Data Processing Addendum

1. Scope and definitions

This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other agreement between CustomBuilds and the customer (“Customer”) for the Services (the “Agreement”). It applies when CustomBuilds processes Customer Personal Data in providing the Services.

“Customer Personal Data” means personal data contained in Customer Content that CustomBuilds processes on Customer's behalf. “Data Protection Laws” means all laws applicable to that processing, including the EU General Data Protection Regulation (“GDPR”), the UK GDPR, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act. Terms such as “controller,” “processor,” “data subject,” and “personal data breach” have the meanings given in the Data Protection Laws.

2. Roles of the parties

Customer is the controller (or, where Customer acts on behalf of another controller, a processor) of Customer Personal Data, and CustomBuilds is a processor (or subprocessor). Under US state privacy laws, CustomBuilds acts as Customer's service provider or contractor.

Customer is responsible for the lawfulness of the personal data it submits, including providing required notices and obtaining any necessary consents. CustomBuilds will not sell or share Customer Personal Data, retain, use, or disclose it outside the direct business relationship with Customer, or combine it with personal data from other sources except as permitted by Data Protection Laws.

3. Processing instructions

CustomBuilds will process Customer Personal Data only on Customer's documented instructions. The Agreement, this DPA, and Customer's configuration and use of the Services constitute Customer's complete instructions. Additional instructions require written agreement.

CustomBuilds will inform Customer if, in its opinion, an instruction violates Data Protection Laws. The subject matter of processing is the provision of the Services; the duration is the term of the Agreement plus the deletion period described below; and the categories of data subjects and personal data are those Customer chooses to submit, typically including Customer's personnel, clients, and prospects, and contact details, professional information, and marketing data.

4. Confidentiality of personnel

CustomBuilds will ensure that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations, receive data protection training, and have access only to the extent necessary to perform the Services.

5. Subprocessors

Customer authorizes CustomBuilds to engage subprocessors to support the Services, including providers of cloud infrastructure, data storage, AI model processing, payment processing, communications, and customer support. CustomBuilds maintains a current list of subprocessors, available on request to legal@custombuilds.ai.

CustomBuilds will impose data protection obligations on each subprocessor that are no less protective than those in this DPA and remains responsible for each subprocessor's performance. CustomBuilds will provide at least 30 days' notice before adding or replacing a subprocessor. Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, Customer may terminate the affected Services and receive a refund of prepaid fees for the remaining term.

6. Security measures

CustomBuilds will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, including encryption in transit and at rest, logical separation of customer data, role-based access controls with least-privilege principles, logging and monitoring, vulnerability management, secure software development practices, business continuity and backup procedures, and regular review of these measures.

CustomBuilds may update its security measures over time, provided that updates do not materially reduce the overall level of protection.

7. Personal data breach notification

CustomBuilds will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the breach, the categories and approximate volume of data affected, likely consequences, and measures taken or proposed.

CustomBuilds will take reasonable steps to contain and remediate the breach and will provide updates as more information becomes available. Notification is not an acknowledgment of fault or liability.

8. Assistance to Customer

Taking into account the nature of the processing, CustomBuilds will provide reasonable assistance to Customer in responding to data subject requests to exercise their rights, including through self-service features of the Services. If CustomBuilds receives a request directly from a data subject, it will redirect the data subject to Customer where possible.

CustomBuilds will also provide reasonable assistance with data protection impact assessments, prior consultations with supervisory authorities, and Customer's compliance with security and breach notification obligations, to the extent Customer cannot reasonably meet them using information available to it.

9. Deletion and return of data

During the term, Customer may export Customer Content using features of the Services. Upon termination of the Agreement, CustomBuilds will, at Customer's choice, return or delete Customer Personal Data. Unless Customer requests otherwise, CustomBuilds will delete Customer Personal Data within 90 days after termination, with residual copies in backups overwritten in the ordinary course.

CustomBuilds may retain Customer Personal Data where required by law, in which case it will continue to protect the data in accordance with this DPA and process it only as required by law.

10. Audits

CustomBuilds will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, including summaries of third-party security assessments and responses to reasonable security questionnaires, no more than once per year.

If that information is not sufficient to demonstrate compliance, or where required by a supervisory authority, Customer may conduct an audit with at least 30 days' written notice, during normal business hours, subject to confidentiality obligations, and in a manner that minimizes disruption. Customer bears its own audit costs.

11. International transfers and Standard Contractual Clauses

CustomBuilds may transfer and process Customer Personal Data in the United States and other countries where it or its subprocessors operate. Where Customer Personal Data originating in the European Economic Area is transferred to a country that has not received an adequacy decision, the parties agree that the Standard Contractual Clauses adopted by the European Commission (Module Two, controller to processor, or Module Three, processor to processor, as applicable) are incorporated into this DPA by reference.

For transfers from the United Kingdom, the UK International Data Transfer Addendum applies, and for transfers from Switzerland, the Standard Contractual Clauses apply with the modifications required by Swiss law. The information required by the annexes to these clauses is set out in this DPA. If there is a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses control.

12. Liability and precedence

Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where such limitations are prohibited by Data Protection Laws. If there is a conflict between this DPA and the Agreement regarding the processing of Customer Personal Data, this DPA controls.

Questions about this DPA may be sent to legal@custombuilds.ai or privacy@custombuilds.ai.