Data Processing Addendum (DPA)

Last updated: 28.12.2025 Preamble & Incorporation This Data Processing Addendum, including its annexes and the Standard Contractual Clauses (“DPA”), is made by and between Molin AI (“Molin AI”), and Customer, pursuant to the Subscription Agreement, the Molin AI Terms of Service or other written or electronic agreement between the parties, as applicable (collectively referred to as the “Agreement”). This DPA is incorporated into the Agreement and governs Molin AI’s processing of Customer Personal Data under Applicable Data Protection Legislation. The purpose of this DPA is to ensure that the processing of Personal Data is undertaken in full compliance with all applicable laws, regulations, and with appropriate regard for the rights and freedoms of data subjects whose Personal Data is processed. 1. Definitions Any capitalized term used but not defined in this DPA has the meaning provided to it in the Agreement. “Account Data” means Personal Data that relates to Customer’s relationship with Molin AI, including to access Customer’s account and billing information, identity verification, maintain or improve performance of the Services, provide support, investigate and prevent system abuse, or fulfill legal obligations. “Affiliate” means any entity that controls, is controlled by, or is under common control with a party, where “control” means ownership of or the right to control 50% or more of the voting securities or equivalent ownership interest. “Aggregated Data” means information that relates to a group or category of data and from which individual identities and characteristics have been removed. “Applicable Data Protection Legislation” means all laws and regulations governing the Processing of Personal Data that apply to the parties, including Regulation (EU) 2016/679 (GDPR); in respect of the UK, the GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom’s European Union (Withdrawal) Act 2019 (“UK GDPR”) and the Data Protection Act 2018 (together, “UK Data Protection Laws”; the Swiss Federal Act on Data Protection (FADP); U.S. federal and state privacy laws (including the California Consumer Privacy Act (CCPA) as amended by the CPRA, and analogous state privacy laws in force from time to time); and the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs); in each case, as amended, replaced or superseded from time to time. “CCPA” or “CCPA and CPRA” means the California Consumer Privacy Act of 2018 and any binding regulations promulgated thereunder, in each case, as may be amended from time to time. This includes but it is not limited to the California Privacy Rights Act of 2020. “Controller” or “controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data. It shall have the same meaning ascribed to “controller” under the GDPR and other equivalent terms under Applicable Data Protection Legislation (e.g., ”Business” as defined under the CCPA), as applicable. “Customer Data” means any data, content or other information of any type that is submitted to the Services by or on behalf of Customer, including without limitation: (a) data, content or other information submitted, uploaded, instructed to be used for or imported to the Services by Customer (including from Third Party Platforms) and (b) data, content or other information provided by or about People (including chat and message logs) that are collected from the Customer Properties using the Services. “Customer Personal Data” means Personal Data contained within Customer Data that Molin AI processes as a Processor on behalf of Customer. “Data Privacy Framework” or “DPF” means, as applicable, the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and/or the Swiss-U.S. Data Privacy Framework. “Anonymized Data” means data that has been processed to remove personal identifiers and cannot reasonably be used to identify an individual, whether directly or indirectly, in compliance with Applicable Data Protection Legislation. “Europe” means for the purposes of this DPA the European Economic Area (“EEA”), the United Kingdom (“UK”) and Switzerland, or another country which ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of Personal Data, as determined by the European Commission in the case that EU Data Protection Law applies (e.g. Andorra, Faroe Islands, Guernsey, Isle of Man, Jersey) respectively as determined by the ICO in the case that UK Data Protection Law applies. “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). “Personal Data” or “personal data” or “personal information” means any information relating to an identified or identifiable natural person (“data subject”) an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person or as defined in and subject to Applicable Data Protection Legislation. “Privacy Policy” means Molin AI’s publicly available privacy policy describing how Molin AI processes personal data. For clarity, the Privacy Policy is not part of this DPA and does not govern Molin AI’s processing of Customer Personal Data as Processor under this DPA. “Processing” or “processing” (and “Process” or “process”) means any operation or set of operations performed upon Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. “Restricted Transfer” means: (i) where the GDPR applies, a transfer of personal data from the EEA to a country outside of the EEA which is not subject to an adequacy decision by the European Commission; (ii) where the UK GDPR applies, a transfer of personal data from the UK to any other country which is not based on adequacy regulations pursuant to UK Data Protection Laws; and (iii) where the Swiss FADP applies, a transfer of personal data to a country outside of Switzerland which is not included on the list of adequate jurisdictions. “Security Breach” means a breach of security leading to any accidental, unauthorized or unlawful loss, disclosure, destruction, alteration, unauthorized disclosure of, or access to Customer Personal Data transmitted, stored or otherwise processed by Molin AI. For clarity, unsuccessful events that do not compromise Customer Personal Data (e.g., pings, port scans, unsuccessful log-on attempts, or denial-of-service attacks without data access) are not Security Breaches. “Standard Contractual Clauses” or “SCCs” means, as applicable: (i) the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 for transfers of personal data to third countries under the GDPR (“EU SCCs”); (ii) the International Data Transfer Addendum issued by the UK Information Commissioner (“UK Addendum”), which amends the EU SCCs for transfers subject to the UK GDPR (“UK SCCs”); and (iii) any Swiss-specific adaptations recognized by the Swiss Federal Data Protection and Information Commissioner for transfers subject to the FADP; in each case, as updated, amended or superseded from time to time. “Sub-processor” or “sub-processor” means any third party (excluding Molin AI’s employees and individual contractors) engaged by Molin AI to process Customer Personal Data on behalf of Molin AI in connection with the Services. “Sub-processor Page” means Molin AI’s web page listing current Sub-processors for the Services (https://docs.molin.ai/legal/subprocessors), as updated from time to time. “Technical and Organizational Measures” or “TOMs” means the security measures described in Schedule 2 (Technical and Organizational Measures), as updated from time to time without material degradation of overall protection. “Third Party Request” means any request, correspondence, inquiry, or complaint from a data subject, regulatory authority, or third party. “UK Addendum” means the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner’s Office. This is found in Schedule 4 below. 2. Applicability and Scope 2.1. Applicability. This DPA applies to Molin AI’s processing, on Customer’s behalf, of Personal Data subject to Applicable Data Protection Legislation. 2.2. Duration. This DPA remains in force for the Agreement term and until return/deletion of Customer Personal Data as per this DPA. 2.3. Molin AI as a Processor. To the extent Molin AI processes Customer Personal Data on behalf of Customer in connection with the Services, Molin AI acts as Processor and Customer acts as Controller. If Customer processes such personal data on behalf of a third-party controller, Customer warrants that it is authorized by such controller to appoint Molin AI as sub-processor and to issue all instructions to Molin AI on the controller’s behalf. Molin AI will process Customer Personal Data solely in accordance with Customer’s documented instructions, as set out in this DPA, and any other instructions that are lawful and mutually agreed in writing. 2.iv. Molin AI as a Controller of Account Data. With respect to Account Data - including administrative, billing, authentication, security, and audit-log information relating to Customer’s users - Customer acts as Controller of the personal data it provides to Molin AI, and Molin AI acts as an independent Controller for its own subsequent processing of that data. The parties acknowledge that such processing is separate from Molin AI’s role as Processor of Customer Personal Data, and that the parties do not act as joint controllers for any processing under this DPA. Molin AI processes Account Data as a controller (a) in order to manage the relationship with Customer; (b) carry out Molin AI’s business operations; (c) in order to detect, prevent, or investigate abuse or misuse of the Services; (d) identity verification; (e) to comply with Molin AI’s legal or regulatory obligations; and (f) as otherwise permitted under Applicable Data Protection Legislation and in accordance with this DPA, the Agreement, and the Privacy Policy. Processing activities Molin performs as an independent Controller—including Account Data, analytics, security operations, and Molin Account data—are governed by the Privacy Policy. For clarity, Molin Account data is not Account Data and neither Customer Personal Data and is excluded from Processor obligations under this DPA. 3. Molin AI as a Processor – Processing Customer Personal Data The Customer, in connection with its use of the Services, retains sole responsibility for determining what data – including Customer Personal Data – is collected from its end users and for deciding how any information processed through the Services is utilized. Customer Instructions. Customer appoints Molin AI as a processor to process Customer Personal Data on behalf of, and in accordance with (a) Customer’s instructions as set forth in the Agreement, this DPA, and as otherwise necessary to provide the Services to Customer (including security/abuse prevention); (b) as required by law, including Applicable Data Protection Legislation, in such a case, Molin AI shall inform Customer of that legal requirement before processing, unless the law prohibits such notification on important grounds of public interest; and (c) as otherwise agreed in writing (collectively, the “Permitted Purposes”). Customer will ensure that its instructions comply with Applicable Data Protection Legislation. Customer acknowledges that Molin AI is neither responsible for determining which laws are applicable to Customer’s business nor whether Molin AI’s Services meet or will meet the requirements of such laws. Customer will ensure that Molin AI’s processing of Customer Personal Data, when done in accordance with Customer’s instructions, will not cause Molin AI to violate any applicable law, including Applicable Data Protection Legislation. 4. Purpose Limitation Molin AI processes Customer Personal Data in order to provide the Services and in accordance with the Agreement. Schedule 1 (Details of Processing) of this DPA further specifies the nature and purpose of the processing, the processing activities, the duration of the processing, the types of Personal Data and categories of data subjects. 5. Compliance Customer shall be responsible for ensuring that: a) all such notices have been given, and all such authorizations have been obtained, as required under Applicable Data Protection Legislation, for Molin AI to process Customer Personal Data as contemplated by the Agreement and this DPA; b) it has complied, and will continue to comply, with all applicable laws relating to privacy and data protection, including Applicable Data Protection Legislation; and c) it has, and will continue to have, the right to transfer, or provide access to, Customer Personal Data to Molin AI for processing in accordance with the terms of the Agreement and this DPA. 6. Confidentiality 6.1. Confidentiality Obligations of Molin AI Personnel. Molin AI will ensure that any person that it authorizes to process Customer Personal Data (including its employees, agents, and subcontractors) shall be subject to a duty of confidentiality (whether in accordance with Molin AI’s confidentiality obligations in the Agreement or a statutory duty). Molin AI shall ensure that access to Customer Personal Data is limited to personnel who require such access for the performance of the Agreement or to comply with Applicable Data Protection Legislation. 6.2. Responding to Third Party Requests. If Molin AI receives a request from a data subject relating to Customer Personal Data, Molin AI shall promptly notify Customer and shall not respond to the request except on Customer’s documented instructions or as required by Applicable Data Protection Legislation. Molin AI shall provide reasonable assistance to Customer, at Customer’s cost, to enable Customer to respond to such requests in accordance with Applicable Data Protection Legislation. Molin AI shall promptly notify Customer of any legally binding request from a public authority (including supervisory authorities, law-enforcement bodies, or courts) for disclosure of Customer Personal Data, to the extent permitted by Applicable Data Protection Legislation. Molin AI shall not disclose Customer Personal Data in response to such a request unless required to do so by Applicable Data Protection Legislation. Where permitted and practicable, Molin AI shall provide reasonable assistance to Customer in responding to or limiting the scope of the request. Molin AI shall ensure that its agreements with Sub-processors impose materially equivalent obligations. Molin AI shall notify Customer of any such requests received by a Sub-processor to the extent Molin AI is informed by the Sub-processor and permitted by law. 7. Sub-processors 7.1. Authorization for Sub-processing. Customer agrees that (a) Molin AI may engage sub-processors as listed at the Sub-processor Page (which may be updated from time to time) and Sub- processors respectively may engage third party processors to process Customer Personal Data on Molin AI’s behalf. Customer provides a general authorization for Molin AI to engage onward sub-processors that is conditioned on the following requirements: (a) Molin AI will restrict the onward sub-processor’s access to Customer Personal Data only to what is necessary and proportionate to provide the Services and in accordance with the Agreement. (b) Molin AI agrees to impose contractual data protection obligations, including appropriate technical and organizational measures to protect personal data, on any sub-processor it appoints that required by Applicable Data Protection Legislation; and (c) Molin AI remains responsible for the performance of each Sub-processor’s obligations and will be liable to the same extent Molin AI would be liable if performing the Services directly. 7.2. Current Sub-processors and Notification of Sub-processor Additions. a. Customer understands that effective operation of the Services may require the transfer of Customer Personal Data to Molin AI’s Sub-processors, see Schedule 3. Customer hereby authorizes the transfer of Customer Personal Data to locations outside Europe (Molin AI’s primary processing facilities are in the US, EU and UK), including to Sub-processors, subject to continued compliance with this DPA throughout the duration of the Agreement. Customer hereby provides general authorization to Molin AI engaging additional third-party Sub-processors to process Customer Personal Data in accordance with the Agreement. b. Molin AI may, by giving reasonable notice to the Customer, add or replace Sub-processors to the Sub-processor Page. Molin AI will notify Customer if it intends to add or replace Sub-processors from the Sub-Processor Page at least 30 days prior to any such changes. To receive such notification, Customers can send an email to dataprotection@molin.ai to join Molin AI’s distribution list. If Customer reasonably objects to the appointment of a new Sub-processor within 15 days of receiving such notice, on reasonable grounds relating to the protection of the Customer Personal Data, then Molin AI will work in good faith with Customer to find an alternative solution. An objection is considered reasonable only if the Customer demonstrates that the proposed Sub-processor is unable to meet materially equivalent data protection obligations to those required under this DPA. Commercial preferences or general objections to cloud sub-processing do not constitute reasonable grounds. In the event that the parties are unable to reach a mutually acceptable resolution regarding the appointment of a new Sub-processor within a reasonable time after Customer’s objection, either party may initiate dispute resolution proceedings in accordance with the terms set forth in the Agreement. 8. Impact Assessments and Consultations Molin AI shall, to the extent required by Applicable Data Protection Legislation, provide Customer with reasonable assistance (at Customer’s cost and expense) with data protection impact assessments or prior consultations with data protection authorities that Customer is required to carry out under such legislation. AI-Related Assistance. To the extent the Customer uses the Services for processing involving artificial intelligence or automated decision-making, Molin shall, upon request, provide Customer with information about the architecture, safety measures, data-handling practices and model-provider dependencies of the relevant AI features, to the extent such information is reasonably required for Customer’s AI-related impact assessments (including DPIAs) or compliance with the EU AI Act or equivalent legislation. This clause does not require Molin to disclose trade secrets, security-sensitive information or proprietary model weights. 9. Security 9.1. Molin AI has in place and will maintain throughout the term of the Agreement appropriate technical and organizational measures designed to protect Customer Personal Data against Security Breaches. 9.2. These measures shall at a minimum comply with Applicable Data Protection Legislation and include the measures identified in Schedule 2 (Technical and Organizational Security Measures). For clarity, such measures include multi-factor authentication, encryption in transit and at rest, role-based access control, periodic access reviews, security logging, vulnerability management, and regular penetration testing. 9.3. Customer acknowledges that the security measures implemented by Molin AI are subject to ongoing technological advancements and developments. Molin AI reserves the right to update or modify such security measures from time to time, provided that any such changes do not result in a reduction of the overall security level of the Services. 9.4. Upon becoming aware of a Security Breach affecting Customer Personal Data, Molin AI shall notify Customer without undue delay. Such notification shall include the information reasonably available to Molin AI at the time, and Molin AI shall provide additional details as they become available. The notification will describe, where known: (i) the nature of the Security Breach, including the categories and approximate number of data subjects and data records concerned; (ii) the likely consequences of the Security Breach; and (iiii) the measures taken or proposed to address the Security Breach, including measures to mitigate possible adverse effects. Molin AI shall provide Customer with reasonable assistance to enable Customer to meet its obligations under Applicable Data Protection Legislation. Nothing in this DPA prevents Molin AI from complying with its own legal obligations to notify authorities or individuals. 9.5. Customer acknowledges and agrees that it bears sole responsibility for its use of the Service, including but not limited to: (a) implementing and maintaining appropriate security measures and controls proportionate to the risks associated with the processing of Customer Personal Data; (b) safeguarding all authentication credentials, devices, and systems used to access the Service against unauthorized access; and (c) regularly performing backups and ensuring the integrity and availability of Customer Personal Data. 9.6. Operational Human Access. Customer acknowledges that the Services may enable manual review of Customer Personal Data by Customer personnel (for example, reviewing email drafts or taking over live chats). Such review is carried out solely by Customer. Molin may permit limited human access to Customer Personal Data solely where necessary to: (i) provide support requested by Customer, (ii) maintain, secure, or improve the Services, (iii) detect or address service errors, incidents, misuse, or abuse, or (iv) comply with legal obligations. All such access is restricted to authorized personnel, logged, and subject to confidentiality and security controls. 10. Return or Deletion of Customer Personal Data Return or Deletion of Data. Upon termination or expiry of the Agreement, Molin AI will (at Customer’s election) delete or return to Customer all Customer Personal Data (including copies) in its possession or control. Upon written request prior to deletion, Molin AI shall return Customer Personal Data in a commonly used format. (a) Deletion on request. Customer may instruct Molin AI to delete all Customer Personal Data, and Molin AI will do so without undue delay and in any event within 60 days of Customer’s written request. (b) Automatic deletion. If Customer does not request deletion or return, Molin AI will automatically delete Customer Personal Data from active systems within 90 days after termination or expiry of this DPA. (c) Backups. Customer Personal Data contained in backup systems will be overwritten in the ordinary course of backup rotation and deleted within 30–45 days thereafter (and in any case no later than 90 days), and will be isolated, encrypted, and not used for any purpose other than disaster recovery during that period. If a backup is restored, Molin AI will re-apply deletion to the restored copy without undue delay in line with this Section. (d) Legal hold. The foregoing does not apply to the extent Molin AI is required by Applicable Data Protection Legislation or other law to retain some or all Customer Personal Data; in such cases Molin AI will securely isolate the data and protect it from processing except as required by law, and will delete it promptly once the basis for retention ends. 11. Audits 11.1. The parties acknowledge that, when Molin AI processes Personal Data on the Customer’s behalf, the Customer must have the ability to verify Molin AI’s compliance with this DPA and with the Applicable Data Protection Legislation. 11.2. Documentation review. Upon written request, Molin AI will provide the Customer and/or its appropriately qualified third-party representative (the “Auditor”) with reasonable access—at no additional charge—to documentation that demonstrates Molin AI’s compliance with this DPA and with its obligations under Applicable Data Protection Legislation. 11.3. Audit rights. The parties intend to rely primarily on Molin AI’s documentation, representations, and third-party audit reports to demonstrate Molin AI’s compliance with this DPA. If the Customer reasonably requires a further audit, Molin AI will permit the Customer or its Auditor to carry out such audit of Molin AI’s processing of Customer Personal Data, at the Customer’s cost (including Molin AI’s reasonable costs), subject to the following terms: (a) Planning. The parties will agree in advance on the audit’s start date, scope, and duration. (b) Frequency. Audits may occur no more than once per calendar year, unless otherwise required by law or a competent authority. (c) Scope and conduct. Audits must be conducted during normal business hours, in a manner that avoids disruption to Molin AI’s operations, and will be limited to data and systems relevant to the Customer. (d) Confidentiality and security. All audits are subject to Molin AI’s security and confidentiality requirements and rules. Molin AI shall make available relevant information reasonably necessary to demonstrate compliance with this DPA. Access to internal systems, logs, or personnel shall be limited to what is strictly required, and subject to confidentiality and security restrictions. (e) Auditor qualification. Molin AI may reasonably object to an Auditor who is not suitably qualified, is a direct competitor, or whose participation could compromise confidentiality or security. In such case, the Customer must appoint a different Auditor or perform the audit itself. (f) Cost responsibility. The Customer will bear its own audit costs and those of any Auditor it appoints, as well as Molin AI’s reasonable expenses incurred in supporting the audit unless: (i) Customer has reasonable grounds to suspect non-compliance and the audit confirms it; or ii) audit is conducted due to a Security Breach affecting Customer Personal Data for which Molin AI or a Sub-processor is responsible. (g) SCC alignment. The audit rights under the Standard Contractual Clauses will be exercised in accordance with this Section 11 (Audits). 11.4. Independent reviews. Molin AI engages qualified external auditors to assess and verify the adequacy of its security and compliance controls related to the processing of Customer Personal Data. Information about Molin AI’s current audit reports, certifications, and related compliance standards is available on Molin AI’s website. 12. Transfer Mechanisms 12.1. Location of Processing. Customer acknowledges that Molin AI and its Sub-processors may process Personal Data in the United States and other countries where Molin AI or its Sub-processors operate. Molin AI will ensure that all such transfers comply with this DPA and Applicable Data Protection Legislation. 12.2. Transfer Mechanism. For any Restricted Transfer, the parties agree that the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference and shall serve as the primary transfer mechanism. Where required, the UK International Data Transfer Addendum to the EU SCCs and/or the Swiss addendum apply to such transfers. Where Molin AI or its Sub-processors transfer Customer Personal Data to a recipient that maintains a valid certification under the applicable Data Privacy Framework (EU–U.S., UK Extension, or Swiss–U.S.), the parties may rely on such certification as an alternative transfer mechanism to the extent permitted under Applicable Data Protection Legislation. Molin AI shall provide Customer with information reasonably available to assist Customer in conducting any transfer impact assessment required under Applicable Data Protection Legislation or the SCCs. a. In relation to transfers of Customer Personal Data that is protected by the GDPR, the EU SCCs shall apply, completed as follows: - Module Two (controller → processor) or Module Three (processor → processor) applies, as appropriate. - The optional docking clause (Clause 7) applies. - For Sub-processor matters (Clause 9), Option 2 applies and the notice period is as stated in Section 7 of this DPA. - Clause 11 (redress option) does not apply. - Clause 17: governed by the law of Ireland. - Clause 18(b): disputes shall be resolved before the courts of Ireland. - Annex I and Annex II of the SCCs are completed using the information in Schedules 1 and 2 of this DPA. b. Account Data Transfers. The parties acknowledge that Molin AI may process certain Account Data as an independent controller for purposes such as billing, account administration, and service improvement. Any international transfers of such Account Data will be conducted in accordance with applicable data-protection laws and valid transfer mechanisms, such as the Data Privacy Framework or the SCCs (Module One, controller → controller), as appropriate. c. UK and Swiss Transfers. For transfers subject to the UK GDPR, the parties use a valid UK transfer mechanism (e.g., the UK International Data Transfer Addendum used with the EU SCCs, or a UK adequacy decision). For transfers subject to the Swiss FADP, the parties apply the EU SCCs with the Swiss-specific adaptations recognized by the Swiss authority, or rely on an applicable Swiss adequacy decision. In each case, Annex/Appendix information is taken from Schedules 1–2, and Sub-processor notice follows Section 7. d. SCC Precedence. In case of conflict between the Standard Contractual Clauses and this Agreement (including this DPA), the Standard Contractual Clauses govern. 3. Alternative or Successor Mechanisms. If a competent authority approves a new, replacement, or additional data transfer mechanism that provides an adequate level of protection under Applicable Data Protection Legislation, Molin AI may adopt such mechanism. Molin AI shall notify Customer of the change. Customer may object only if the new mechanism does not comply with Applicable Data Protection Legislation. 13. Cooperation and Data Subject Rights 13.1. Data Subject Rights. Molin AI provides Customers with self-service tools within the Services to help them manage data-subject requests under Applicable Data Protection Legislation. These tools include the ability to delete entire chatbots, which immediately removes access to the underlying data. The deleted chatbot data is permanently erased from Molin AI’s systems after 90 days. Customers may also delete individual conversations or entire conversation histories at any time through the Services’ conversational-delete function. Upon Customer’s written request, and taking into account the nature of the Processing, Molin AI will provide reasonable assistance without undue delay to enable the Customer to respond to such requests that relate to Customer Personal Data. Customer shall reimburse Molin AI’s reasonable costs incurred in assisting with data subject requests. If Molin AI receives a data-subject request directly and can reasonably identify the Customer as the controller, Molin AI will promptly notify the Customer and will not respond to the request except as legally required. The parties agree that the Customer retains exclusive authority and responsibility for determining how to respond to and fulfill any data subject requests relating to Customer Personal Data. 13.2. Cooperation. Should either party receive (a) any request from a data subject to exercise rights under Applicable Data Protection Legislation, or (b) any Third Party Request concerning the processing of Account Data or Customer Personal Data conducted by the other party, it shall promptly notify the other party in writing. The parties agree to cooperate in good faith and to the extent necessary to respond effectively to any such Third Party Request and to fulfill their respective obligations under Applicable Data Protection Legislation. 14. No sale or Sharing To the extent Molin AI’s Processing of Customer Personal Data is subject to U.S. state privacy laws (including the CCPA/CPRA, VCDPA, CPA, CTDPA, and UCPA), the parties agree that Molin AI acts as a Service Provider or Processor on behalf of the Customer. Accordingly, Molin AI shall not (a) Sell Customer Personal Data or otherwise make it available to any third party for monetary or other valuable consideration; (b) Share Customer Personal Data for cross-context behavioral advertising; (c) Retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in this DPA or as otherwise permitted by U.S. data protection laws; (d) Retain, use, or disclose Customer Personal Data outside the direct business relationship between the parties; or (e) Combine Customer Personal Data with personal data that Molin AI receives from another person or collects through its own interactions, except: where the Customer provides documented instructions or consent to such combination, or where the data subject has provided valid consent or opt-in under applicable law. Molin AI shall promptly notify the Customer if it determines that it can no longer comply with its obligations under applicable U.S. privacy laws. Upon providing such notice, Molin AI shall either cease processing Customer Personal Data or take all reasonable and appropriate measures to remediate any identified non-compliance. 15. Miscellaneous 15.1. In the event of any conflict between the terms of this DPA and the Agreement, the terms of this DPA shall prevail. The order of precedence shall be: (a) this DPA; (b) the Agreement; and (c) the Privacy Policy. Furthermore, to the extent of any inconsistency between the Standard Contractual Clauses and any provisions of this DPA, the Agreement, or the Privacy Policy, the Standard Contractual Clauses shall take precedence. 15.2. This DPA replaces any prior data processing addendum that Molin AI and Customer may have previously entered into related to the Services. 15.3. Any claims connected to this DPA shall be governed by the terms and conditions of the Agreement, including its limitations and exclusions. 15.4. In no event does this DPA restrict or limit the rights of any data subject. 15.5. In the event (and to the extent only) of a conflict (whether actual or perceived) among Applicable Data Protection Legislation, the parties (or relevant party as the case may be) shall comply with the more onerous requirement or standard. 15.6. Changes to this DPA. Molin AI may update this DPA where required to comply with applicable data protection laws, approved contractual mechanisms, or regulatory requirements. Such updates become effective upon notice to the Customer. All other changes to this DPA must be agreed in writing between the parties. If a legally required change materially affects Customer’s use of the Service, Customer may terminate the affected processing activities upon written notice. 15.7. No Consideration for Data. The parties acknowledge that Molin AI’s access to and processing of Customer Personal Data are solely for the purpose of providing the Services under this Agreement. Such access or processing does not constitute part of the consideration or value exchanged between the parties. The parties further agree that no Customer Personal Data is provided to Molin AI in exchange for monetary or other valuable consideration. 15.8. No Third-Party Rights. This DPA is intended solely for the benefit of the parties and does not grant any rights or remedies to any third party, including any Third-Party Controller. Nothing in this clause limits or affects any rights or remedies available to Data Subjects under Applicable Data Protection Legislation, this DPA, or under the Standard Contractual Clauses or Data Privacy Framework, where applicable. 15.9. The parties agree that any notice or communication sent by Molin AI to Customer shall also satisfy any obligation to send such notice or communication to Customer’s Affiliate. 15.10. The Annexes, Schedules, and Appendices form an integral part of this DPA. Schedule 1 DETAILS OF PROCESSING Annex 1 – Details of Processing of Customer Personal Data (This Annex 1 includes certain details of the Processing of Customer Personal Data as required by Article 28(3) GDPR.)

Item	Details
1. Parties	Data Exporter (Controller/Customer): The entity identified as the ‘Customer’ in the Agreement and this DPA. Address and Contact Details: As specified in the Agreement. Contact Person / DPO (if any): As specified in the Agreement. Role: Controller. Data Importer (Processor/Molin AI): Molin AI Ltd. Address: As set forth in the Agreement. Contact Email: dataprotection@molin.ai Role: Processor.
2. Subject Matter of Processing	Processing of Customer Personal Data by Molin AI on behalf of Customer for the purpose of providing and supporting the Services under the Agreement, and any related technical or operational support activities expressly instructed by Customer.
3. Duration of Processing	Processing continues for the term of the Agreement and any post-termination period reasonably required to delete, return, or securely isolate Customer Personal Data in accordance with Section 10 of this DPA.
4. Nature and Purpose of Processing	Provide, maintain, and support the Services. Host, store, transmit, and display Customer Personal Data. Manage user accounts, authentication, and permissions. Provide analytics, reporting, or optimization features. Ensure security and detect or prevent misuse. Comply with applicable laws or regulatory obligations. Perform other Processing as instructed by Customer.
5. Categories of Data Subjects	End users or customers interacting with Customer’s chatbot or digital channels. Customer employees, contractors, or agents accessing the Services. Individuals whose personal data is contained in communications or content processed through the Services.
6. Categories of Personal Data	Identification and contact data (name, email, phone, address). Login credentials (hashed or tokenized). Technical data (IP address, browser, logs, cookies). Conversation and interaction data (chat transcripts, uploads, forms, messages, phone calls (and recordings thereof)). Email content, email headers, attachments, recipient/sender metadata. Customer account and billing details. Any other personal data entered by Customer or its end users. Note: Customer is responsible for ensuring that no unnecessary or prohibited data is entered without lawful basis.
7. Sensitive or Special Categories of Data	Molin AI does not intentionally process special categories of data (Article 9 GDPR). Customer shall avoid transmitting such data unless expressly agreed in writing with appropriate safeguards.
8. Frequency of Processing / Transfers	Continuous during the operation of the Services.
9. Retention and Deletion	Customer Personal Data is retained for the duration of the Agreement and deleted or returned per Section 10. Backups are deleted within standard retention cycles unless otherwise required by law.
10. Sub-Processing and Onward Transfers	Molin AI may engage approved Sub-Processors bound by equivalent data-protection obligations. A current list is available on Sub-processor page. Transfers outside the EEA/UK/Switzerland occur only under lawful transfer mechanisms (see Section 12 of this DPA).
11. Technical and Organizational Measures	Molin AI maintains TOMs to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. See Annex 2 for details (e.g., encryption, access control, monitoring, incident response).
12. Competent Supervisory Authority	EEA: Supervisory authority of Customer’s Member State of establishment or residence. UK: Information Commissioner’s Office (ICO). Switzerland: Federal Data Protection and Information Commissioner (FDPIC).

This Annex 1 forms an integral part of the DPA and shall be deemed accepted and executed by the parties upon execution of the DPA (or the Agreement to which it is attached). Schedule 2 TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES (TOMs) Annex II 1. Molin AI maintains an information-security program designed to protect the confidentiality, integrity, and availability of Customer Personal Data, taking into account the risks of accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures reflect industry standards (ISO 27001 principles) and may evolve with technical progress, provided that such updates do not materially reduce overall security. Where applicable, this Schedule 2 will serve as Annex II to the Standard Contractual Clauses. The following sections provide information regarding the technical and organizational security measures: 2. Organizational Security

Governance and Policies: Molin AI maintains an Information Security Policy, Access Control Policy, and Business Continuity Policy reviewed at least annually.
Training and Awareness: All personnel receive mandatory privacy and security training, including secure-coding and phishing-resilience modules.
Vendor Risk Management: Prior to onboarding Sub-processors, Molin AI assesses their security posture.

3. Access Control and Authentication

Access to production systems is role-based and limited to authorized personnel on a need-to-know basis.
Multi-Factor Authentication (MFA) is mandatory for all privileged accounts.
Passwords follow strong-credential rules (≥ 16 characters, complexity requirements) and are managed via a centralized identity provider.
Access rights are reviewed at least every 180 days and immediately revoked upon role change or termination.
Failed login attempts trigger account lockout (at more than 5 consecutive incorrect password attempts), all access events are logged and monitored.

4. Encryption and Pseudonymization

In Transit: All data transmitted via HTTPS with TLS 1.2 or higher (default TLS 1.3), AES-256 encryption, SHA-2 signatures.
At Rest: Customer Data encrypted using AES-256-GCM within Cloudflare-managed storage.
Key Management: Encryption keys stored and rotated securely with limited personnel access, subject to MFA and audit logging.
Pseudonymization: When feasible, identifiers are separated or masked for diagnostic and analytics uses.

5. Physical and Environmental Security

Customer Data is hosted in secure Cloudflare data centers in the EU and U.S.
Molin AI maintains no on-premise servers; all operations use virtualized cloud instances for redundancy and resilience.

6. Operations Security and System Configuration

Systems are hardened per CIS benchmarks and patched promptly.
Change management processes ensure peer review, version control, automated testing, and rollback plans for all releases.
Vulnerability scans and third-party penetration tests are performed regularly.
Intrusion-prevention systems and network firewalls protect external interfaces; anomalous activity triggers alerts.

7. Data Minimization, Retention and Deletion

Data collection is limited to the purposes of processing (or the data that the Customer chooses to provide).
Security measures are in place to provide only the minimum amount of access (least privilege) necessary to perform required functions.
Upon termination or expiry of this DPA, Molin AI will (at Customer’s election) delete or return to Customer all Customer Personal Data as per Section 10 of this DPA.

8. Incident and Breach Management

24×7 on-call incident response with documented escalation paths.
Security events are logged, triaged, and investigated; containment and remediation occur under defined SLAs.
Customers are notified without undue delay after confirmation of a Personal Data Breach.
Post-incident reviews identify corrective actions and drive continuous improvement.

9. Business Continuity and Disaster Recovery

Redundant architecture and automated backups ensure availability.
Disaster Recovery (DR) plan tested periodically in coordination with cloud provider capabilities.
Objective: restore service and access to Customer Data within commercially reasonable timeframes after disruption.

10. Testing and Auditing

Regular security assessments and internal audits validate control effectiveness.
External SOC 2 / ISO 27001-aligned audits are conducted annually.

11. Accountability and Certification

Documentation of all processing activities maintained.
Molin AI adheres to the principles of “privacy by design and default.”
Implementation of ISO 27001 standards and participation in relevant certification programs are ongoing.

12. Sub-processor Measures Molin AI requires each authorized Sub-processor to implement adequate security measures. 13. Updates Molin AI may modify these Technical and Organizational Measures from time to time to reflect evolving threats and technology, provided that such modifications do not materially diminish the level of protection. Schedule 3 LIST OF SUB-PROCESSORS Annex III Customer agrees that Molin AI may engage Sub-processors as set in Section 7 in this DPA. The list of Sub-processors are available on the Sub-processor Page. Schedule 4 UK Addendum to the EU Commission Standard Contractual Clauses (UK GDPR) Effective as of the DPA Effective Date. 1. Purpose and Incorporation 1.1 This Schedule governs Restricted Transfers of Personal Data subject to the UK GDPR and provides Appropriate Safeguards under Article 46 UK GDPR. 1.2 The parties incorporate by reference the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (version B1.0, in force 21 March 2022) (the “UK Addendum”), as issued by the UK Information Commissioner’s Office. The UK Addendum’s Mandatory Clauses apply in full. 1.3 This Schedule supplements the EU Standard Contractual Clauses (2021/914) used elsewhere in this DPA and completes them for transfers of Customer Personal Data subject to the UK GDPR. 2. Part 1 — Tables (Completion) The UK Addendum’s Part 1 Tables 1–4 are completed by reference to this DPA as follows:

Table 1 (Parties): Exporter is the Customer (and its relevant Affiliates, if applicable). Importer is Molin AI. Contact details are as specified in the Agreement or in Annex 1 (Details of Processing).
Table 2 (Selected SCCs, Modules, Clauses): Approved SCCs – Commission Implementing Decision (EU) 2021/914. Modules – Module 2 (controller to processor) and Module 3 (processor to processor) for Customer Personal Data; Module 1 (controller to controller) for Account Data where Molin acts as an independent controller.
Table 3 (Appendix / Annex Information): Annex I(A)-(B) – Parties and description of transfers (Annex 1 of this DPA); Annex I(C) – ICO as competent authority; Annex II – Technical and Organizational Measures (Annex 2 of this DPA); Annex III – Sub-processors per the Sub-processor Page (or Annex 3, if applicable).
Table 4 (ICO Revision Mechanism): Selection – Importer and Exporter (both parties). Either party may terminate the UK Addendum before the effective date of a revised Approved Addendum if that revision would cause a substantial and disproportionate increase in cost or risk, consistent with the ICO mechanism.

3. Interpretation and Hierarchy 3.1 Terms used but not defined in this Schedule have the meanings given in the DPA, the EU SCCs, or the UK Addendum. Where the UK GDPR applies, references to the GDPR/EU are read as references to UK Data Protection Laws/the UK. 3.2 For Restricted Transfers subject to the UK GDPR: (a) the UK Addendum prevails over conflicting terms in the EU SCCs; (b) the SCCs prevail over the DPA or Agreement; and (c) the provision providing greater protection to data subjects prevails. 4. UK-Specific Modifications to the EU SCCs

References to ‘Regulation (EU) 2016/679’ are read as references to the UK GDPR and the Data Protection Act 2018.
References to ‘EU/Union/Member State’ are read as references to the UK or UK law.
Clause 13(a) and Annex I, Part C (EU authority) do not apply; the ICO acts as the competent supervisory authority.
Clause 17 (governing law): England and Wales; Clause 18 (forum): courts of England and Wales; data subjects may also bring proceedings in any competent UK jurisdiction.
Onward transfers: Clause 8.8(i) (Modules 2/3) is read to permit onward transfers to countries with UK adequacy regulations (Section 17A of the Data Protection Act 2018); Clause 8.7(i) (Module 1) similarly applies.
Footnotes to the EU SCCs do not form part of this UK Addendum unless expressly required by the UK Addendum.

5. UK Adequacy (Data Bridge) and Transfer Mechanisms 5.1 Where the recipient is certified under the UK Extension to the EU-U.S. Data Privacy Framework (DPF) and listed on the DPF List, the parties may rely on the UK adequacy regulations as the transfer mechanism for that transfer. Otherwise, the EU SCCs together with this UK Addendum shall apply. 5.2 The use of the UK adequacy regulations for certain transfers does not preclude reliance on the SCCs plus this UK Addendum for other transfers. 6. UK Transfer Risk Assessment (TRA) Assistance Molin AI shall provide information reasonably available to assist the Customer in conducting any UK Transfer Risk Assessment (TRA) or equivalent evaluation required for transfers under the UK GDPR. 7. Annex References

Annex I(A)-(B): Populated by Annex 1 (Details of Processing) to this DPA.
Annex I(C): ICO as competent authority (UK GDPR).
Annex II: Populated by Annex 2 (Technical and Organizational Measures).
Annex III: Sub-processors per Molin AI’s Sub-processor Page or Annex 3 (if included).

8. Execution and Form The parties may enter into this UK Addendum by reference, including via electronic acceptance or attachment to the DPA, without separate signature, provided that it is legally binding and enforceable by data subjects as required by the UK Addendum.