oversee the Information Security Program. 2. Security policies are reviewed and updated at least annually. 3. Regular risk assessments, including penetration testing, vulnerability scans, and patch management. |
Personnel Security | 1. Background checks for employees with data access (where legally permissible). 2. Written confidentiality obligations for personnel. 3. Mandatory security and privacy training for all employees. |
Access Controls | 1. Formal access management process based on least privilege and need-to-know. 2. Unique user IDs, strong passwords, multi-factor authentication. 3. Periodic access reviews to prevent unauthorized access. |
Data Center & Network Security | 1. Data hosted on Amazon Web Services (AWS). 2. Multi Availability Zones for resiliency, regular backup restoration tests. 3. Logging enabled for event monitoring. 4. HTTPS (TLS) encryption in transit. 5. Strict firewall rules and intrusion detection. |
Incident Response | 1. Detailed incident escalation and response procedures. 2. Monitoring of communication channels for security incidents. 3. Root cause analysis and corrective action plans for incidents. |
Data Storage & Disposal | 1. Logical isolation of customer data in multi-tenant environment. 2. Secure disposal of data (e.g., secure deletion or destruction). 3. Backup and disaster recovery processes to ensure availability and integrity. |
12. Annex 1: Description of Processing Activities
Below is a high-level overview of Voltai’s Processing of Customer Personal Data. This Annex 1 corresponds to the information required by applicable Data Protection Laws (e.g., Article 28 of the GDPR).
Item | Description |
|---|---|
Data Exporter (Controller) | Name: Customer Address: As set forth in the Order Form Contact: As set forth in the Order Form Role: Controller |
Data Importer (Processor) | Name: Voltai Inc. Contact: team@voltai.com
Role: Processor |
Categories of Data Subjects | Customer’s authorized users of the Services. |
Categories of Personal Data | - Names, email IDs (processed automatically) - Address, date of birth, past employment details (if provided) |
Sensitive Data | None |
Frequency | Continuous, as necessary to provide the Services. |
Nature & Purpose of Processing | - Provide Services (including: query, cleanse, standardize, enrich data) - Maintain and improve the Services - Store data for auditing or troubleshooting purposes |
Business Purposes (California) | - Security and integrity - Debugging - Performing services on behalf of the business - Internal research - Quality and safety - Prevent, detect, or investigate data security incidents |
Retention Period | As specified in the Agreement or Order Form. Data is returned or deleted upon termination or request, unless required by law to retain. |
13. Annex 2: List of Sub-processors
Below is the current list of approved Subprocessors. Voltai will keep this list updated and provide notice of changes as specified in Section 5.2.5 of this Addendum.
Name of Sub-processor | Description of Processing | Location |
|---|---|---|
Amazon Web Services (AWS) | Hosting the Production environment (Application and Databases) | USA |
MongoDB | Database hosting | USA |
Slack | Internal communication | USA |
GitHub | Source code management | USA |
Notion | Project management | USA |
Gusto | Human Resources (HR) | USA |
Scrut | Security and compliance management | USA |
Signature and Date
By signing the Agreement that incorporates this Addendum, the Parties acknowledge having read, understood, and agreed to all the terms and conditions contained herein. The effective date of this DPA aligns with the Effective Date of the Agreement or as otherwise agreed in writing by the Parties.