Data Processing Addendum

1.Scope

1.1This addendum forms part of the agreement between Wysdom Labs Ltd, trading as Soba ("Soba", "we"), and the customer that accepted the terms of service ("you"). It applies whenever Soba processes personal data on your behalf in providing the service, and it applies automatically: accepting the terms accepts it.

1.2It does not cover the data Soba processes as a controller in its own right, such as your account, your workspace members and your billing relationship with us. That is governed by the privacy policy.

2.Definitions

2.1"Data protection law" means the UK GDPR and the Data Protection Act 2018, the EU GDPR, and any other law on the processing of personal data that applies to the processing under this addendum. "Personal data", "controller", "processor", "data subject", "processing" and "personal data breach" have the meanings data protection law gives them.

2.2"Customer personal data" is personal data Soba processes on your behalf under the agreement, described in Annex 1. "End user" is a person who uses your app. "Subprocessor" is a third party Soba engages to process customer personal data.

3.Roles of the parties

3.1For customer personal data, you are the controller, or a processor acting for your own customer, and Soba is your processor, or subprocessor. Each of us will comply with the data protection law that applies to it in that role.

3.2Stripe processes payment data as an independent controller, under its own agreement with you, when your end users pay you through your own Stripe account. Soba never holds card details.

3.3The same is true of a model provider you connect with your own API key. When your routing sends a run to it, Soba transmits the run on your instruction, and the provider processes it under your agreement with them, not as Soba's subprocessor. A run served by an end user's own machine or subscription goes to no provider at all.

4.Processing instructions

4.1Soba processes customer personal data only on your documented instructions. The agreement, this addendum and the way you configure and call the service (your plans, routing, keys, API requests and dashboard settings) are your complete instructions. Anything further must be agreed in writing.

4.2We will not process customer personal data for our own purposes, sell it, use it to market to your end users, build a profile of an end user across the apps they use, or train any model on it.

4.3If the law requires us to process customer personal data other than on your instructions, we will tell you first unless the law forbids it. If we believe an instruction infringes data protection law, we will tell you and may suspend that processing until you confirm or change it.

5.Confidentiality

5.1Only people who need access to customer personal data to run, support or secure the service have it, and each is bound by a duty of confidentiality.

6.Security

6.1Soba maintains the technical and organisational measures in Annex 2, which are designed to protect customer personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, the cost of implementation, and the nature and risks of the processing. We may change them over time, but never in a way that lowers the overall level of protection.

7.Subprocessors

7.1You authorise Soba to engage the subprocessors listed in Annex 3. We impose on each data protection obligations no less protective than this addendum, and we remain liable to you for their performance of them.

7.2Before adding or replacing a subprocessor, we will update Annex 3 and email the account owner of each workspace at least 30 days in advance. If you object on reasonable data protection grounds within that period, we will work with you in good faith to find an alternative. If we cannot, you may terminate the affected part of the service and we will refund any prepaid fees for the period after termination.

8.Assistance and data subject requests

8.1If an end user sends us a request about their personal data, such as access, correction or deletion, we will pass it to you rather than answer it ourselves, unless the law requires otherwise. Taking into account the nature of the processing, we will help you answer such requests, including by deleting an end user and the records attributed to them when you ask us to in writing. Deleting an app deletes all of its end users and their records.

8.2We will also give you reasonable help with data protection impact assessments, consultations with supervisory authorities and your security obligations, to the extent they concern the service and you do not otherwise have the information.

9.Personal data breaches

9.1If Soba becomes aware of a personal data breach affecting customer personal data, we will notify you without undue delay, and in any case within 48 hours. The notice will describe what happened, the data and end users likely to be affected, the likely consequences and what we are doing about it, as far as that is known; we will add to it as we learn more. We will take reasonable steps to contain the breach and limit its effects.

9.2Notifying you is not an admission of fault. You are responsible for any notice owed to supervisory authorities or end users, and we will help you with it.

10.International transfers

10.1Soba's database and the functions that write to it are hosted in London. Some subprocessors operate globally, so customer personal data may be processed outside the UK and the EEA. Where a transfer needs a safeguard under data protection law, it relies on, as applicable:

• an adequacy decision or UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified;
• the European Commission's standard contractual clauses (Module 2, controller to processor, or Module 3, processor to processor), which are incorporated by reference for transfers from the EEA; and
• the UK International Data Transfer Addendum to those clauses, or the UK International Data Transfer Agreement, for transfers from the UK.

10.2For those clauses, you are the data exporter and Soba the data importer. The optional docking clause applies. The supervisory authority is the one competent for you, and the governing law and courts are those of Ireland for the EU clauses, and of England and Wales for the UK ones. The details the clauses ask for are in the annexes below.

11.Audits

11.1On request, we will make available the information reasonably needed to show compliance with this addendum, including written answers to a security questionnaire. If that is not enough to satisfy an obligation you have under data protection law, you may audit our compliance once in any twelve months, on at least 30 days' written notice, during business hours, at your own cost and under a duty of confidentiality, or appoint an independent auditor to do so. An audit must not give access to other customers' data.

12.Return and deletion of data

12.1When the agreement ends, or when you delete an app or a workspace, Soba will delete the customer personal data it holds for it within 30 days, including from active systems. Encrypted backups expire on their ordinary rotation and are not restored except to recover the service. Before then you can ask us for an export of it.

12.2We may keep records the law requires us to keep, such as billing and tax records, for as long as it requires, and only for that purpose.

13.Customer obligations

13.1You are responsible for having a lawful basis for the processing you instruct, for giving your end users the information data protection law requires, and for the data your app sends through Soba. In particular, a run carries whatever your tools return to the model. Do not route special category data, or data about criminal convictions, through Soba unless you have assessed that the processing is lawful and the measures in Annex 2 are adequate for it.

14.Liability and precedence

14.1Each party's liability under or in connection with this addendum is subject to the limits and exclusions in the terms of service, as far as data protection law allows. Where this addendum conflicts with the terms of service on the processing of personal data, this addendum prevails; where it conflicts with the standard contractual clauses or the UK Addendum, those prevail. This addendum lasts as long as Soba processes customer personal data for you.

Annex 1: The processing

Annex 2: Security measures

Annex 3: Subprocessors

Soba currently uses the following subprocessors. Changes are notified in accordance with clause 7.