FRIENDLIAI CUSTOMER DATA PROCESSING AGREEMENT

This Data Processing Agreement, including its Schedules and Annexes (“DPA”) is entered into and forms part of the Customer Terms of Service (“Agreement”) between the entity that is party to that Agreement (“Customer”) and the applicable FriendliAI entity that is party to that Agreement (hereafter, “FriendliAI”) for the provision of FriendliAI’s services (“Services”), and is effective as of the date of the Agreement. FriendliAI and the Customer may be referred to individually as a “Party” and collectively as the “Parties” under this DPA.

WHEREAS:

(A) Customer wishes to contract certain Services to FriendliAI under the Agreement, which may require the Processing of Personal Data on behalf of Customer and/or Customer’s customers or end users;

(B) The Parties seek to implement this DPA to assist with compliance with applicable Data Protection Laws including the GDPR, UK GDPR, PIPEDA, PIPA, and applicable US State Privacy Laws; and

(C) The Parties wish to identify their respective rights and obligations.

The parties agree to comply with the following provisions, each acting reasonably and in good faith.

1. Definitions and Interpretation

Unless otherwise defined herein, capitalized terms and expressions used in this DPA shall have the following meaning:

“Alternative Adequate Level of Protection” means: (a) the country where FriendliAI or the applicable Sub-Processor is located is recognized by the Data Protection Laws of the EEA and/or UK (as applicable) to have an adequate level of protection of Personal Data; (b) FriendliAI or the applicable Sub-Processor have implemented binding corporate rules which provide adequate safeguards as required by the Data Protection Laws of the EEA and/or UK (as applicable); or (c) FriendliAI or the applicable Sub-Processor has implemented any other similar program or appropriate safeguards that are recognized by the Data Protection Laws of the EEA and/or UK (as applicable) as providing an adequate level of protection.

“Business” shall have the meaning given to it in the CCPA.

“BAA” shall mean the separate FriendliAI Business Associate Agreement that shall be entered into between Customer and FriendliAI to the extent that Customer requires FriendliAI to be compliant with the Privacy, Security, Breach Notification and Enforcement Rules (“HIPAA Rules”) for Protected Health Information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”)

“CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (“CPRA”), and its accompanying regulations, each as they may be amended from time to time.

“Consumer” shall have the meaning given to it in the CCPA.

“Controller” means the entity that determines the purposes and means of the Processing of Personal Data, and also includes a ‘business’ as that term is defined in the CCPA.

“Data Protection Laws” means any laws and regulations applicable in any relevant jurisdiction relating to privacy or the use or Processing of Personal Data, including without limitation: (a) CCPA and other US State Privacy Laws; (b) GDPR; (c) UK GDPR; (d) the DPA 2018; (e) EU Directive 2002/58/EC (as amended by 2009/139/EC) and any legislation implementing or made pursuant to such directive, including (in the UK) the Privacy and Electronic Communications (EC Directive) Regulations 2003; (f) any provincial or federal laws or regulations in Canada, including without limitation, PIPEDA and any substantially similar legislation enacted in the Provinces of Alberta, British Columbia and Quebec; (g) the PIPA, (h) HIPAA, and (i) any laws or regulations ratifying, implementing, adopting, supplementing or replacing any of the foregoing; in each case, to the extent in force, and as such are updated, amended or replaced from time to time.

“Data Subject” means the identified or identifiable person to whom Personal Data relates, and also includes a ‘consumer’ as that term is defined in the CCPA.

“EEA” means the European Economic Area, including Switzerland and those countries comprising the European Union (“EU”) and the European Free Trade Association.

“EU SCCs” means the standard contractual clauses approved by the European Commission in Commission Decision 2021/914 dated 4 June 2021, for transfers of Personal Data in countries not otherwise recognized as offering an adequate level of protection for Personal Data by the European Commission (as amended and updated from time to time) currently available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj. This includes the Controller-to-Processor Clauses and the Processor-to-Processor Clauses which are hereby incorporated by reference.

“GDPR” means: (a) General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data and repealing Directive 95/46/EC and any implementing laws in each EU member state, each as they may be amended from time to time.

“Personal Data” means all data which is defined as ‘personal data’ or ‘personal information’ or similar in the applicable Data Protection Laws, and which is provided by Customer or its customers or end users to FriendliAI or accessed, stored, or otherwise Processed by FriendliAI in connection with the Services, and includes Personal Data contained within ‘Customer Data,’ ‘Customer Inputs’ and ‘Customer Outputs’ as defined in the Agreement.

“PIPA” means the Korean Personal Information Protection Act, as amended in 2023, and as amended from time to time.

“PIPEDA” means the Canadian Personal Information Protection Electronic Documents Act, SC 2000 c5 and its accompanying regulations, and for purposes of this DPA shall include any substantially similar legislation enacted in the Provinces of Alberta, British Columbia and Quebec, each as they may be amended from time to time.

“Process” or “Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Processor” means the entity that Processes Personal Data on behalf of the Controller, and also includes a ‘service provider’ as that term is defined in the CCPA.

“Schedule” means a schedule to this DPA, which forms an integral part of this DPA.

“Security Incident” means a breach of FriendliAI security or any Sub-Processor’s security leading to accidental or unlawful destruction, theft, loss, alteration or unauthorized disclosure of, or access to, Personal Data.

“Selling” and “Sharing” shall have the meanings given to them in the CCPA and “sell” and “share” shall be construed accordingly.

“Sensitive Data” means (a) social security number, tax file number, passport number, driver’s license number, or similar identifier (or any portion thereof); (b) credit or debit card number (other than the truncated last four digits of a credit or debit card, which remain visible); (c) employment, financial, credit, genetic, biometric or health information; (d) racial or ethnic origin, political affiliations, philosophical or religious beliefs, trade union membership, information about sexual life or sexual orientation or identity, or criminal record; (e) account passwords; or (f) other information that falls within the definition of “special categories of data,” “sensitive data” or “nonpublic personal information” under applicable Data Protection Laws or personal information as defined in applicable data breach notification laws, and includes the limitations on Personal Data contained within paragraph 8 of the Authorized Use Policy that is Exhibit 2 to the Agreement.

“Services” means the Friendli Services as defined in the Agreement.

“Service Provider” shall have the meaning given to it in the CCPA.

“Sub-Processor” means another Processor subcontracted by FriendliAI which is to Process Personal Data for the purpose of the Services.

“Supervisory Authority” means the applicable data protection authority or other regulatory authority responsible for regulating the Processing of Personal Data in connection with the Services.

“UK GDPR” means the GDPR as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and the European Union (Withdrawal Agreement) Act 2020 in the UK and including the UK Data Protection Act 2018 (“DPA 2018”), and any implementing laws in the United Kingdom, each as they may be amended from time to time.

“UK Addendum” means the “International Data Transfer Addendum to the EU Commission Standard Contractual Clauses” issued by the United Kingdom’s Information Commissioner’s Office, Version B1.0, in force as of March 21, as revised under section 18 of the UK Mandatory Clauses, which is hereby incorporated by reference.

“US State Privacy Laws” means any laws and their accompanying regulations, each as they may be amended from time to time, applicable at the federal level and in any relevant US state relating to privacy or the use or processing of Personal Data.

Capitalized terms used, but not defined, in this DPA are defined in the Agreement.

2. Object of this DPA

The Parties acknowledge and agree that, except as provided in the paragraph below, this DPA will apply when Personal Data is Processed by FriendliAI. In this context, FriendliAI will act as Processor or Sub-Processor to Customer, who can act either as Controller or Processor (on behalf of Customer’s customers or end users) of Personal Data. As between Customer and FriendliAI, Customer shall be solely responsible for its relationship with, and its obligations and representations to Consumers, Controllers, and Data Subjects, and FriendliAI shall have no direct obligation to any Consumers, Controllers, Data Subjects or other third party except as expressly set forth in this DPA.

Notwithstanding anything in this DPA to the contrary, FriendliAI acts as an independent Controller with respect to Personal Data that it collects or generates for its own business purposes, including (i) contact details and payment details, (ii) account, authentication, and login data, and (iii) device, connection, and service-usage data (such as IP address, user agent, request timestamps, and account and API key identifiers), in each case for purposes of sales and marketing, account management, technical support, billing, legal and regulatory compliance and such other activities as set out in its Privacy Policy or in the Terms of Service. Such activities are outside of the scope of this DPA. When acting as the Controller of such data, FriendliAI shall Process such Personal Data in accordance with its Privacy Policy, the Terms of Service or the terms of any other Agreement between the Parties, and applicable Data Protection Laws.

3. Duration and Termination

This DPA shall remain in effect as long as FriendliAI carries out Processing of Personal Data on behalf of Customer as set forth in the Agreement, or until the termination of the Services, whichever period is longer.

Upon the termination or expiration of this DPA or the Agreement, any rights and obligations of the Parties accrued prior to the termination or expiration thereof shall continue to exist.

Customer acknowledges and agrees that FriendliAI shall have no liability for any losses incurred by Customer arising from or in connection with FriendliAI’s inability to perform the Services as a result of FriendliAI complying with a request to delete or return Personal Data made by Customer or Customer’s customers or end users.

The provisions of Sections 1, 3, 10-11, and 13-16 of this DPA shall survive the termination or expiration of this DPA, the Agreement and the Services.

4. Data Protection

Because the performance of the Agreement and the delivery of the Services includes the Processing of Personal Data, Customer and FriendliAI shall comply with applicable Data Protection Laws to the extent that the Personal Data is within the scope of such Data Protection Laws. It shall be the responsibility of Customer to inform FriendliAI which Personal Data FriendliAI Processes on behalf of the Customer is within the scope of the CCPA, US State Privacy Laws, GDPR, UK GDPR, PIPEDA, PIPA, and/or HIPAA and to execute any additional documents necessary for compliance with applicable international, national, provincial, state, or sector-specific Data Protection Laws. Any Personal Data subject to HIPAA shall be required to be specifically identified as such, and the Parties will be required to enter into the separate BAA prior to FriendliAI Processing any PHI under HIPAA or the HIPAA Rules.

As the Controller or Processor of Personal Data, Customer (or Customer’s customers or end users) shall ensure that it has established a valid legal basis for the Processing of the Personal Data by FriendliAI. Customer’s instructions for the Processing of Personal Data shall comply with applicable Data Protection Laws. Customer or its customers or end users shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data, including compliance with any applicable Data Subject notice and consent requirements.

FriendliAI shall only Process Personal Data on behalf of and in accordance with Customer’s documented instructions (including those set out in the Agreement and this DPA and any applicable BAA) for the following purposes unless required to by applicable laws to which FriendliAI is subject: (A) Processing in accordance with the Agreement; (B) Processing initiated by Customer or Customer’s customers or end users in their use of the Services; and (C) Processing to comply with other documented reasonable instructions provided by Customer where such instructions are consistent with the terms of the Agreement, and (D) as required by applicable Data Protection Laws.

To the extent required by applicable Data Protection Laws, FriendliAI, in acting as Customer’s Processor or Sub-Processor, shall:

  • take reasonable steps to ensure that persons authorized to Process the Personal Data are subject to statutory or contractual confidentiality obligations or are otherwise bound by confidentiality obligations;
  • take technical and organizational measures appropriate (having regard to the state of technological development and cost of implementation) for protection of the security, confidentiality and integrity of Personal Data (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss, theft, alteration, damage or unauthorized disclosure of, or access to, Personal Data), as set forth in Schedule 4 (Annex II) of this DPA;
  • at Customer’s cost and request, assist, insofar as this is possible, to fulfil Customer’s obligations to respond to requests made by Data Subjects in relation to their rights with regard to their Personal Data (as further set forth in Section 7 of this DPA);
  • at Customer’s cost and request, provide reasonable assistance in relation to any mandatory obligations applicable to Customer in relation to the performance of Data Protection Impact Assessments by Customer under applicable Data Protection Laws;
  • make available to Customer all information necessary to demonstrate compliance with the obligations laid down in this DPA and, at the cost and request of Customer, allow for and contribute to audits, including inspections conducted by Customer or another auditor mandated by Customer, as set forth in Section 9 of this DPA; and
  • inform Customer promptly if it believes that any instruction from Customer infringes applicable Data Protection Laws.

5. Data Transfers

Customer shall ensure that any data transfers to FriendliAI are in compliance with the requirements of applicable Data Protection Laws.

Where Customer acts as a Controller and FriendliAI as a Processor, and the Personal Data is subject to the Data Protection Laws of the EEA and/or the UK (as applicable), (b) transferred to FriendliAI outside the EEA and (c) where no Alternative Adequate Level of Protection applies, the Parties hereby agree that the EU SCCs (Controller-to-Processor – Module 2) will apply to the transfer of such Personal Data, as construed by reference to Schedule 1 hereto. FriendliAI may terminate the EU SCCs by giving Customer 30 days’ notice and implementing an alternative framework as may be required as provided in the Data Protection Laws of the EEA and/or the UK (as applicable).

Where Customer acts as a Processor and FriendliAI as a Sub-Processor, and the Personal Data is subject to the Data Protection Laws of the EEA and/or the UK (as applicable), (b) transferred to FriendliAI outside the EEA and (d) where no Alternative Adequate Level of Protection applies, the Parties hereby agree that the EU SCCs (Processor-to-Processor – Module 3) will apply to the transfer of Personal Data, as construed by reference to Schedule 1 hereto. FriendliAI may terminate the EU SCCs by giving Customer 30 days’ notice and implementing an alternative framework as required as provided in the Data Protection Laws of the EEA and/or the UK (as applicable).

The Parties hereby agree that the UK Addendum, as construed by reference to Schedule 2 hereto, will also apply to the transfer of Personal Data from the UK and shall supplement the EU SCCs, to the extent such transfers are subject to the UK GDPR and are to a country where no Alternative Adequate Level of Protection is recognized in the UK (as described in the UK GDPR). FriendliAI may terminate the UK Addendum by giving Customer 30 days’ notice and implementing an alternative framework as may be required as provided in the UK GDPR.

In addition, pursuant to Article 26 of the PIPA, FriendliAI shall only process Personal Data originating from the Republic of Korea in accordance with the Korean Addendum for Delegation of Personal Data Processing Services, included in Schedule 6 of this DPA.

6. California Consumer Privacy Act

Customer and FriendliAI shall comply with the CCPA to the extent that Customer is a Business and FriendliAI is a Service Provider Processing the Personal Data of Consumers on behalf of Customer. It shall be the responsibility of Customer to inform FriendliAI which Personal Data FriendliAI Processes on behalf of the Customer is within the scope of the CCPA.

Customer warrants that it discloses Personal Data of Consumers to FriendliAI solely for (i) a valid business purpose, and (ii) to permit FriendliAI to perform the Services. FriendliAI agrees to provide the same level of protection of the Consumer’s rights under the CCPA as Customer and provide the same level of privacy protection as required of businesses by the CCPA and its accompanying regulations.

To the extent the CCPA is applicable, FriendliAI shall not retain, use, or disclose Personal Data of Consumers obtained in the course of providing Services, including for any commercial purpose other than the business purposes specified in the Agreement except:

  • To process or maintain Personal Data of Consumers on behalf of the Customer in compliance with the Agreement;
  • To retain and employ another Service Provider as a Sub-Processor, where the Sub-Processor meets the requirements for a Service Provider under CCPA;
  • For internal use by FriendliAI to build or improve the quality of its services, provided that the use does not including building or modifying Consumer profiles to use in providing Services to another Business or correcting or augmenting data acquired from another source; and/or
  • To detect data Security Incidents, or to protect against fraudulent or illegal activity.

This DPA shall not restrict FriendliAI’s ability to:

  • Comply with federal, state, or local laws;
  • Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena or summons by federal, state, or local authorities;
  • Cooperate with law enforcement agencies concerning conduct or activity that Customer, FriendliAI, or a third party reasonably and in good faith believes may violate federal, state, or local law; and/or
  • Exercise or defend legal claims.

For clarity, FriendliAI shall not sell or share a Consumer’s Personal Data as the term ‘sell’ or “share” is defined in the CCPA when a Consumer has opted out of the sale of their Personal Data with the Customer and such request has been conveyed to FriendliAI.

FriendliAI shall refrain from combining Personal Data received from Customer with Personal Data (1) received from, or on behalf of, one or more entities to which it is a Service Provider or Processor, or (2) collected from FriendliAI’s own interaction with the Consumer, or (3) of opted-out Consumers which FriendliAI receives from or on behalf of Customer with Personal Data which FriendliAI receives from or on behalf of another person or persons, or collects from its own interaction with Consumers.

FriendliAI grants Customer the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data.

FriendliAI shall use the Personal Data only for the limited and specified purposes set out in Schedule 3 (Annex I).

FriendliAI certifies that it understands and will comply with the restrictions set out in this DPA. If FriendliAI at any time determines that it can no longer meets its obligations under this DPA or under the Applicable Data Protection Laws, FriendliAI shall immediately notify Customer after FriendliAI makes such determination. FriendliAI grants Customer the right to take reasonable and appropriate steps to ensure that FriendliAI uses the Personal Data that it collected pursuant to the Agreement in a manner consistent with Customer’s obligations under the CCPA and its regulations. FriendliAI shall cooperate with Customer including but not limited to, providing documentation to Customer verifying that FriendliAI no longer retains or uses Personal Data of Consumers who have made a valid request to delete with Customer.

No Re-Identification. FriendliAI agrees, except as may be necessary to fulfil the express requirements of the Agreement, to refrain from attempting to reidentify or identify any individual based on Personal Data.

7. Rights of Data Subjects

Customer is responsible for providing notice of all applicable Data Subject Rights to Customer’s customers or end users prior to using the Services. FriendliAI shall respond to any Data Subject complaint, inquiry, or request to exercise their rights regarding Personal Data (including right of access, right to rectification, restriction of Processing, erasure, data portability, objection to the Processing, or right not to be subject to automated individual decision making) (each, a “Data Subject Request”) by either asking the Data Subject to make their request to Customer or by promptly notifying Customer of the same.

FriendliAI will, in a manner consistent with the functionality of the Services, enable Customer to access, rectify, erase and restrict Processing of Personal Data (including via any deletion functionality provided by the Services, if available), and to export Personal Data.

To the extent Customer, in its use of the Services, does not have the ability to address a Data Subject Request, FriendliAI shall upon Customer’s request (and taking into account the nature of the Processing) provide commercially reasonable efforts to assist Customer in fulfilling its obligation to respond to Data Subject Requests that are required under applicable Data Protection Laws. To the extent legally permitted, Customer shall be responsible for any reasonable costs arising from FriendliAI’s provision of such assistance.

8. Sub-Processing

To the extent permitted under the Agreement, FriendliAI may appoint third parties to assist in providing the Services who may be considered Sub-Processors, provided that such Sub-Processors:

(a) agree to act only on FriendliAI’s instructions when Processing Personal Data (which instructions shall be consistent with the Customer’s Processing instructions to FriendliAI); and

(b) have entered into a written agreement with FriendliAI containing data protection obligations no less protective than those in this DPA with respect to the Processing of Personal Data to the extent applicable to the nature of the Services provided by such Sub-Processor.

The list of current FriendliAI Sub-Processors is identified in Schedule 5 (Annex III). When any new Sub-Processor is appointed that will Process Personal Data, FriendliAI will, at least thirty (30) days before the new Sub-Processor Processes any Personal Data, post the updated Sub-processors at https://friendli.ai/subprocessors for notice as listed in paragraph 4 of the Agreement (the “Notice Period”).

In the event that Customer reasonably objects to the Processing of its Personal Data by any Sub-Processor, it shall inform FriendliAI immediately by emailing its objection and the grounds for its objection to the email address(es) for notice as listed in the Agreement. In such event, FriendliAI will do one of the following at FriendliAI’s option: (a) instruct the Sub-Processor to cease any further Processing of the Customer’s Personal Data, in which event this DPA shall continue unaffected (Customer acknowledges that the inability to use a particular new Sub-Processor may result in delay in performing the Services, inability to perform the Services or increased fees), or (b) allow the Customer to terminate this DPA and the Agreement and related Services immediately with no further liability to FriendliAI. Customer’s failure to object in writing within the Notice Period time period shall constitute approval to use the new Sub-Processor.

FriendliAI shall be liable for the acts and omissions of its Sub-Processors to the same extent FriendliAI would be liable if performing the services of each Sub-Processor directly under the terms of this DPA.

9. Data Protection Impact Assessment and Privacy Risk Assessment

FriendliAI shall, taking into account the nature of the processing and the information available to FriendliAI, provide reasonable assistance to Customer at Customer’s cost, with any data protection impact assessments and privacy risk assessments and prior consultations with supervisory authorities or other competent regulatory authorities as required for the Customer to fulfill its obligations under applicable Data Protection Laws.

10. Security Incidents

FriendliAI shall notify Customer of a Security Incident in relation to Customer’s Personal Data without undue delay, and, at the Customer’s request, provide reasonable assistance in relation to any mandatory obligations applicable to the Customer in relation to a Security Incident under applicable Data Protection Laws, in each case at the Customer’s cost; provided, however, that nothing in this paragraph shall prohibit FriendliAI from taking the steps as FriendliAI deems necessary and reasonable in order to remedy or mitigate the effects of the Security Incident.

11. Deletion of Personal Data

Upon termination or expiration of the DPA or the Agreement, or at any earlier moment if the Personal Data are no longer relevant for the delivery of the Services, at the choice of the Customer, FriendliAI shall enable Customer to retrieve and/or delete Personal Data from the Service before any termination of the Agreement. Customer instructs FriendliAI, after the end of the provision of the Services, to delete all Personal Data in FriendliAI’s possession or control, and FriendliAI shall delete such Personal Data within 90 days or shorter as required by applicable Data Protection Laws, including, without limitation, when a Data Subject exercises their right to erasure, but this requirement shall not apply to the extent FriendliAI is required by applicable law to retain all or some of the Personal Data or to Personal Data FriendliAI has archived on backup systems, which data FriendliAI shall securely isolate and protect from further processing except to the extent required by such law, until such time as the relevant backup archive is destroyed in accordance with FriendliAI’s standard backup destruction policies, which shall not exceed 90 days after the date such data was backed up.

12. Audit Rights

To the extent that Audit Rights are specifically authorized by the applicable Data Protection Law, upon Customer’s request, with not less than thirty (30) days’ notice, FriendliAI agrees (at Customer’s expense) to permit Customer to perform reviews of FriendliAI’s compliance with its security obligations set forth under the DPA (the “Customer Audits”). Customer Audits may be conducted by the internal and external auditors and personnel of Customer who have entered into FriendliAI’s form of nondisclosure agreement (collectively, “Auditors”). The scope of such Customer Audits shall be agreed in advance with FriendliAI. Such Customer Audits shall be conducted in accordance with FriendliAI’s security policies and procedures, without undue disruption to FriendliAI’s operations, in a commercially reasonable manner, and shall be limited to the security aspects of the Services provided to Customer. Customer Audit(s) will be performed at Customer’s sole cost and Customer will reimburse FriendliAI for its reasonable costs associated with such additional Customer Audits. Customer shall promptly notify FriendliAI with information regarding the results of Customer Audits, including any information that FriendliAI is not Processing Personal Data in accordance with its obligations under this DPA. If the requested scope of the Customer Audit is addressed in an SSAE 16/ISAE 3402 Type 2, ISO, NIST or similar audit report performed by a qualified third-party auditor within twelve (12) months of the request of the Customer Audit and FriendliAI confirms there are no known material changes in the controls audited, Customer agrees to accept those findings in lieu of requesting an audit of the controls covered by the report.

13. Customer Instructions

FriendliAI shall not be liable for any claim brought by Customer or any end user or customer of Customer or any other third party arising from FriendliAI’s compliance with Customer’s instructions.

14. Limitation of Liability

The total liability of FriendliAI (and its Affiliates and their respective employees, directors, officers, agents, successors, and assigns) arising out of or related to this DPA and the Agreement, whether in contract, tort, or other theory of liability, shall in the aggregate, be subject to the limitation of liability set forth in the Agreement.

15. Miscellaneous Provisions

This DPA, together with the Agreement, sets out all of the terms that have been agreed between the Parties in relation to the subjects covered by it hereof and supersedes and replaces all prior agreements or understandings, whether written or oral, with respect to the same subject matter that are still in force between the Parties.

Except as otherwise set forth herein, any amendments to this DPA, as well as any additions or deletions, must be agreed to in writing by both Parties.

Customer acknowledges that FriendliAI may disclose any information processed pursuant to this DPA, and any other relevant data protection and privacy provisions to the U.S. Department of Commerce, the Federal Trade Commission, or any other judicial or regulatory body upon their request.

To the extent that any provision of this DPA conflicts with any provision of the Agreement, the terms of the DPA shall prevail, as to the specific subject matter of the DPA.

Whenever possible, the provisions of this DPA shall be interpreted in such a manner as to be valid and enforceable under the applicable law. If any part of this DPA is held invalid, illegal or unenforceable, the validity of all remaining parts will not be affected. Moreover, in such an event, the Parties shall amend the invalid, illegal or unenforceable parts and/or agree on a new provision to reflect as much as possible the intended purpose of the invalid, illegal or unenforceable provision.

Any failure, delay, action or inaction by a Party to exercise its rights under this DPA, shall not be considered a waiver of that Party’s rights under this DPA, and shall not operate to preclude such rights. Any waiver of a right must be express and in writing.

16. Applicable Law and Jurisdiction

To the extent required by applicable Data Protection Laws (e.g., in relation to the governing law of the EU SCCs and the UK Addendum), this DPA shall be governed by the law of the applicable jurisdiction. In all other cases, the laws of the jurisdiction specified in the Agreement shall apply to this DPA.

List of Schedules:

  • Schedule 1: References to EU Standard Contractual Clauses - Controller to Processor and Processor to Processor
  • Schedule 2: (if applicable) UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses
  • Schedule 3: Data Processing Details (also Annex I to the EU SCCs)
  • Schedule 4: Security (also Annex II to the EU SCCs)
  • Schedule 5: Sub-Processors (also Annex III to the EU SCCs)
  • Schedule 6: Korean Addendum for Delegation of Personal Data Processing Services

Schedule 1 - EEA Transfers

This Schedule shall apply when the Personal Data is (a) subject to the Data Protection Laws of the EEA and/or the UK (as applicable) (b); transferred to FriendliAI outside the EEA and/or UK and (c) where no Alternative Adequate Level of Protection applies (the “EEA Transfer”).

The Parties hereby agree that the EU SCCs shall be construed as set forth below. FriendliAI may terminate the EU SCCs by giving Customer 30 days’ notice and implementing an alternative framework as may be required as provided by the Data Protection Laws of the EEA and/or the UK (as applicable).

  1. The EEA Transfer shall be governed by the EU SCCs and references in the EU SCCs and in this Schedule 1 to the data exporter shall be Customer and references to the data importer shall be FriendliAI.
  1. The EU SCCs are hereby incorporated into this DPA with and construed as follows (with references in this paragraph 1.2 to Clauses being to Clauses of the EU SCCs):

1.1.a.1. All footnotes and explanatory notes in the EU SCCs are deleted;

1.1.a.1.1. Where the EEA Transfer is a Controller-to-Processor transfer, specifically where Customer acts as the Controller and data exporter, and FriendliAI acts as the Processor and data importer, only the provisions relating to Module 2 apply to such EEA Transfer;

1.1.a.1.2. Where the EEA Transfer is a Processor-to-Processor transfer, specifically where Customer acts as the Processor and data exporter, and FriendliAI acts as the Sub-Processor and data importer, only the provisions relating to Module 3 apply to such EEA Transfer;

1.1.a.2. Clause 7 (Docking Clause) of the EU SCCs (Module 2 and Module 3) applies.

1.1.a.3. The instructions to the data importer shall be construed by reference to Section 4 of this DPA and which in the case of Module 3 constitute the instructions of the relevant Controller(s);

1.1.a.4. Clause 8.5 (Duration of processing and erasure or return of data) of the EU SCCs (Module 2 and Module 3) shall be construed by reference to Section 3 of this DPA;

1.1.a.5. Clause 8.9(d) (audits) of the EU SCCs (Module 2 and Module 3) shall be construed by reference to Section 9 of this DPA;

1.1.a.6. With respect to Clause 9 (sub-processors), ‘Option 2: General Written Authorisation’ applies, and the data importer shall specifically inform the data exporter in writing of any intended changes to the Sub-Processor list set forth at Annex III in accordance with Section 8 of this DPA;

1.1.a.7. The optional provision in Clause 11(a) (Redress) of the EU SCCs (Module 2 and Module 3) does not apply;

1.1.a.8. With respect to Clause 13(a) (supervision), the following wording shall apply: where the data exporter is established in an EU Member State, the Supervisory Authority shall be the Supervisory Authority of that EU Member State. Where the data exporter is not established in an EU Member State but has appointed an EU representative pursuant to the GDPR, the Supervisory Authority shall be the Supervisory Authority of the EU Member State in which the EU representative is established. In all other cases, the Supervisory Authority shall be the Supervisory Authority of Ireland;

1.1.a.9. In respect of Clause 17 (governing law), Option 1 shall apply, and the Clauses shall be governed by the laws of Ireland; and

1.1.a.10. In respect of Clause 18 (choice of forum and jurisdiction), the relevant courts shall be the courts of Ireland.

a) Annex I of the EU SCCs shall be completed with the information set out in Schedule 3 of this DPA.

b) Annex II of the EU SCCs shall be completed with the information set out in Schedule 4 of this DPA.

c) Annex III of the EU SCCs shall be completed with the information set out in Schedule 5 of this DPA.

d) Where the Data Protection Laws of Switzerland apply, the governing law, jurisdiction and Supervisory Authority shall be those of Switzerland. In addition, references in the EU SCCs to:

1.1.d.1. the “EU/Member State” shall be construed as references to Switzerland;

1.1.d.2. the GDPR shall refer to the Data Protection Laws of Switzerland; and

1.1.d.3. “supervisory authority” shall refer to the Supervisory Authority of Switzerland.

Schedule 2 – UK Transfers

This Schedule shall apply in addition to Schedule 1 when the Personal Data is (a) subject to the UK GDPR and the DPA 2018 (b); transferred to FriendliAI outside the UK and (c) where no Alternative Adequate Level of Protection applies (the “UK Transfer”).

The Parties hereby agree that the UK Addendum supplements the EU SCCs and shall be construed as set forth below. FriendliAI may terminate the UK Addendum by giving Customer 30 days’ notice and implementing an alternative framework as may be required as provided by the UK GDPR and the DPA 2018. In the event of any conflict between Schedule 1 and this Schedule 2, this Schedule 2 takes precedence.

1.1. The UK Transfer shall be governed by the UK Addendum and the EU SCCs which are hereby incorporated into this DPA and construed as follows.

1.2. References in the UK Addendum and in this Schedule 2 to the data exporter shall be Customer and references to the data importer shall be FriendliAI.

1.3. Table 1 of the UK Addendum shall be completed as follows:

1.1.d.4. The parties’ details shall be the parties set forth in Schedule 3 of this DPA.

1.1.d.5. The Key Contact shall be the contacts set forth in Schedule 3 of this DPA.

1.4. Table 2 of the UK Addendum shall be completed as follows: the Approved EU SCCs referenced in Table 2 shall be the EU SCCs as set forth in Schedule 1 of this DPA.

1.5. Table 3 of the UK Addendum shall be completed as follows: Annexes 1A and 1B shall be as set forth in Schedule 3 of this DPA; Annex II shall be as set forth in Schedule 4 of this DPA; and Annex III shall be as set forth in Schedule 5 of this DPA.

1.6. Table 4 of the UK Addendum shall be completed as follows: FriendliAI may end this Schedule 2 as set out in Section 19 of the EU SCCs.

Schedule 3 - Data Processing Details
(also Annex I to the EU SCCs)

A. LIST OF PARTIES

Customer/Data Exporter details:

Name: The Customer, as identified in the Agreement and this DPA.

Address: The address for Customer as otherwise specified in the Agreement or supporting schedules.

Contact person’s name, position and contact details: The contact details associated with Customer’s account, or as otherwise specified in the Agreement or supporting schedules.

Activities relevant to the data transferred under these Clauses: Receipt of the Services under the Agreement.

Role: Controller or Processor (as applicable)

FriendliAI/Data Importer details:

Name: FriendliAI, as identified in the Agreement and this DPA.

Address: The address for FriendliAI as specified in the Agreement or supporting schedules.

Contact person’s name, position and contact details: The contact details for FriendliAI, as specified in the Agreement or supporting schedules.

Activities relevant to the data transferred under these Clauses: Provision of the Services under the Agreement.

Role: Processor or Sub-Processor (as applicable).

In addition to the information provided elsewhere in this DPA, the Parties wish to document the following information in relation to the Processing activities:

B. DESCRIPTION OF TRANSFER

1. Categories of Data Subjects

The Personal Data Processed concern the employees of Customer, the customers and end users of Customer, and such other Data Subjects as required to provide the Services and such other Data Subjects as applicable to the Services, including any natural persons whose Personal Data is contained within Customer Inputs and Customer Outputs, as well as prompts, completions, embeddings, audio, images, or other content submitted to or returned by the Services.

2. Categories of Personal Data Transferred

The categories of Personal Data involved are: Personal Data that may be contained in Customer Data, Customer Inputs, Customer Materials, Customer Outputs, Customer-Provided Model Checkpoints, as well as any other prompts, completions, embeddings, audio, video, images, files, or other content submitted to or returned by the Services, in each case as determined and controlled by Customer; and such other Personal Data as FriendliAI processes on behalf of Customer to provide the Services.

3. Sensitive Personal Data

The Services are not designed to require the processing of special categories of Personal Data or other Sensitive Personal Data. Customer determines and controls the content it submits to the Services. To the extent that Customer submits Sensitive Personal Data in Customer Inputs, it shall do so only as permitted by the Agreement and the Authorized Use Policy attached as Exhibit 2 to the Agreement, and the restrictions in and safeguards in Annex II apply.

4. Frequency of Transfer

Continuous

5. Nature of the Processing

The Processing operations performed by FriendliAI on behalf of Customer relate to the provision of the Services and the collection, recording, organization, storage, use, and transmission of Personal Data to provide the Services in the Agreement, including for the purpose of completing inference requests, generating model outputs, routing requests/responses, authentication, abuse prevention, security monitoring, debugging, billing reconciliation, capacity planning and legal compliance.

6. Purpose of the Data Transfer and Further Processing

The purpose is the scope of Services provided under the Agreement, which includes, but is not limited to, providing support for generative AI models and other services as set forth in the Agreement.

Processing by Sub-Processors that are listed by reference in Schedule 5 is limited to the provision of services to FriendliAI.

7. Retention Period

The shortest duration between (i) any deletion of the Personal Data from Customer’s account with FriendliAI, and (ii) the end of the contractual relationship between Customer and FriendliAI, subject to Section 3 of the DPA.

8. Duration of Processing

The Processing performed by FriendliAI on behalf of Customer shall be for the term set forth in the Agreement.

C. COMPETENT SUPERVISORY AUTHORITY

As per Schedule 1 and Schedule 2 (as applicable) of this DPA.

Schedule 4 - Security
(also Annex II to EU SCCs)

ANNEX II - TECHNICAL AND ORGANIZATIONAL MEASURES INCLUDING TECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

This Annex forms part of the Clauses.

Description of the Technical and Organizational Security Measures implemented by FriendliAI as the data importer are located at https://trust.friendli.ai/controls.

Schedule 5 - Sub-Processors
(also Annex III to EU SCCs)

FriendliAI has appointed, and Customer authorizes, the Sub-Processors located at https://friendli.ai/subprocessors. This list may change from time to time, and the effective date of such change will be posted on the referenced site.

Schedule 6 – Korean Addendum for
Delegation of Personal Data Processing Services

The applicable customer or partner that is party to the Agreement (“Customer”) and FriendliAI (“FriendliAI”) agree upon the following matters set forth in this Addendum regarding delegation of processing of Personal Data in connection with the (“Agreement”) entered into between Customer and FriendliAI:

Purpose and Scope of Delegation

1. Under Article 26 of the Korean Personal Information Protection Act (“PIPA”) and Article 25 of the Korean Act on Promotion of Information and Communications Network Utilization and Information Protection (“Network Act”), the Customer hereby delegates to FriendliAI, and FriendliAI hereby agrees to provide, the processing of any Personal Data related to the services contemplated in the Terms of Service (“Delegated Services”) insofar as the delegation is related to the original purpose of collecting and using the Personal Data for the Customer’s own business purposes.

2. In the event FriendliAI collects, records, stores, uses, provides, or discloses any Personal Data or otherwise performs any act similar thereto (collectively referred to as “processing”) in the course of performing the Delegated Services, FriendliAI shall not engage in any such activities for any purpose other than to provide the Delegated Services to the Customer and its end-users, which shall include services such as data processing and other limited related services at the direction of the Customer.

Customer’s Obligations

3. The Customer agrees and warrants:

a. that the processing, including the transfer itself, of Personal Data has been and will continue to be carried out in accordance with the relevant provisions of the applicable laws;

b. that it has instructed, and throughout the duration of the Personal Data processing services will instruct, FriendliAI to process the Personal Data transferred only on the Customer’s behalf and in accordance with the applicable laws;

c. that after assessment of the requirements of the applicable Data Protection Law, the security measures are appropriate to protect the Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure, or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation; and

d. that it will ensure compliance with the security measures.

FriendliAI’s Obligations

4. FriendliAI agrees and warrants:

a. To process the Personal Data only on behalf of the Customer and in compliance with its instructions and this Addendum; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the Customer of its inability to comply.

b. That it has no reason to believe that any of the applicable laws prevents it from fulfilling the instructions received from the Customer and its obligations under the Agreement and that in the event of a change in the law which is likely to have a substantial adverse effect on the warranties and obligations provided by this Addendum, it will promptly notify the change to the Customer as soon as it is aware; and

c. To observe all applicable Korean privacy laws and regulations, including the PIPA, Network Act and subordinate legislations and notifications thereunder.

Sub-Processing

5. The Customer hereby expressly consents to FriendliAI subcontracting the processing of the Personal Data in connection with the Delegated Services to the third parties listed in Schedule 5 attached hereto.

6. FriendliAI shall not subcontract any of its processing operations performed on behalf of the Customer under the Addendum without the prior written consent of the Customer. Where FriendliAI subcontracts its obligations under the Addendum, with the consent of the Customer, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub-processor as are imposed on FriendliAI under the Addendum. Where the sub-processor fails to fulfil its data protection obligations under such written agreement FriendliAI shall remain fully liable to the Customer for the performance of the sub-processor’s obligations under such agreement.

Training and Monitoring

7. The Customer may educate FriendliAI so that Personal Data of Data Subjects may not be lost, stolen, leaked, forged, altered, or damaged because of the delegation of personal information. The Customer may also supervise FriendliAI’s processing of Personal Data by inspecting the status of processing, as prescribed by the PIPA and the Network Act.

Liability

8. In the event that FriendliAI violates any obligation regarding the processing of the Personal Data under any of the above provisions and the Customer incurs damage as a result thereof, FriendliAI shall be liable to compensate for such damages.

9. Notwithstanding Article 8 and any other provisions of the Agreement, the DPA or this Addendum, to the extent permitted by applicable law, (i) FriendliAI shall be liable only in the case of fraud, wilful misconduct, or gross negligence, and (ii) FriendliAI shall be liable only for ordinary damages and shall not be liable for any special, punitive, indirect or consequential damages.

10. Any liability under Sections 8 and 9 of this Addendum shall be subject to the limitation of liability in the Agreement.

Last Modified: September 21, 2026

To see previous version of this Data Processing Agreement:

Explore FriendliAI today

Get startedTalk to an engineer