Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Audon Terms of Service (document id terms) or other written agreement (the "Agreement") between Audon Software LLC To be confirmed: confirm legal name as shown on the Delaware certificate of formation, a Delaware limited liability company, United States ("Processor", "Audon", "we") and the customer organization that has accepted the Agreement ("Customer", "you").

It applies where Audon processes Customer Personal Data on behalf of the Customer in providing the Services.

---

1. Definitions

Capitalized terms not defined here have the meaning given in the Agreement.

• "Applicable Data Protection Law" means all laws relating to the processing of personal data that apply to a party's processing under the Agreement, which may include: the UK GDPR and the UK Data Protection Act 2018; Regulation (EU) 2016/679 (the "EU GDPR"); the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL") and its implementing regulations; the Saudi Personal Data Protection Law and its implementing and transfer regulations (the "Saudi PDPL"); and applicable US state privacy laws, including the California Consumer Privacy Act as amended (the "CCPA"). Reference to a law does not mean that it necessarily applies in a particular case.
• "Customer Personal Data" means personal data contained in Customer Data that Audon processes on behalf of the Customer.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by Audon or its Subprocessors.
• "Subprocessor" means a third party engaged by Audon that processes Customer Personal Data.
• "controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in Applicable Data Protection Law; and "controller" includes "business" and "processor" includes "service provider" under the CCPA.

---

2. Roles and scope

2.1 Roles. For Customer Personal Data, the Customer is the controller (or a processor acting for its own controller) and Audon is a processor (or subprocessor). Annex I describes the processing.

2.2 Audon's own data. This DPA does not apply to personal data that Audon processes as a controller for its own purposes, such as account administration, authentication, billing, legal acceptance records, security logging and support. That processing is described in the Privacy Policy.

2.3 Customer obligations. The Customer is responsible for: (a) having a lawful basis and giving any required notices for the processing described in Annex I; (b) the accuracy of Customer Personal Data; (c) its choice to supply provider admin keys and to submit Telemetry; and (d) not submitting data that the Services are not designed to receive, in particular prompts, responses, special category or sensitive personal data, or secrets, in Telemetry.

---

3. Processing on documented instructions

3.1 Instructions. Audon will process Customer Personal Data only on the Customer's documented instructions, unless required to do otherwise by law to which Audon is subject (in which case Audon will inform the Customer of that legal requirement before processing, unless that law prohibits it on important grounds of public interest).

3.2 Documented instructions. The Customer's instructions are: (a) the Agreement and this DPA; (b) the Customer's configuration of the Services (for example, which connectors are enabled, retention settings and notification settings); and (c) actions taken by Authorized Users and Agents within their scopes through the user interface, API or MCP. Additional instructions require written agreement.

3.3 Unlawful instructions. Audon will inform the Customer without undue delay if, in its opinion, an instruction infringes Applicable Data Protection Law. Audon is not required to perform legal research on the Customer's behalf.

3.4 No secondary use. Audon will not: (a) sell or share Customer Personal Data (as those terms are defined in the CCPA); (b) retain, use or disclose it for any purpose other than providing the Services, or outside the direct business relationship with the Customer; (c) combine it with personal data received from other sources except as permitted by Applicable Data Protection Law; (d) use it to train, fine-tune or evaluate any AI model; or (e) send it to any AI model. Audon certifies that it understands and will comply with these restrictions.

---

4. Confidentiality of personnel

Audon will ensure that persons authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and have access only to the extent needed to provide, secure or support the Services.

---

5. Security

5.1 Measures. Audon will implement and maintain the technical and organizational measures in Annex II, which are designed to provide a level of security appropriate to the risk.

5.2 Updates. Audon may update the measures in Annex II, provided that the update does not materially reduce the overall level of protection.

5.3 No certification claims. The Customer acknowledges that Audon does not currently hold SOC 2 or ISO/IEC 27001 certification and has not completed an independent penetration test. If this changes, Audon will update the Security Overview.

---

6. Subprocessors

6.1 General authorization. The Customer gives general authorization for Audon to engage Subprocessors. The Subprocessors in use at the date of this DPA are listed in Annex III and in the Subprocessors list (document id subprocessors).

6.2 Notice of changes. Audon will give at least 30 days' notice before a new Subprocessor begins processing Customer Personal Data, by updating the Subprocessors list and notifying organization owners who have not opted out of these notices, by email and in the Services. Where urgent replacement is needed for security or continuity reasons, Audon will give notice as soon as practicable.

6.3 Objection. The Customer may object to a new Subprocessor on reasonable data protection grounds by writing to To be confirmed: privacy contact email within the notice period. The parties will discuss the objection in good faith. If Audon cannot reasonably accommodate it, the Customer may terminate the affected Services by written notice and receive a refund of prepaid fees for the unused part of the Subscription Term.

6.4 Flow-down. Audon will impose on each Subprocessor, by written contract, data protection obligations that provide at least the same level of protection for Customer Personal Data as this DPA, to the extent applicable to the services the Subprocessor provides. Audon remains responsible to the Customer for its Subprocessors' performance of those obligations.

---

7. Assistance with data subject requests

7.1 Tools. The Services allow the Customer to export organization data (JSON), set retention, remove members, revoke credentials and request deletion of the organization, through the user interface and the API/MCP. The Customer should use these tools first.

7.2 Requests received by Audon. If Audon receives a request from a data subject relating to Customer Personal Data, it will (unless legally prohibited) promptly forward it to the Customer and will not respond directly except to direct the data subject to the Customer.

7.3 Further assistance. Taking into account the nature of the processing, Audon will provide reasonable assistance to enable the Customer to respond to requests that the Customer cannot fulfil using the self-service tools.

---

8. Personal Data Breaches

8.1 Notification. Audon will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach. To be confirmed: breach notice period to customers (proposed 72 hours) Notice will be sent to the organization owner's email address and shown in the Services.

8.2 Content. The notice will, to the extent then known, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Audon will provide further information as it becomes available.

8.3 Cooperation. Audon will take reasonable steps to contain and remediate the breach and will reasonably cooperate with the Customer in meeting its obligations to notify supervisory authorities and data subjects.

8.4 No admission. Notification is not an admission of fault or liability.

---

9. Data protection impact assessments and consultation

Audon will provide reasonable assistance to the Customer with data protection impact assessments and prior consultations with supervisory authorities that are required by Applicable Data Protection Law, in relation to the Services and to the extent the Customer does not otherwise have access to the relevant information. The information in this DPA, the Security Overview and the Subprocessors list is intended to support such assessments.

---

10. Return and deletion

10.1 During the Agreement. The Customer may export its organization data at any time and may set the retention period for spend data (default 400 days). Disconnecting a connector immediately destroys the related encrypted credential and stops future synchronization.

10.2 On termination. When an organization owner requests deletion, or after termination of the Agreement, Audon will delete Customer Personal Data. Deletion requests enter a 14-day grace period during which they can be cancelled; after that, Customer Personal Data is permanently deleted from active systems.

10.3 Backups. Customer Personal Data in backups maintained by Audon's database Subprocessor will be overwritten or deleted in accordance with that Subprocessor's normal backup cycle. To be confirmed: Neon backup and point-in-time recovery retention period Until then, backups remain protected under this DPA and are not used except to restore the Services.

10.4 Legal retention. Audon may retain Customer Personal Data where required by law, but only for as long as required and only for that purpose, and will continue to protect it under this DPA. Activity log, legal acceptance and billing records are Audon's controller records and are governed by the Privacy Policy.

10.5 Certification. On written request, Audon will confirm in writing that deletion has been completed.

---

11. International transfers

11.1 Locations. Customer Personal Data is processed in the United States (hosting) and may be accessed from the United Arab Emirates (Audon). Annex III states the location of each Subprocessor. Audon does not currently offer data residency in any particular country.

11.2 Transfer mechanisms. To the extent Applicable Data Protection Law requires a transfer mechanism for a transfer of Customer Personal Data between the parties or to a Subprocessor, the parties agree to rely on one of the following, as appropriate:

(a) for transfers subject to the EU GDPR, the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 (the "EU SCCs"), with the applicable module (expected to be Module 2, controller to processor, or Module 3, processor to processor);

(b) for transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (the "UK Addendum"), or the UK International Data Transfer Agreement;

(c) for transfers subject to the UAE PDPL, a transfer ground permitted by the UAE PDPL and its implementing regulations; and

(d) for transfers subject to the Saudi PDPL (pilot customers only), a transfer ground and safeguards permitted by the Saudi PDPL and its regulations on transfer of personal data outside the Kingdom.

11.3 Official texts to be attached. The official texts of any instruments relied on are incorporated by reference and will be attached as Schedule A, completed with the information in Annexes I to III. The parties will not modify the official texts except as those texts permit. To be confirmed: attach official EU SCCs, UK Addendum and any UAE/KSA instruments, and confirm modules, exporter/importer roles and docking

11.4 Precedence. If there is a conflict between this DPA and any attached official transfer instrument, the official instrument prevails.

---

12. Audits and information

12.1 Information. Audon will make available to the Customer, on written request, information reasonably necessary to demonstrate compliance with this DPA, including this DPA, the Security Overview, Annex II, the Subprocessors list and written responses to reasonable security questionnaires.

12.2 Audits. If the information provided is not reasonably sufficient to demonstrate compliance, or where required by a supervisory authority or by Applicable Data Protection Law, the Customer (or an independent auditor bound by confidentiality and reasonably acceptable to Audon) may conduct an audit, no more than once in any 12-month period (except following a Personal Data Breach or regulator request), on at least 30 days' written notice, during normal business hours, in a manner that does not compromise the security of other customers' data. Each party bears its own costs unless the audit reveals a material breach by Audon.

12.3 Subprocessor audits. For Subprocessors, Audon may satisfy audit requests by providing the Subprocessor's available third-party certifications or reports, where they exist.

---

13. CCPA-specific terms

To the extent the CCPA applies, Audon acts as a "service provider". Audon will notify the Customer if it determines that it can no longer meet its obligations under the CCPA, and the Customer may then take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

---

14. Liability, term and general

14.1 Liability. Each party's liability arising out of or in connection with this DPA is subject to the limitations of liability in the Agreement, except to the extent Applicable Data Protection Law or an official transfer instrument provides otherwise.

14.2 Term. This DPA applies for as long as Audon processes Customer Personal Data.

14.3 Precedence. In relation to the processing of Customer Personal Data, this DPA prevails over the Terms of Service if they conflict.

14.4 Governing law. This DPA is governed by the law that governs the Agreement, except where an official transfer instrument requires otherwise. To be confirmed: governing law, dispute forum and venue

14.5 Electronic acceptance. This DPA may be accepted electronically by an authorized user of the Customer (or an Agent authorized by such a user) through the Services or the API. Audon records the document id, version, hash, accepting party, authority statement and timestamp, and makes the accepted version available for download.

---

Annex I — Description of processing

A. List of parties

B. Description of the processing

C. Competent supervisory authority

To be confirmed: competent supervisory authority for SCC/UK Addendum purposes

---

Annex II — Technical and organizational measures

---

Annex III — Subprocessors

Stripe processes billing data as described in the Privacy Policy; it does not process Customer Personal Data as defined in this DPA. GitHub hosts source code only and does not receive Customer Data.