Data Processing Addendum

This Data Processing Addendum (“Addendum”) governs the processing of personal data that the Operator of Betty carries out on behalf of the customer. It forms part of the Terms of Service and is incorporated into them by reference: it applies to every customer that processes personal data in its workspace, without a separate signature. A customer that needs a signed copy may request one from the privacy address shown in the identification of the Operator at the top of this document.

1. Parties and subject matter

1.1. The parties to this Addendum are the customer (“the Controller”) and the Operator identified at the top of this document (“the Processor”).

1.2. The subject matter is the processing of personal data contained in the records that the Controller and its authorised users store in their workspace in the Betty CRM (“the Data”).

1.3. This Addendum is entered into in order to comply with Article 28 of Regulation (EU) 2016/679 (GDPR) and the equivalent processor obligations under the UK GDPR, the California CCPA as amended by the CPRA and the other applicable US state privacy laws, Colombia’s Ley 1581 de 2012 and Decreto 1377 de 2013, Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties, Brazil’s Lei 13.709 (LGPD), Argentina’s Ley 25.326, Chile’s Ley 19.628 and Ley 21.719, and Peru’s Ley 29733 with its regulation.

1.4. Precedence. In the event of conflict between this Addendum and the Terms of Service regarding the processing of personal data, this Addendum prevails. The standard contractual clauses applicable under clause 13 prevail over this Addendum in what they govern.

2. Roles of the parties

2.1. In respect of the Data, the Controller determines the purposes and means of processing, and the Processor processes it only on behalf of and following the instructions of the Controller.

2.2. The Controller warrants that it has a valid legal basis for the processing, that it has informed data subjects where required, and that its instructions do not infringe applicable law.

2.3. In respect of user account data, the technical logs of the infrastructure, and the data from the access request form, the Processor acts as controller in its own right, on the terms of the Privacy Policy. That data falls outside the subject matter of this Addendum.

2.4. In CCPA terminology, the Processor acts as the Controller’s service provider and, where the applicable state law uses that category, as a processor.

3. Description of the processing

The subject matter, duration, nature, purpose, types of data, and categories of data subjects are set out in Annex I. The Controller may extend or restrict that description by written instruction, within the functional possibilities of the service.

4. The Controller’s instructions

4.1. The Processor processes the Data only in accordance with the Controller’s documented instructions. The following constitute documented instructions: this Addendum and the Terms of Service; the configuration the Controller applies in the service; the support requests it submits; the OAuth authorisation it grants to an artificial intelligence client to access its workspace through the MCP connector; and any other instruction sent to the privacy address.

4.2. The Processor does not process the Data for its own purposes. In particular, it does not use it to train its own or third-party artificial intelligence models, does not use it for advertising, does not sell it, does not transfer it to third parties for their own use, does not combine it with data of other controllers, and does not retain it beyond what clause 14 provides.

4.3. If the Processor considers that an instruction infringes applicable data protection law, it will inform the Controller without delay and may suspend its execution until the Controller confirms, amends, or withdraws it.

4.4. If Union or Member State law requires the Processor to carry out processing beyond the instructions, it will inform the Controller before doing so, unless that law prohibits it on important grounds of public interest.

5. Confidentiality of personnel

5.1. The Processor ensures that the persons authorised to process the Data are bound by a contractual or statutory duty of confidentiality that survives the end of their engagement.

5.2. Access by the Processor’s personnel to the Data is limited to those who need it to provide the service, granted on a least-privilege basis, and revoked when the need or the engagement ends. Administrative access is logged.

5.3. Personnel receive data protection and information security training appropriate to their duties.

6. Security of processing

6.1. The Processor applies the technical and organisational measures described in Annex II, appropriate to the risk under Article 32 GDPR.

6.2. The Processor may update those measures provided the level of security is not reduced. If an update substantially reduces a measure, it will notify the Controller thirty (30) calendar days in advance.

6.3. The Controller is responsible for the security configuration under its control: the roles and permissions it assigns, the management of its authorised users, the strength of credentials, and the scope of the OAuth authorisations it grants.

7. Subprocessors

7.1. General authorisation. The Controller gives the Processor general authorisation to use the subprocessors listed in Annex III and to engage new subprocessors in accordance with this clause.

7.2. Obligations imposed. The Processor enters into a written contract with each subprocessor imposing data protection obligations equivalent to those in this Addendum, in particular sufficient guarantees of security, and remains answerable to the Controller for a subprocessor’s breach as if it were its own.

7.3. Notice of changes and objection. The Processor will notify the Controller of the addition or replacement of a subprocessor at least thirty (30) calendar days in advance, by email to the account address. Within that period the Controller may object on reasonable grounds relating to data protection. If it objects, the parties will seek an alternative solution in good faith; if none is found within thirty (30) calendar days, the Controller may terminate the service free of charge and without penalty, with the right to export the Data under clause 14.

7.4. The Controller’s artificial intelligence providers. OpenAI, Anthropic, and any other artificial intelligence provider from whose environment the Controller uses Betty are not subprocessors of the Processor. They are providers engaged by the Controller itself, under their own terms. The Processor does not send them Data on its own initiative: it delivers Data to the authorised artificial intelligence client when the Controller or an authorised user submits a query through an active OAuth connection, which constitutes a documented instruction under clause 4.1. The Controller is responsible for the lawfulness of that disclosure under the rules applicable to it, including, where relevant, the international transfer mechanism in its relationship with that provider.

8. Assistance with data subject rights

8.1. The service allows the Controller to access, rectify, delete, restrict, and export the Data directly, without the Processor’s involvement.

8.2. Where the Controller cannot satisfy a request using those features, the Processor will give it reasonable assistance, on written request and at no additional charge during the term of the agreement.

8.3. If a data subject sends the Processor a request concerning the Data, the Processor will not deal with it itself: it will inform the data subject that they must approach the Controller, and will pass the request to the Controller without undue delay, with the contact details the data subject has provided.

9. Assistance with impact assessments

On the Controller’s written request, the Processor will provide the information about the processing, the infrastructure, and the security measures that is in its possession and necessary for the Controller to carry out a data protection impact assessment or a prior consultation with the supervisory authority, under Articles 35 and 36 GDPR and the equivalent mechanisms of the other applicable rules, including the impact assessment under the Peruvian regulation.

10. Personal data breaches

10.1. The Processor will notify the Controller of any security breach affecting the Data without undue delay and in any event within forty-eight (48) hours of becoming aware of it. The forty-eight-hour period is adopted so that the Controller can meet the seventy-two-hour deadline in Article 33 GDPR and the specific deadlines of its own country.

10.2. The notification will include, with the information available at the time: the nature of the breach; the categories and approximate number of data subjects and records affected; the likely consequences; the measures taken or proposed to address it and mitigate its effects; and a point of contact. Where not all the information is available, it will be provided in phases without undue delay.

10.3. The Processor will document breaches, cooperate with the Controller in the investigation and in communications to authorities or data subjects, and will not notify third parties of a breach affecting the Data on the Controller’s behalf without its instruction, unless required by law.

10.4. The Processor is not required to notify unsuccessful attack attempts that the security measures have blocked.

11. Audit and information

11.1. The Processor will make available to the Controller, on written request, the information necessary to demonstrate compliance with this Addendum: the description of the measures in Annex II, the up-to-date list of subprocessors, and, where they exist, the audit reports or certifications that the infrastructure subprocessors publish.

11.2. If that information is insufficient, the Controller may carry out an audit, itself or through an independent auditor that is not a competitor of the Processor and is bound by a duty of confidentiality, on thirty (30) calendar days’ notice, once per calendar year, during business hours, and without interrupting the service or accessing other customers’ data. Additional audits are available where a supervisory authority requires one or following a security breach that has affected the Data.

11.3. Each party bears its own audit costs. The Processor may charge the reasonable cost of its personnel’s time for additional audits that do not arise from its own breach.

12. Processing under United States law

12.1. In respect of personal information subject to the CCPA, the Processor processes the Data only for the business purposes set out in this Addendum and the Terms of Service.

12.2. The Processor does not sell the Data and does not share it for cross-context behavioural advertising; it does not retain, use, or disclose it for purposes other than providing the service, including any commercial purpose of its own; it does not combine it with personal information received from other sources, except where the CCPA itself permits a service provider to do so; and it complies with the level of protection the law requires.

12.3. The Processor will notify the Controller without undue delay if it determines that it can no longer meet these obligations, and the Controller may take reasonable steps to stop and remediate unauthorised use, including terminating the service.

12.4. The Processor imposes these same obligations on its subprocessors and gives the Controller the reasonable assistance it needs to respond to consumer requests and to carry out the risk assessments and cybersecurity audits required of it by the CCPA regulations.

13. International transfers

13.1. Location. The Data is processed in the Amazon Web Services Europe (Ireland) region, eu-west-1. The Processor does not move the Data outside the European Economic Area in order to provide the service.

13.2. European Economic Area and United Kingdom. Where a subprocessor must access the Data from a third country, the transfer relies on the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914, modules 2 or 3 as applicable, and on the International Data Transfer Addendum issued by the Information Commissioner’s Office under section 119A(1) of the Data Protection Act 2018 for transfers subject to the UK GDPR. Where an adequacy decision covers the transfer, that decision prevails. Annex III states the mechanism applicable to each subprocessor.

13.3. Where the standard contractual clauses of Decision (EU) 2021/914 apply between the Controller and the Processor, they are incorporated into this Addendum with the following content: Annex I to this Addendum completes Annex I to those clauses; Annex II to this Addendum completes their Annex II; Annex III to this Addendum completes their Annex III; the general subprocessor authorisation in clause 7 corresponds to Option 2 of their clause 9(a) with the thirty-day notice period; and the governing law and forum are those set out in the Terms of Service to the extent those clauses permit.

13.4. Latin America. The parties follow the mechanisms described in section 12.5 of the Privacy Policy. In particular, this Addendum fulfils the function of the transmission contract under Article 25 of Colombia’s Decreto 1377 de 2013 and documents the remittance of data to a processor provided for in Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties. For Brazil, the adequacy decision in Resolution CD/ANPD No. 32 of 26 January 2026 applies; if it ceases to be in force, the parties will incorporate the standard clauses annexed to Resolution CD/ANPD No. 19/2024. For Argentina, the recognition of adequate legislation in Article 3 of Disposición 60-E/2016, as replaced by Resolución AAIP 34/2019, applies; failing that, the parties will execute the model clauses for the provision of processing services set out in that Disposición. For Peru, the Controller registers the cross-border flow with the authority under Article 21 of the regulation approved by Decreto Supremo 016-2024-JUS.

14. Return and deletion of the Data

14.1. During the term of the agreement, the Controller may export the Data in a structured, commonly used format, by itself and at any time.

14.2. After termination, the Controller retains that ability for thirty (30) calendar days. If access is suspended, the Processor will enable the export on the Controller’s request within that period.

14.3. After that period, the Processor deletes the Data from active systems. Backups containing it are overwritten in the ordinary retention cycle, which does not exceed ninety (90) calendar days from termination.

14.4. The Processor may retain the Data, or part of it, where Union or Member State law requires. In that case retention is limited to that purpose and that period, with the security measures in Annex II and without any other processing.

14.5. On the Controller’s written request received within thirty days of termination, the Processor will certify the deletion in writing.

15. Liability

15.1. The parties’ liability under this Addendum is governed by clause 16 of the Terms of Service, subject to clause 16.3 of those Terms: the limits do not apply to liability for damage arising from breach of the GDPR or of equivalent applicable data protection law, nor to what the applicable standard contractual clauses provide about liability towards data subjects.

15.2. Each party is liable to data subjects and to authorities to the extent attributable to it under Article 82 GDPR and equivalent rules.

16. Term

This Addendum takes effect on the date shown at the top of this document or, if later, on the date the Controller begins using the service, and remains in force for as long as the Processor processes Data on the Controller’s behalf. Clauses 5, 10, 14, and 15 survive termination to the extent applicable. The Processor may amend this Addendum under clause 19 of the Terms of Service; if an amendment reduces the Controller’s safeguards, the Controller may terminate the service free of charge before it takes effect.

Annex I. Description of the processing

A. Parties

Exporter / Controller: the customer using the Betty CRM, identified by the holder and email address of its account and by its workspace. Role: controller.

Importer / Processor: the Operator identified at the top of this document. Role: processor. Contact details for data protection matters: the privacy address shown in that identification.

B. Description of the processing

C. Competent supervisory authority

Where the Controller is established in the European Economic Area, the authority competent in respect of the standard contractual clauses is that of the Member State of its establishment. Where it is not so established but is subject to the GDPR under Article 3(2), the authority of the Member State where its representative is located or, failing that, of the Member State where the data subjects are located. For transfers subject to the UK GDPR, the Information Commissioner’s Office.

Annex II. Technical and organisational measures

The measures in this Annex are obligations the Processor assumes and maintains for the term of this Addendum, within the meaning of Article 32 GDPR. The Processor updates them in accordance with clause 6.2.

1. Encryption

Encryption in transit using TLS on all external connections, with forced redirection to HTTPS. Encryption at rest of the PostgreSQL database and of file storage using the infrastructure provider’s managed keys. Passwords are stored using a cryptographic hash function resistant to brute-force attacks; they are not stored in the clear and are not recoverable.

2. Access control

Individual authentication for each user. Role-based permissions within each workspace, defined by the Controller. Logical isolation of data by workspace, so that a query reaches only the workspace to which the session belongs. Access by the Processor’s personnel to the infrastructure is granted on a need basis and with least privilege, with individual credentials and a second factor, and is reviewed at least annually and when the need or the engagement ends.

3. MCP connector

Access from an artificial intelligence client requires an OAuth authorisation granted by the Controller, with explicit scope, revocable at any time from the account. Without that authorisation no access channel exists.

4. Pseudonymisation and minimisation

The Processor does not need the Data for its own purposes and does not extract it from the infrastructure. Technical logs do not reproduce the content of CRM records. Error messages and service traces are constructed so as not to incorporate the Controller’s personal data.

5. Network and systems security

Deployment in managed containers, with security groups limiting traffic to the necessary ports and origins. The database and the cache are not reachable from the public network. Dependencies are updated and security patches applied according to their criticality.

6. Logging and monitoring

Centralised logging of application and infrastructure activity, with the content and retention periods set out in section 7 of the Privacy Policy. Logging of administrative access. Monitoring of service availability and errors. Telemetry, product analytics, and third-party error reporting are disabled.

7. Continuity and recovery

Automated database backups, encrypted and retained in accordance with the cycle in clause 14.3, with periodic restore testing. All infrastructure stays in the Ireland region. The Controller may also export its Data at any time under clause 14.1.

8. Incident management

A procedure for detecting, classifying, containing, eradicating, and recovering from security incidents, with a record of the facts and decisions and with the notification periods in clause 10.

9. Organisation

A duty of confidentiality on personnel surviving the end of their engagement. Data protection and security training appropriate to their duties. Assessment of subprocessors before engagement and a written contract with obligations equivalent to those in this Addendum.

10. Secure deletion

Deletion of the Data from active systems and overwriting of backups within the periods in clause 14. Physical media are managed and destroyed by the infrastructure provider under its own certified controls.

Annex III. Subprocessors

The list in force on the effective date of this Addendum. Additions and replacements are notified under clause 7.3.

The Controller’s artificial intelligence providers, such as OpenAI and Anthropic, are not subprocessors of the Processor, as set out in clause 7.4.