Data Processing Addendum

This Data Processing Addendum (“DPA”) is incorporated into the Urdi Terms of Service (the “Agreement”) between Urdi, Inc. (“Urdi,” “we,” “us”) and the customer (“Customer,” “you”) and applies to the extent Customer Content includes personal data protected by Data Protection Law.

1. Definitions

“Data Protection Law” means all laws applicable to the processing of personal data under the Agreement, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss FADP, and applicable US state privacy laws. “Customer Personal Data” means personal data contained in Customer Content. “SCCs” means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914. Terms like “controller,” “processor,” “data subject,” “personal data,” and “processing” have the meanings given in Data Protection Law. Capitalized terms not defined here have the meanings in the Agreement.

2. Roles

For Customer Personal Data, Customer is the controller (or a processor acting on behalf of another controller) and Urdi is the processor. Each party will comply with its own obligations under Data Protection Law. Customer is responsible for the accuracy and lawfulness of Customer Personal Data, for having a valid legal basis, and for providing all notices and obtaining all consents required for Urdi’s processing described in this DPA, including for data ingested from Connected Services (such as email content, contact data, and meeting transcripts) that relates to people other than Customer’s own users. Urdi acts as an independent controller for the account, billing, usage, security, customer-identity, and marketing data described in our Privacy Policy, including when Urdi uses Customer Identity Materials for its own business, advertising, publicity, or promotional purposes under Section 11.2 of the Agreement. This DPA does not govern that independent-controller processing.

3. Processing instructions

Urdi will process Customer Personal Data to provide, secure, support, and improve the Services, to develop, train, evaluate, and improve Urdi’s models, features, and machine-learning systems, and to create and use aggregated and de-identified data, and otherwise on Customer’s documented instructions. Those instructions consist of the Agreement, this DPA, Customer’s configurations in the Services (including connector scopes, agent settings, and approvals), and any other written instructions the parties agree to. Customer instructs and authorizes the processing described in this DPA and the Agreement, including the uses of Customer Content set out in the Terms of Service and Privacy Policy. Urdi will inform Customer if, in its opinion, an instruction infringes Data Protection Law, and will notify Customer (unless legally prohibited) if it is required by law to process Customer Personal Data other than per instructions. Urdi will not attempt to re-identify data it has de-identified, and will not use information received from Google APIs to train generalized AI or machine-learning models.

4. Nature and details of processing

• Subject matter and duration: providing the Services for the term of the Agreement, plus the deletion period in Section 10.
• Nature and purpose: hosting, storage, synchronization, indexing, transformation, display, transmission, publication and distribution of Customer Application Materials as authorized by the Agreement, AI-assisted analysis and generation, automated actions configured by Customer, model development, training, and evaluation, and product analytics and improvement.
• Categories of data subjects: Customer’s users and personnel; Customer’s customers, prospects, and business contacts; participants in communications and meetings ingested by Customer (email correspondents, meeting attendees); end users of Customer Applications.
• Categories of personal data: identification and contact data; professional data; communications content and metadata (email, chat, calendar); CRM records; meeting notes and transcripts; files and documents; credentials Customer elects to store; usage and log data. Customer is responsible for not submitting special categories of data except as permitted by the Agreement.

5. Confidentiality

Urdi ensures that personnel authorized to process Customer Personal Data are bound by contractual or statutory confidentiality obligations and access it only as needed to perform under the Agreement.

6. Security

Urdi maintains appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art and the risks of the processing, including the measures in Section 14 (Security measures) below. Urdi may update these measures provided the overall level of protection is not materially reduced.

7. Subprocessors

Customer provides general written authorization for Urdi to engage subprocessors within the categories published at /subprocessors, and acknowledges that Urdi may add, replace, or remove providers within those categories at any time without individual notice. Urdi will update that page before subprocessors in a new category of processing begin processing Customer Personal Data and, where offered, will notify subscribed customers by email. Customer may object to a new category within 30 days of the update on reasonable, data-protection-related grounds; the parties will discuss in good faith, and if no resolution is found Customer may terminate the affected subscription and receive a pro-rata refund of prepaid, unused fees. This is Customer’s sole and exclusive remedy for subprocessor objections. Urdi will impose data protection obligations on subprocessors materially no less protective than this DPA and remains liable for its subprocessors’ performance as if it were its own.

8. Assistance

Taking into account the nature of the processing, Urdi will provide reasonable assistance to Customer (including through the functionality of the Services) with: responding to data subject requests; security of processing; personal data breach notifications; data protection impact assessments; and prior consultations with supervisory authorities. If a data subject contacts Urdi directly about Customer Personal Data, Urdi will (where identifiable) refer them to Customer. Customer will reimburse Urdi’s commercially reasonable costs for assistance beyond the Services’ built-in functionality, notified in advance.

9. Personal data breach

Urdi will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably available to Urdi as it becomes known, take reasonable steps to contain and remediate the breach, and cooperate with Customer’s reasonable notification obligations. Urdi’s notification of or response to a breach is not an acknowledgment of fault or liability. Customer is solely responsible for notifying supervisory authorities and data subjects where it is the controller, and for breaches arising from its own configurations, credentials, users, Customer Applications, or Connected Services.

10. Deletion and return

Upon termination or expiry of the Agreement, Urdi will, at Customer’s election made within 30 days, delete or return Customer Personal Data, and will in any event delete it within 90 days of termination, except for (a) copies in encrypted backups, which are securely isolated, protected from further processing, and deleted in the ordinary backup cycle, and (b) data Urdi must retain under applicable law, which remains protected by this DPA.

11. Audits

Urdi will make available information reasonably necessary to demonstrate compliance with this DPA. Urdi may satisfy audit requests by providing, on a confidential basis, its most recent security documentation, questionnaire responses, and third-party audit reports or certifications (such as SOC 2 or penetration-test summaries, when available). Where Data Protection Law grants Customer a mandatory audit right that these materials do not satisfy, Customer may conduct an audit no more than once per calendar year (unless required by a supervisory authority or following a material breach), during business hours, on at least 30 days’ notice, at Customer’s expense, under confidentiality obligations, and without unreasonable disruption to Urdi’s operations.

12. International transfers

The Services are not directed to or offered to persons in the European Economic Area, the United Kingdom, or Switzerland. However, if and to the extent the processing nonetheless involves a transfer of Customer Personal Data protected by EU, UK, or Swiss Data Protection Law to a country without an adequacy decision (including transfers to Urdi in the United States), the parties incorporate the SCCs by reference as follows: Module Two (controller → processor) where Customer is a controller and Module Three (processor → processor) where Customer is a processor; Clause 7 (docking) included; Clause 9 Option 2 (general authorization, 30 days); Clause 17 governed by Irish law; Clause 18 courts of Ireland; the annexes are deemed completed with the details in this DPA (Sections 4, 6, 7 and 14). For UK transfers, the UK International Data Transfer Addendum applies with the corresponding details; for Swiss transfers, the SCCs apply as adapted per FDPIC guidance. If the SCCs conflict with this DPA, the SCCs prevail.

13. Liability

Each party’s liability arising out of or related to this DPA (including the SCCs) is subject to the exclusions and limitations of liability in the Agreement, and liability under the Agreement and this DPA together is subject to a single aggregate cap, provided that nothing limits either party’s liability with respect to any individual’s data protection rights or any liability that cannot be limited under Data Protection Law.

14. Security measures

Urdi maintains, at minimum, the following technical and organizational measures:

• Encryption in transit: industry-standard transport encryption for data in transit between clients, the Services, and subprocessors.
• Encryption at rest: industry-standard encryption at rest for stored data, with additional envelope encryption using versioned keys for stored credentials and secrets, and encrypted storage of cached communications content.
• Authentication and credentials: passwords stored using industry-standard one-way salted hashing; API and access tokens stored in hashed or encrypted form; support for scoped, revocable tokens.
• Access control: role-based access with account- and workspace-level scoping; integration grants scoped to specific resources selected by the customer; tenant isolation enforced and tested.
• Logging and monitoring: audit logging of agent, automation, and system activity; security event monitoring.
• Availability and resilience: encrypted backups stored in access-restricted storage; documented restore procedures.
• Organizational measures: least-privilege access for personnel; confidentiality obligations; vendor security review; secure development practices; incident response procedures supporting the notification commitments in Section 9.

15. Contact

Questions about this DPA go to privacy@urdi.ai or legal@urdi.ai.