Data Processing Agreement

Preamble

This Data Processing Agreement (this "DPA") is entered into between the Customer that has accepted the Terms ("Customer") and Frabo OS, a subsidiary of USRA, LLC ("Frabo"), and takes effect upon Customer's acceptance of the Terms. It reflects the parties' agreement with respect to the Processing of Customer Personal Data in accordance with Article 28(3) of the GDPR and other Data Protection Laws.

A countersigned copy may be requested at [email protected]; countersignature is not required for this DPA to take effect.

Article 1 — Definitions

In this DPA:

• "Data Protection Laws" means all laws applicable to the Processing of Customer Personal Data under the Agreement, including the GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and the CCPA, each as amended.
• "GDPR" means Regulation (EU) 2016/679; "UK GDPR" means the GDPR as retained in the law of the United Kingdom.
• "Customer Personal Data" means Personal Data contained in Customer Data that Frabo Processes on behalf of Customer.
• "Personal Data", "Controller", "Processor", "Data Subject", "Processing", "Personal Data Breach", and "Supervisory Authority" have the meanings given in the GDPR, and include equivalent terms under other Data Protection Laws (including "personal information", "business", and "service provider" under the CCPA).
• "Sub-processor" means any Processor engaged by Frabo to Process Customer Personal Data.
• "SCCs" means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914; "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
• "Restricted Transfer" means a transfer of Customer Personal Data to a country that has not been recognised under Data Protection Laws as providing an adequate level of protection.

Article 2 — Scope and Roles of the Parties

2.1 Roles. Customer is the Controller (or, where Customer acts on behalf of another Controller, a Processor) of Customer Personal Data, and Frabo is a Processor (or, as applicable, a Sub-processor) acting on Customer's behalf. Annex I describes the Processing.

2.2 Frabo as Controller. This DPA does not apply to Personal Data that Frabo Processes as a Controller, such as Account Data concerning account holders and Authorized Users, which is governed by the Privacy Policy.

2.3 Customer Obligations. Customer shall ensure that it has a lawful basis for the Processing, has provided all notices and obtained all consents required by Data Protection Laws, and that its instructions comply with Data Protection Laws. Customer is responsible for the accuracy and lawfulness of Customer Personal Data.

Article 3 — Processing Instructions

3.1 Documented Instructions. Frabo shall Process Customer Personal Data only on Customer's documented instructions, including with regard to Restricted Transfers, unless required to do so by Union, Member State, or other applicable law, in which case Frabo shall inform Customer of that legal requirement before Processing unless the law prohibits such information on important grounds of public interest.

3.2 Scope of Instructions. The Agreement, Customer's configuration of the Service, and Customer's use of the Service (including actions Customer approves Adam to take) constitute Customer's complete documented instructions. Additional instructions require the parties' written agreement.

3.3 Unlawful Instructions. Frabo shall inform Customer without undue delay if, in its opinion, an instruction infringes Data Protection Laws.

3.4 No Training. Frabo shall not use Customer Personal Data to train third-party AI models.

Article 4 — Confidentiality of Personnel

4.1 Frabo shall ensure that persons authorised to Process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited on a least-privilege basis to personnel who require it to provide, secure, or support the Service. All such access is logged.

Article 5 — Security of Processing

5.1 Frabo shall implement and maintain the technical and organisational measures described in Annex II, which are designed to ensure a level of security appropriate to the risk in accordance with Article 32 of the GDPR.

5.2 Frabo may update those measures from time to time, provided that any update does not materially diminish the overall level of protection of Customer Personal Data.

Article 6 — Sub-processors

6.1 General Authorisation. Customer grants Frabo general written authorisation to engage Sub-processors. The Sub-processors engaged as of the date of this DPA are listed in Annex III.

6.2 Notice of Changes. Frabo shall notify Customer of any intended addition or replacement of a Sub-processor, by email or within the Service, at least thirty (30) days before the new Sub-processor begins Processing Customer Personal Data.

6.3 Objection. Customer may object to a new Sub-processor on reasonable data protection grounds by written notice to [email protected] within thirty (30) days of Frabo's notice. The parties shall discuss Customer's objection in good faith. If they cannot resolve it, Customer may terminate the affected portion of the Service, and Frabo shall refund any prepaid Fees for the unused portion of the Subscription Term attributable to it.

6.4 Flow-Down and Liability. Frabo shall impose on each Sub-processor, by written contract, data protection obligations no less protective than those in this DPA, and shall remain liable to Customer for the performance of each Sub-processor's obligations.

6.5 Customer-Enabled Integrations. Third-Party Services and connected applications that Customer elects to enable are engaged at Customer's direction. Their Processing is governed by their own terms with Customer, and Section 6.2 does not apply to them.

Article 7 — Data Subject Requests

7.1 Taking into account the nature of the Processing, Frabo shall assist Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling Customer's obligation to respond to requests from Data Subjects to exercise their rights under Data Protection Laws. The Service provides self-service tools for access, export, correction, and deletion.

7.2 If Frabo receives a request directly from a Data Subject concerning Customer Personal Data, Frabo shall not respond substantively (other than to direct the Data Subject to Customer) unless authorised by Customer or required by law, and shall promptly notify Customer where the request identifies Customer.

Article 8 — Impact Assessments and Prior Consultation

8.1 Taking into account the nature of the Processing and the information available to it, Frabo shall provide reasonable assistance to Customer in ensuring compliance with Articles 32 to 36 of the GDPR, including in connection with data protection impact assessments and prior consultations with Supervisory Authorities.

Article 9 — Personal Data Breach Notification

9.1 Notification. Frabo shall notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

9.2 Content. The notification shall describe, to the extent then known: (a) the nature of the breach, including the categories and approximate number of Data Subjects and records concerned; (b) the name and contact details of Frabo's point of contact; (c) the likely consequences; and (d) the measures taken or proposed to address the breach and mitigate its effects. Where information is not available at once, Frabo shall provide it in phases without undue further delay.

9.3 Cooperation. Frabo shall take reasonable steps to contain and remediate the breach and shall cooperate with Customer in meeting its notification obligations. Frabo's notification of a breach is not an acknowledgment of fault or liability.

Article 10 — Return and Deletion

10.1 Return. Customer may export Customer Personal Data from Settings at any time during the term of the Agreement and after its Subscription Plan ends.

10.2 Deletion. Upon deletion of Customer's Account or termination of the Agreement, Frabo shall delete Customer Personal Data from live systems within thirty (30) days, and residual copies in backups shall expire within a further thirty (30) days, unless Union, Member State, or other applicable law requires retention, in which case Frabo shall continue to protect the retained data in accordance with this DPA and Process it only for the purpose of such retention. Payment and payout records, records in which another person has an interest, and the tamper-evident action log are retained without the Customer's name or account identifier attached, as described in Section 13 of the Privacy Policy.

Article 11 — Information and Audits

11.1 Information. Frabo shall make available to Customer all information reasonably necessary to demonstrate compliance with Article 28 of the GDPR and this DPA, including written responses to reasonable security questionnaires, this DPA's Annex II, and the certifications and reports of its Sub-processors to the extent Frabo is permitted to share them.

11.2 Audits. Where the information provided under Section 11.1 is insufficient to demonstrate compliance, or where an audit is required by a Supervisory Authority or by Data Protection Laws, Customer (or an independent auditor bound by confidentiality and reasonably acceptable to Frabo) may conduct an audit, including an inspection, on at least thirty (30) days' prior written notice, during normal business hours, no more than once in any twelve (12) month period except following a Personal Data Breach, and in a manner that does not unreasonably disrupt Frabo's operations or compromise the security or confidentiality of other customers' data. Each party shall bear its own costs of any audit.

Article 12 — International Transfers

12.1 Locations. Customer acknowledges that the Service operates on Cloudflare's global network and that Customer Personal Data may be Processed in countries other than Customer's, including the United States.

12.2 EU SCCs. To the extent that Processing involves a Restricted Transfer from the European Economic Area, the SCCs are incorporated into this DPA as follows: (a) Module Two (Controller to Processor) applies where Customer is a Controller, and Module Three (Processor to Processor) applies where Customer is a Processor; (b) Clause 7 (docking clause) applies; (c) for Clause 9(a), Option 2 (general written authorisation) applies, with the notice period set out in Section 6.2; (d) the optional wording in Clause 11(a) does not apply; (e) for Clause 13, the competent Supervisory Authority is the Supervisory Authority of the Member State in which the data subjects whose Personal Data is transferred under the SCCs in relation to the offering of goods or services to them, or whose behaviour is monitored, are located; (f) for Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland; (g) for Clause 18(b), disputes shall be resolved before the courts of Ireland; and (h) Annexes I.A, I.B, II, and III of the SCCs are completed by Annexes I, II, and III of this DPA.

12.3 United Kingdom. To the extent that Processing involves a Restricted Transfer from the United Kingdom, the UK Addendum is incorporated into this DPA: Table 1 is completed with the parties' details in this DPA; Table 2 refers to the Modules and options selected in Section 12.2; Table 3 is completed by Annexes I to III of this DPA; and for Table 4, either party may end the UK Addendum as set out in its Section 19.

12.4 Switzerland. To the extent that Processing involves a Restricted Transfer from Switzerland, the SCCs apply as set out in Section 12.2, with the following modifications: references to the GDPR shall be read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent Supervisory Authority insofar as the transfer is governed by the FADP; and the term "Member State" shall not be interpreted so as to exclude Data Subjects in Switzerland from enforcing their rights in their place of habitual residence.

12.5 Precedence. In the event of conflict between this DPA and the SCCs or the UK Addendum, the SCCs or the UK Addendum shall prevail.

Article 13 — CCPA Service Provider Terms

To the extent that Customer Personal Data is subject to the CCPA, Frabo acts as a service provider and shall not:

• (a) sell or share (as those terms are defined in the CCPA) Customer Personal Data;
• (b) retain, use, or disclose Customer Personal Data for any purpose (including any commercial purpose) other than the business purposes specified in the Agreement, or outside the direct business relationship between Customer and Frabo;
• (c) combine Customer Personal Data with personal information received from or on behalf of another person, or collected from Frabo's own interactions with consumers, except as permitted by the CCPA.
• Frabo shall comply with applicable obligations under the CCPA and provide the same level of privacy protection as the CCPA requires; shall notify Customer if it determines that it can no longer meet its obligations; and grants Customer the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorised use of Customer Personal Data. Frabo certifies that it understands and shall comply with the restrictions in this Article.

Article 14 — Liability

14.1 Each party's liability arising out of or relating to this DPA is subject to the exclusions and limitations of liability in Article 20 of the Terms, save that nothing in this DPA limits either party's liability to Data Subjects under the SCCs or under Data Protection Laws to the extent such liability cannot be limited.

Article 15 — Term, Precedence, and Governing Law

15.1 Term. This DPA remains in effect for so long as Frabo Processes Customer Personal Data, and its obligations survive termination of the Agreement until all Customer Personal Data has been deleted in accordance with Article 10.

15.2 Precedence. Subject to Section 12.5, in the event of conflict between this DPA and any other part of the Agreement, this DPA prevails with respect to the Processing of Customer Personal Data.

15.3 Governing Law. Except as required by the SCCs or the UK Addendum, this DPA is governed by the law and subject to the forum specified in Article 22 of the Terms.

Annex I — Description of the Processing

• A. Parties. Data exporter: Customer (Controller or Processor), whose details are those associated with its Account. Data importer: Frabo OS, a subsidiary of USRA, LLC (Processor), contact [email protected].
• B. Categories of Data Subjects. Customer's customers; Customer's contacts and prospects; Customer's employees; Customer's contractors; and end users of Customer's offerings.
• C. Categories of Personal Data. Contact details (names, email addresses, telephone numbers, companies); financial transaction data (invoices, payments, refunds, disputes, payouts, amounts, currencies, dates, and statuses); payroll inputs (pay type and rate, hours, pay dates, deductions entered, payment notes, and W-9 on-file status — excluding Social Security numbers and bank account numbers); CRM notes and follow-ups; email campaign delivery and unsubscribe records; documents and records Customer uploads or connects; and messages Customer exchanges with Adam that contain such data.
• D. Special Categories of Data. None intended. Customer shall not submit special categories of Personal Data under Article 9 of the GDPR, or data relating to criminal convictions and offences, unless the parties have agreed additional safeguards in writing.
• E. Frequency. Continuous, for the duration of the Agreement.
• F. Nature of Processing. Hosting, storage, retrieval, organisation, analysis, AI-assisted preparation of drafts and calculations, transmission at Customer's direction, and deletion.
• G. Purpose. Provision, security, and support of the Service in accordance with the Agreement and Customer's instructions.
• H. Duration and Retention. For the term of the Agreement, followed by deletion in accordance with Article 10.
• I. Sub-processor Transfers. As set out in Annex III, for the subject matter, nature, and duration described in this Annex I.

Annex II — Technical and Organisational Measures

• (1) Encryption: TLS encryption for all data in transit; encryption at rest for stored credentials and connected-account access tokens.
• (2) Authentication: sign-in by one-time code; single sign-on for organisations that require it; step-up re-authentication before sensitive actions such as moving money, approving pay runs, or connecting applications; and alerts upon sign-in from a new browser, device, or country.
• (3) Access Control: role-based access control (owner, admin, member, viewer) enforced server-side on every request.
• (4) Audit Logging: a tamper-evident, hash-chained audit log in which each record carries a cryptographic hash of the preceding record, with the latest hash anchored daily to write-once storage so that any altered or deleted record is detectable; exportable by owners.
• (5) AI Safeguards: removal of credentials and personal identifiers, where practicable, before text is transmitted to a cloud AI model; screening of documents and emails for embedded manipulative instructions; no training of third-party models on Customer Personal Data; and on-device processing through Adam Local at Customer's election.
• (6) Personnel Access: least-privilege access by Frabo personnel, limited to those who require it to provide, secure, or support the Service, with all access logged.
• (7) Third-Party Access: OAuth with PKCE, scoped and expiring tokens, Customer consent for each application, and revocation at any time; immediate deletion of stored tokens upon disconnection.
• (8) Integrity of Payment Events: verification of Stripe webhook signatures before acting; card data transmitted directly to Stripe (a PCI DSS Level 1 certified processor) and not received by Frabo's servers.
• (9) Data Minimisation: voice audio is converted to text and not stored; Social Security numbers and bank account numbers for Customer's staff are not requested or stored.
• (10) Incident Response: breach detection, containment, and notification as set out in Article 9.

Annex III — Sub-processors

Frabo engages the following Sub-processors:

• (1) Cloudflare, Inc. (United States; global network) — application hosting and compute, databases, file storage, AI model inference (Cloudflare Workers AI), email delivery and routing, and security services.
• (2) Stripe, Inc. (United States) — payment processing for Frabo subscription billing and, where Customer connects Stripe, the payment event data described in the Stripe Connect Disclosure. Stripe's processing of payments on Customer's own Stripe account is governed by the Stripe Services Agreement between Customer and Stripe.
• (3) Expo (650 Industries, Inc.) (United States) — delivery of push notifications to the Frabo mobile applications.
• (4) Customer-enabled integrations — Third-Party Services and connected applications that Customer elects to enable (for example, Google, Microsoft, social platforms, or applications authorised through the API), engaged solely at Customer's direction and within the scope Customer approves, as described in Section 6.5.

Contact

Data protection enquiries, objections to Sub-processors, and requests for a countersigned copy of this DPA: [email protected].

Frabo OS is a subsidiary of USRA, LLC.