Data Processing Agreement

For personal data that the Customer (or its authorized users) submits to the platform, the Customer is the data controller / data fiduciary and FinPera Inc. ("FinPera") is the data processor. FinPera processes such personal data only on the Customer's documented instructions, including as set out in the Terms of Service and this Agreement.

As controller, the Customer is responsible for the lawfulness of the processing it instructs, including giving data subjects any notice, and obtaining any consent, authorisation or permission, that applicable law, professional rules or tax law requires for their personal data to be processed as described in the Terms of Service - including through AI features, by sub-processors, and outside their country. The Customer confirms this in the AI Processing section of the Terms of Service. FinPera relies on that confirmation and does not verify it.

Subject-matter and duration. FinPera processes personal data on the Customer's behalf in order to provide the modules, features and services the Customer has subscribed to, and any support, security and administration incidental to them, for the duration of the Customer's subscription and for so long afterwards as is necessary to meet the retention obligations described in the Privacy Policy.

The Customer instructs FinPera to carry out all processing necessary or useful to operate the subscribed services. That includes hosting, storage, retrieval, organisation and structuring, transmission, sharing at the Customer's direction, backup and deletion, and the continuous and automatic processing described in the Terms of Service and the AI Processing Notice - reading, indexing, classification, embedding, scenario analysis, scoring, linking, enrichment, benchmarking, monitoring and re-processing - whether or not initiated by a user action, and including data submitted earlier or through another module, together with processing to operate, secure, support and improve the Service.

The Customer determines what it submits, so the categories are those the Customer chooses to put into its workspace. Depending on the Customer's type and the modules it uses, data subjects may include the Customer's own personnel and users, shareholders and option holders, investors and their representatives, portfolio companies and their personnel, clients and client contacts, directors and officers, advisers and professional counterparties, suppliers and other third parties. Personal data may include identity and contact details, role and relationship information, holdings and financial or transactional details, correspondence and documents, and any other personal data contained in material the Customer submits. The Customer is responsible for ensuring it has a valid basis to submit each category, and should not submit special-category or other highly sensitive personal data except where a feature is designed for it.

This Agreement, the Terms of Service and the AI Processing Notice together constitute the Customer's documented instructions in full for the purposes of applicable data-protection law. The Customer confirms that the processing they describe is instructed by it, and that it has the authority and a valid basis to give those instructions for all personal data it submits. FinPera processes personal data only on those instructions or as required by law.

The Customer authorizes FinPera to engage the sub-processors listed at finpera.ai/legal/sub-processors. FinPera requires each sub-processor to process personal data only for the contracted service and subject to confidentiality, security and privacy terms appropriate to the service - whether through an executed data-processing agreement, the provider's standard data-processing terms, or equivalent contractual terms. Sub-processors include FinPera's group companies, which may support and maintain the Service remotely as described on that page. FinPera will update that list when it adds a new sub-processor, maintains and updates its sub-processor records, and remains responsible for its sub-processors' performance.

FinPera may add, replace, or remove sub-processors to maintain, secure, improve, or scale the Service. FinPera will give notice of a new sub-processor by updating the sub-processor page and, for Customers who have asked to be notified, by email to the account owner. The objection period runs from that notice. If the Customer has a reasonable data-protection objection to a new sub-processor, the Customer must notify FinPera through the legal, data and privacy request form within fifteen (15) days after that notice. The parties will work in good faith on a commercially reasonable mitigation. If no mitigation is reasonably available, the Customer may stop using the affected feature.

FinPera maintains technical and organizational measures of the kind described at finpera.ai/security, which may change provided the overall level of protection is not materially reduced. Redaction, masking, and anonymisation controls are applied on a best-efforts basis to values held in fields classified as sensitive, where available and appropriate for the relevant feature, file type, customer configuration, and processing context. Those controls operate on structured fields and do not extend to the contents of a document the Customer uploads, which is processed substantially as supplied; the Customer is responsible for what it submits. Descriptions of security measures are for information and are not a warranty; FinPera's commitments are those in this Agreement and the Terms of Service.

Customer responsibilities. The Customer is responsible for who it invites and what roles it gives them; enabling multi-factor authentication for its users; removing access when someone leaves; the security of its own devices and networks; what it uploads and shares; obtaining any client or engagement authorisation needed before AI is used on client data; and keeping its own copies of important records.

No protected health information. The Service is not designed for protected health information. The Customer must not upload protected health information as defined under HIPAA, and FinPera is not a business associate.

FinPera will notify the Customer without undue delay after becoming aware of a personal-data breach affecting the Customer's data, and will provide the information the Customer reasonably needs to meet its own notification obligations.

Taking into account the nature of processing, FinPera will assist the Customer by appropriate technical and organizational measures - and through the platform's export and erasure tooling - to respond to data-subject requests for access, correction, erasure, portability, objection and restriction.

On termination, FinPera will, at the Customer's choice and through available export or deletion tooling, delete or return the Customer's personal data, except where retention is required by law, needed for security, billing, audit, dispute resolution, backup cycles, or legal holds, or otherwise permitted under the Terms of Service.

FinPera is established in the United States and processes personal data there and in the locations of the sub-processors listed at /legal/sub-processors, so personal data may be transferred to and processed in countries other than the one it was collected in. This includes remote access from India by personnel of FinPera's group company who support and maintain the Service, while the data remains hosted with the infrastructure providers listed on that page. Where a transfer requires a specific safeguard under applicable law, FinPera relies on the mechanism available for that transfer - for example Standard Contractual Clauses, an adequacy or equivalence decision, the Customer's own consent or contractual arrangement, or another lawful transfer basis - and imposes confidentiality, security and privacy terms on each sub-processor appropriate to the service. The Customer acknowledges that it determines what it submits and is responsible for ensuring that submitting it is lawful in the territories relevant to the Customer and its data subjects.

AI providers may change their models, endpoints, retention settings, safety-review processes, abuse-monitoring practices, and legal terms. FinPera will use commercially reasonable efforts to select appropriate commercial or enterprise configurations. FinPera does not use Customer content to train AI models, and does not authorise its AI providers to train on it, unless the Customer agrees otherwise in writing. Customer acknowledges that provider terms may vary by provider, model, endpoint, region, and account configuration, and should review the provider links on the sub-processor page for the current provider position.

Where the Customer stores or processes US tax return information in the Service, FinPera acts as a provider of auxiliary services to the Customer for the purposes of Internal Revenue Code section 7216 and its regulations, and uses and discloses that information only to provide, maintain, secure and support the Service for the Customer, and as those regulations otherwise permit. FinPera does not use Customer content to train AI models, for advertising, or for its own analytics on the content itself. FinPera's personnel who support the Service are located outside the United States; our practice is not to access workspace content except in a support session the Customer approves. Before approving such a session for a workspace containing US tax return information, the Customer is responsible for obtaining any taxpayer consent section 7216 requires, including the consent rules that apply to disclosure outside the United States and the restrictions on disclosing Social Security numbers that way. The Customer remains responsible for its own obligations under section 7216, the FTC Safeguards Rule, and professional confidentiality rules (for example, AICPA ET 1.700.040), including its own written information security plan. See the AI Processing section of the Terms of Service for the fuller version of this clause.

Where FinPera processes personal information for the Customer that is subject to the California Consumer Privacy Act or a similar United States state privacy law, FinPera acts as a service provider or processor and will not: sell or share that personal information; retain, use or disclose it for any purpose other than the business purpose of providing the Service, or outside the direct business relationship with the Customer, except as those laws permit; or combine it with personal information it receives from or on behalf of another person, or collects from its own interactions with the individual, except as those laws permit. FinPera certifies that it understands these restrictions and will comply with them, and will notify the Customer if it determines it can no longer meet its obligations under those laws.

Standard accounts. FinPera will make available the information reasonably necessary to demonstrate compliance with this Agreement. For all Customers, that obligation is satisfied by FinPera providing written responses to a reasonable security or privacy questionnaire, a security summary, and any certification or third-party report FinPera holds at the time. This is the Customer's sole audit right unless the paragraph below applies.

Where the Customer's aggregate fees payable to FinPera exceed USD 250,000, or its equivalent in the currency invoiced at the exchange rate on the date of the request, either in the preceding twelve months or as committed under the Customer's current subscription term, the Customer may additionally request one audit in any twelve-month period, on at least thirty (30) days' prior written notice, subject to: reasonable scope agreed in advance and limited to the processing carried out under this Agreement; a written confidentiality undertaking from the Customer and any auditor; an auditor who is independent, suitably qualified, and not a competitor of FinPera; conduct during business hours and in a manner that does not disrupt the Service or compromise the confidentiality or security of any other customer's data; and the Customer bearing its own and FinPera's reasonable costs. FinPera may satisfy such a request through the materials described above where they reasonably address the Customer's questions. On-site attendance, access to infrastructure, and any penetration or intrusive testing require FinPera's prior written agreement and may be refused where they would create security, confidentiality, or service risks. Where an audit is required by a supervisory authority or by mandatory law, FinPera will co-operate to the extent that law requires, regardless of the threshold above.

If this Agreement conflicts with the Terms of Service, this Agreement controls only for personal-data processing obligations required by applicable data-protection law. The Terms of Service control for fees, suspension, acceptable use, disclaimers, limitation of liability, indemnity, dispute resolution, and all non-data-processing matters.

Disputes arising out of or in connection with this Agreement are resolved under the dispute-resolution clause in the Terms of Service - including its informal-resolution step, its arbitration agreement, and its carve-outs. This Agreement does not have a separate venue, forum, or arbitration provision of its own.