DPA in two columns.

“Applicable Data Protection Law” means GDPR (Regulation 2016/679), UK GDPR, the Swiss FADP, CCPA / CPRA, and any other privacy or data-protection law applicable to a party’s processing of Personal Data under this DPA.

“Customer Data” means Personal Data that Customer or Customer’s Authorised Users submit to or generate within the Service. “Service” means the Pulse hosted platform, MCP server, connectors, Skills runtime, and any related software made available to Customer under the Agreement.

Customer is the Controller of Customer Data. Pulse is the Processor. Where Customer is itself a processor for an upstream controller, Pulse is a sub-processor and the obligations in this DPA flow through accordingly.

Pulse will Process Customer Data only (a) to provide and improve the Service for Customer; (b) on documented instructions from Customer; (c) as required by Applicable Law, in which case Pulse will inform Customer prior to processing unless prohibited.

The subject-matter, nature, and purpose of processing, the categories of Data Subjects, and the categories of Personal Data are set out in Annex I (Processing Details).

Processing continues for the term of the Agreement plus the Wind-Down Period (30 days from termination).

Customer warrants that it has all rights, consents, and lawful bases necessary to authorise Pulse’s processing of Customer Data as contemplated by the Agreement.

Pulse personnel authorised to process Customer Data are under written confidentiality obligations that survive termination of employment.

Taking into account the state of the art, Pulse implements the technical and organisational measures set out in Annex II (TOMs) to ensure a level of security appropriate to the risk.

Pulse may update its TOMs from time to time, provided the updated TOMs do not materially decrease the protection of Customer Data.

Customer authorises Pulse to engage Sub-processors to process Customer Data, subject to the conditions in this Clause 6 and the list in Annex III. Pulse will impose data-protection terms on Sub-processors no less protective than this DPA.

Pulse remains fully liable for the acts and omissions of its Sub-processors as if they were its own.

Where Pulse transfers Personal Data from the EEA, Switzerland, or the UK to a country not subject to an adequacy decision, the parties incorporate the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) and the UK International Data Transfer Addendum (Version B1.0).

Customer is the data exporter; Pulse is the data importer. Annex I, II, and III of this DPA serve as Annex I, II, and III of the SCCs.

Pulse provides Customer with the means, through the Service, to fulfil requests from Data Subjects to exercise rights under Applicable Data Protection Law.

Where a Data Subject contacts Pulse directly, Pulse will refer them to Customer, unless legally required to respond.

Pulse will notify Customer without undue delay and in any event within 24 hours of becoming aware of a Personal Data Breach affecting Customer Data, providing the information required by Article 33(3) GDPR to the extent then known.

Pulse will make available to Customer information reasonably necessary to demonstrate compliance with this DPA. The current pack includes the architecture overview, threat model, sub-processor list, and applicable controls documentation. SOC 2 Type II and ISO 27001 reports will be added once those audits are complete.

Where Customer reasonably requires further information or an on-site audit, Pulse will accommodate one audit per twelve-month period during business hours, on at least 30 days’ notice.

At the end of the Wind-Down Period, or earlier on Customer’s written instruction, Pulse will delete Customer Data from production systems within 7 days and from backups within 30 days, providing Customer with a signed deletion certificate.

Liability under this DPA is governed by the Liability section of the Agreement, except that nothing in the Agreement excludes or limits liability where Applicable Data Protection Law prohibits such exclusion or limitation, including liability under Article 82 GDPR.