Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the agreement between you ("Customer") and Onlo AI Inc. ("Onlo", "Company") governing Customer's use of the Service (the "Agreement"), and applies wherever Onlo processes personal data on Customer's behalf. Terms not defined here have the meaning given in the Agreement.

1. Roles of the parties

With respect to personal data submitted to the Service by Customer or Customer's end users, Customer is the controller and Onlo is the processor. Customer shall ensure it has a lawful basis for the personal data it submits and for any instructions it gives Onlo regarding that data.

2. Processing instructions

Onlo will process personal data only on Customer's documented instructions, which are deemed to include processing necessary to provide, maintain, secure and support the Service, and as otherwise required by applicable law. Onlo will inform Customer if, in its opinion, an instruction infringes applicable data protection law.

3. Confidentiality

Onlo ensures that personnel authorized to process personal data are bound by confidentiality obligations, whether contractual or statutory, and access is limited to what is necessary to provide the Service.

4. Sub-processors

Customer provides general authorization for Onlo to engage sub-processors to support the Service, such as hosting and messaging infrastructure providers. Onlo remains responsible for each sub-processor's performance of its data protection obligations. A current list of sub-processors is available on request to privacy@onlo.ai, and we'll give reasonable notice before adding a new one, so Customer can object on legitimate data protection grounds.

5. Security measures

Onlo maintains technical and organizational measures appropriate to the risk, including encryption of data in transit and at rest, access controls and multi-factor authentication for production systems, network segmentation, logging and monitoring, and regular review of security practices.

6. International transfers

Where personal data is transferred out of the European Economic Area, the United Kingdom or Switzerland, Onlo relies on the European Commission's Standard Contractual Clauses (or the UK equivalent) as the transfer mechanism, incorporated into this DPA by reference, together with any supplementary measures required by applicable law.

7. Assistance with data subject rights

Taking into account the nature of the processing, Onlo will assist Customer, insofar as reasonably possible, in responding to requests from data subjects exercising their rights under applicable data protection law. If Onlo receives such a request directly, it will direct the individual to submit it to Customer.

8. Personal data breaches

Onlo will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer's personal data, and will provide reasonable information to help Customer meet any notification obligations it has to regulators or affected individuals.

9. Audits

Onlo will make available information reasonably necessary to demonstrate compliance with this DPA, including relevant security documentation, and will allow for audits, including inspections, conducted by Customer or an auditor Customer appoints, subject to reasonable advance notice and confidentiality safeguards.

10. Deletion and return of data

On termination of the Agreement, Onlo will, at Customer's choice, delete or return personal data processed on Customer's behalf, except to the extent applicable law requires continued storage.

11. Term

This DPA remains in effect for as long as Onlo processes personal data on Customer's behalf under the Agreement, and terminates automatically when the Agreement ends and all personal data has been deleted or returned in accordance with Section 10.