This Data Processing Addendum (DPA) supplements the OmevAI Terms of Service or another written agreement (Agreement) between OmevAI and the Enterprise customer identified in the signature block or Order Form (Customer).

This public template does not authorise personal-data processing. It becomes effective only after manual use-case approval, execution of an NDA, completion of all schedules and signature by both parties. Capitalised terms not defined here have the meanings in the Agreement or Applicable Data Protection Law.

1. Scope

This DPA applies only to Service Processing: processing of Approved Personal Data by OmevAI on Customer's documented instructions to provide the contracted Service.

It does not apply to processing for which OmevAI independently determines purposes and essential means, including:

• account, security, fraud-prevention, billing-administration and legal-compliance processing described in the Privacy Policy; and
• general training, evaluation, testing and improvement of models and related systems (Independent Improvement Processing).

Independent Improvement Processing is mandatory under the AI and Customer Content Terms. For that purpose OmevAI acts as an independent controller. The Customer must evaluate and authorise that separate disclosure before signing this DPA. This DPA does not convert Independent Improvement Processing into processing solely on Customer's instructions.

2. Definitions

• Applicable Data Protection Law means the GDPR, UK GDPR, applicable implementing law, and another privacy law expressly identified in the completed Order Form.
• Approved Personal Data means only the data categories and use case completed in Schedule 1 and approved in writing by OmevAI.
• Controller, processor, data subject, personal data, processing, personal data breach and subprocessor have the meanings in Applicable Data Protection Law.
• GDPR means Regulation (EU) 2016/679.
• Restricted Transfer means a transfer requiring a recognised transfer mechanism under Applicable Data Protection Law.
• SCCs means the European Commission standard contractual clauses adopted by Implementing Decision (EU) 2021/914, as amended or replaced.

3. Roles and instructions

For Service Processing, Customer is controller and OmevAI is processor, unless Schedule 1 lawfully identifies Customer as a processor and OmevAI as its subprocessor.

OmevAI will process Approved Personal Data only:

1. to provide the Service and documented support;
2. as described in the Agreement, this DPA and completed schedules;
3. on additional documented instructions that are lawful, technically feasible and within the Service scope; or
4. where Union, Member State or other applicable law requires processing, in which case OmevAI will inform Customer before processing unless legally prohibited.

OmevAI will promptly inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. OmevAI may suspend the affected instruction while the parties resolve it.

Customer's instructions do not include Independent Improvement Processing. Customer separately authorises that controller-to-controller disclosure by accepting the Agreement and completed transfer schedule.

4. Customer obligations

Customer will:

• comply with Applicable Data Protection Law and ensure its instructions are lawful;
• have a valid legal basis for Service Processing and Independent Improvement Processing;
• give data subjects transparent notice of OmevAI's roles, mandatory training purpose, recipient categories and international transfers;
• collect only data necessary for the approved use case;
• not submit a prohibited category listed in the AI and Customer Content Terms;
• maintain appropriate access controls and obtain required permissions from its customers and users;
• respond to data-subject requests as controller; and
• complete any required legitimate-interest, compatibility, DPIA and transfer assessments before activation.

Customer remains responsible for the accuracy, quality, legality and provenance of Approved Personal Data.

5. Confidentiality and personnel

OmevAI will ensure that people authorised to process Approved Personal Data:

• are bound by confidentiality obligations;
• receive access only as necessary for their role;
• receive appropriate security and data-protection guidance; and
• are subject to access removal when their role ends.

The parties' NDA and confidentiality provisions in the Agreement also apply.

6. Security

Taking into account the state of the art, implementation cost, scope/context/purposes and risk, OmevAI will maintain appropriate technical and organisational measures. The baseline measures are in Schedule 2.

Customer acknowledges that the Service is multi-provider and multi-region unless a signed Order Form expressly states a dedicated architecture. Customer is responsible for secure configuration, its endpoint devices, its integration partner and its own credential handling.

OmevAI may update a measure where the update does not materially reduce the overall security of Service Processing.

7. Personal data breaches

After becoming aware of a confirmed personal data breach affecting Approved Personal Data, OmevAI will notify Customer without undue delay and provide information reasonably available to help Customer meet its notification obligations, including:

• nature and scope of the incident;
• affected data and data-subject categories where known;
• likely consequences;
• containment and remediation taken or proposed; and
• a contact for follow-up.

Information may be provided in phases. Notification is not an admission of fault. Customer is responsible for notifying authorities and data subjects unless law places that duty directly on OmevAI.

8. Data-subject requests

Taking into account the nature of processing, OmevAI will provide reasonable technical and organisational assistance for Customer to respond to requests to access, correct, delete, restrict, object or port Service Processing data.

If OmevAI receives a request clearly relating to Customer-controlled Service Processing, it will refer the requester to Customer or forward the request unless law prevents it. OmevAI may respond directly where required by law or for its independent-controller processing.

Assistance beyond standard Service functionality may be charged at a reasonable rate where permitted, especially for manifestly excessive or Customer-caused requests.

9. Compliance assistance

OmevAI will provide information reasonably necessary for Customer to:

• conduct a data-protection impact assessment;
• consult a supervisory authority where required;
• maintain Article 30 records; and
• evaluate security and Restricted Transfers.

Customer must first use available documentation and questionnaires and must not request confidential model, routing, pricing or other information unrelated to verifying data-protection compliance.

10. Subprocessors

Customer gives general written authorisation for OmevAI to use the subprocessors listed in confidential Schedule 3.

OmevAI will:

1. impose data-protection obligations offering materially equivalent protection for Service Processing;
2. remain responsible for a subprocessor's performance of those obligations to the extent required by law;
3. give at least 30 days' written notice of an intended addition or replacement, unless urgent security or legal necessity requires faster action; and
4. provide the new subprocessor's identity, function, location and transfer mechanism.

Customer may object during the notice period on specific, documented data-protection grounds. The parties will attempt to resolve the objection. OmevAI may offer a commercially reasonable alternative, restrict the affected processing, or permit termination of the affected Service. Customer has no right to demand disclosure of model selection/routing economics or a dedicated architecture without a separately priced written Order.

Provider categories and regions are described publicly in Subprocessors and Data Transfers. Categories alone do not replace confidential Schedule 3 for this DPA.

11. Restricted Transfers

The parties will use the transfer mechanism completed in Schedule 4. Where the SCCs apply, they are incorporated by reference and prevail over conflicting commercial terms for the Restricted Transfer.

OmevAI will provide reasonable information for a transfer impact assessment and implement the agreed supplementary measures. If a transfer mechanism becomes invalid or materially inadequate, the parties will cooperate on a lawful replacement; OmevAI may suspend the affected transfer if no lawful solution is reasonably available.

12. Return and deletion

At the end of Service Processing, OmevAI will, at Customer's choice and subject to technical availability, return or delete Approved Personal Data processed solely on Customer's instructions, unless law requires retention. Backup copies may remain until normal secure rotation and will remain protected and isolated from ordinary use.

This section does not require deletion of:

• independent-controller records needed for security, billing, legal compliance or claims;
• source Customer Content temporarily retained within the 24-month limit for Independent Improvement Processing;
• irreversibly anonymised data and aggregate statistics; or
• trained parameters from which the source personal data cannot reasonably be extracted or reconstructed.

Those items are governed by the Privacy Policy and AI and Customer Content Terms, not Customer instructions under this DPA.

13. Information and audits

OmevAI will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR, initially through current policies, security documentation, provider assessments and written responses.

If that information is insufficient, Customer may request one audit in a 12-month period by an independent qualified auditor bound by confidentiality, unless a confirmed breach or supervisory authority reasonably requires another audit. The audit must:

• be scoped to Customer's Approved Personal Data and relevant controls;
• occur during normal business hours with reasonable advance notice;
• avoid access to other customers' data, secrets, live credentials and confidential model/routing mechanics; and
• not unreasonably disrupt the Service.

Customer bears audit cost unless the audit identifies a material breach by OmevAI. OmevAI may satisfy a request through a recent independent report where appropriate.

14. Government requests

Unless legally prohibited, OmevAI will notify Customer of a binding government demand specifically seeking Approved Personal Data. OmevAI will review the demand, challenge it where there are reasonable grounds, and disclose no more than legally required.

15. Liability

Liability arising under this DPA is subject to the Agreement's allocation and limitation of liability to the maximum extent permitted by law. No commercial limitation restricts a data subject's rights or liability that the SCCs or mandatory law prohibit the parties from limiting.

16. Duration and termination

This DPA continues while OmevAI performs Service Processing. OmevAI may refuse or suspend an instruction or terminate personal-data-enabled processing if:

• Customer submits prohibited data or materially changes the approved use case;
• a required transfer or provider arrangement cannot lawfully continue;
• Customer fails to maintain the required lawful basis, notice, NDA or security; or
• continued processing would violate law or create material risk.

Termination of this DPA does not by itself cancel the commercial subscription, but Customer may be unable to use personal data thereafter.

17. Governing law and order of precedence

Except where the SCCs require otherwise, this DPA is governed by Estonian law and disputes are subject to Harju County Court after the 30-day good-faith resolution procedure in the Agreement.

For data-protection matters, the order of precedence is: applicable SCCs; this DPA; signed Enterprise Order Form; Agreement. A higher document controls only for the relevant conflict.

Schedule 1 — Processing details

This Schedule must be completed before signature.

A. Parties and approved use case

• Customer legal name and address: [complete in signed DPA]
• OmevAI details: [complete in signed DPA]
• Customer role: [controller / processor]
• Approved product/workflow: [describe]
• Business purpose and necessity: [describe]
• Activation date and duration: [describe]

B. Service Processing

• Subject matter: receiving Customer requests, routing them to authorised providers, generating/validating responses, returning output, saved-run functionality where ordered, usage metering, security and support.
• Nature: collection, transmission, hosting, organisation, retrieval, inference, analysis, logging, restriction, deletion and return.
• Frequency: continuous or as initiated by Customer during the Order.
• Duration: Order term plus the deletion/backup period in this DPA.

C. Approved data

• Categories of data subjects: [complete; e.g. Customer personnel, business contacts, website authors]
• Categories of ordinary personal data: [complete narrowly]
• Special categories/criminal data: not permitted
• Children: not permitted
• Government identifiers: not permitted
• Credentials/payment instruments: not permitted
• Expected volume and geography: [complete]

D. Independent Improvement Processing

• Controller-to-controller purpose: model training, evaluation, testing and related system improvement.
• Source-content maximum retention: 24 months.
• Customer notice/lawful basis confirmation: [complete]
• Required compatibility/LIA/DPIA references: [complete]

Schedule 2 — Baseline technical and organisational measures

The final schedule must be verified against production before signature.

1. Access control: role- and tenant-scoped access; least privilege; prompt removal of access; restricted administrative functions.
2. Authentication: secure login links/codes or approved OAuth; short-lived authenticated sessions; hashed tokens; protected API-key issuance and rotation.
3. Transport security: TLS for public Service endpoints and provider transport.
4. Secrets: secrets stored outside public code and customer-facing logs; restricted access; rotation/revocation process.
5. Tenant separation: organisation/project boundaries and restricted customer-facing data transfer objects.
6. Logging: security, audit, usage and request correlation; customer-facing logs omit confidential provider economics and full secrets.
7. Storage: restricted databases and object storage; durable write handling; lifecycle controls for approved retention periods.
8. Availability: monitoring, health checks, backup/recovery appropriate to the Service; no SLA unless ordered.
9. Secure development: change review, testing, dependency/patch management and separation of production access.
10. Incident response: detection, containment, investigation, recovery and notification process.
11. Data minimisation: self-service personal-data prohibition; Enterprise allowlisting by approved use case; limited display of key and billing data.
12. Deletion: 24-month Customer Content lifecycle; shorter telemetry/export limits; backup rotation and legal-hold controls.
13. Provider governance: contractual review, region/transfer mapping, subprocessor change control and restricted named list.
14. Personnel: confidentiality obligations, role-based access and security awareness.

Schedule 3 — Confidential named subprocessor annex

Provided to the prospective Enterprise customer after NDA and manual use-case review, before signature. For each potential subprocessor, complete:

Do not include model names, routing priority, prices, volumes, internal IDs or evaluation methodology.

Schedule 4 — International-transfer terms

Complete the modules applicable to the actual parties and flows:

1. EEA Customer controller → OmevAI processor for Service Processing: SCC Module 2, where required.
2. EEA Customer processor → OmevAI subprocessor: SCC Module 3, where required and authorised by the upstream controller.
3. EEA Customer controller → OmevAI independent controller for Improvement Processing: SCC Module 1 or another valid mechanism, where required.
4. OmevAI → non-EEA subprocessor: applicable onward-transfer module/contract and supplementary measures.
5. UK data: UK International Data Transfer Addendum or another valid UK mechanism where required.
6. Swiss data: SCC adaptations required under Swiss law where applicable.

For EU SCCs, the intended commercial selections are:

• Clause 7 docking clause: included only if completed in the signed DPA;
• Clause 9: general written authorisation with 30 days' notice;
• Clause 11: optional independent dispute-resolution mechanism not selected unless stated;
• Clause 17: law of Estonia where an EU Member State law is required;
• Clause 18: courts of Estonia;
• Annex I competent supervisory authority: completed based on exporter/representative and Article 13 SCC criteria;
• Annex II measures: completed from verified Schedule 2;
• Annex III subprocessors: confidential Schedule 3.

Official SCC text: European Commission Standard Contractual Clauses.

Signatures

The DPA is not effective until both parties complete the schedules and sign.

OmevAI
Name/title: [complete]
Date: [complete]
Signature: [complete]

Customer
Legal name: [complete]
Name/title: [complete]
Date: [complete]
Signature: [complete]