Data Processing Addendum

Parties, scope, and order of precedence

This Addendum forms part of the completed UserGist service agreement only when validly accepted by the identified customer and the legal operator of UserGist. The customer acts as controller, or as a processor with authority from its controller; UserGist acts as processor or subprocessor for the customer personal data described in Schedule A. Separate controller activities are described in the Privacy Policy.

“Applicable data protection law” means the privacy law that applies to the relevant processing, including GDPR, UK GDPR, Swiss law, Israeli privacy law, and US state privacy law where applicable. “Personal data breach” means a security breach involving accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to that personal data.

Mandatory transfer clauses prevail over this Addendum, which prevails over conflicting service terms on customer personal data. This draft is not a signed DPA and does not itself complete a cross-border transfer instrument.

Documented instructions and purpose limits

UserGist will process customer personal data only to provide and secure the contracted service, follow the customer’s documented instructions, and comply with law. The agreement, enabled features, customer configurations, authorised API/MCP requests, and authenticated export/deletion requests document those instructions. Additional instructions must be lawful and within the agreed scope or separately agreed.

UserGist will inform the customer if it believes an instruction infringes applicable data protection law and may pause that instruction while the issue is resolved. If law requires other processing, UserGist will notify the customer before processing unless legally prohibited. UserGist will not sell the data, use it for cross-context behavioural advertising, or use it to train a general-purpose model under this proposed Addendum.

Customer responsibilities

• Establish a lawful basis, provide clear notices, and obtain and record consent where needed. Handle consent withdrawal and individual rights requests.
• Collect only the data needed, configure access and retention, and avoid prohibited sensitive data or children’s data without a separate written arrangement.
• Keep management tokens, identity-signing credentials, push credentials, integrations, and device permissions secure. Give UserGist accurate instructions and authorised contacts.
• If acting as a processor, obtain the controller’s authority for this subprocessing and communicate the relevant controller obligations and restrictions.

Confidentiality and security

UserGist will ensure authorised personnel are subject to appropriate confidentiality obligations and access only what is necessary for their duties. It will maintain technical and organisational measures appropriate to the nature, scope, context, risks, and state of the art of the processing.

Schedule B identifies product controls and operational measures to be verified before execution. UserGist must not materially reduce the agreed protection during the processing term. A vendor certification is not a certification of UserGist itself.

Subprocessors and changes

The customer authorises only the subprocessors and processing activities included in the completed register and any subsequently authorised changes. UserGist will impose appropriate written data protection obligations on its subprocessors and remain responsible for their performance as required by applicable law.

The proposed change process gives the customer at least thirty days’ prior written notice of a new or replacement subprocessor, with its function and location, and an opportunity to object on reasonable data protection grounds. The parties will seek a reasonable alternative; if none is available, the customer may terminate the affected service without a penalty for that termination and receive any agreed refund for unused prepaid service.

The final notice channel, objection process, and customer contact list must be established before this commitment becomes effective. Publishing a page alone does not establish that customers received notice. Customer-selected destination services are distinguished from vendors engaged by UserGist.

Individual rights, impact assessments, and regulators

Taking into account the processing and information available, UserGist will assist the customer with access, correction, erasure, restriction, portability, objections, security obligations, data protection impact assessments, and required consultations with authorities. It will forward a request concerning customer data to the customer without undue delay and not independently decide its merits unless law requires it.

Available technical assistance includes app-scoped export and deletion for anonymous or identified SDK subjects. Portal identities, account records, downstream vendors, backups, and other data require the applicable operational process. UserGist must not mark a request fully resolved merely because one database operation or API acknowledgement succeeded.

Any fees for assistance beyond ordinary service support must be reasonable, disclosed, and agreed in advance, and must not obstruct statutory obligations. The customer remains responsible for its decisions and response to the individual or authority.

Personal data breaches

UserGist will notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data. It will provide available information on the incident, affected categories and approximate scale, likely consequences, measures taken or proposed, and a contact for follow-up. Information may be provided in phases when not initially available.

UserGist will take appropriate containment and remediation steps, preserve relevant evidence, and cooperate with the customer’s required notifications. The customer determines its own regulator and individual notices unless law requires otherwise. A proposed internal notification target and escalation rota must be validated before any additional fixed-hour contractual promise is made.

Restricted transfers and government requests

UserGist must not make a restricted transfer without a lawful mechanism appropriate to the parties, the data, and the destination. Before execution, the parties must identify whether adequacy applies or complete the appropriate European Commission standard contractual clauses, UK Addendum or IDTA, Swiss adaptations, and transfer assessment as needed.

For an applicable controller-to-processor transfer, assess Module Two; for a processor-to-subprocessor transfer, assess Module Three. The correct instrument also depends on the importer’s GDPR status. Complete party details, competent authority, governing law, courts, processing description, security measures, and subprocessor information rather than treating an uncompleted reference as an executed annex.

UserGist will review compulsory access requests, challenge unlawful or disproportionate requests where legally possible, minimise disclosures, and notify the customer unless prohibited. It will document the assessment and any supplementary protections required for an authorised transfer.

Information, audits, and compliance

UserGist will make information needed to demonstrate compliance available and allow and contribute to customer or independent auditor inspections as required by applicable law. Routine audits may use current documentation first and reasonable notice and confidentiality arrangements, without excluding necessary inspections after an incident, a regulatory request, or a credible compliance concern.

Audits must protect other customers’ information and service security. Frequency or cost arrangements cannot remove mandatory rights. If UserGist can no longer meet its obligations, it will promptly inform the customer and cooperate in stopping or remedying the affected processing.

Return, deletion, and end of processing

At the customer’s choice, UserGist will return or delete customer personal data at the end of the service and delete remaining copies unless law requires retention. The parties must complete an achievable return period, active-system deletion deadline, backup expiry, and downstream deletion procedure in the executed schedule.

Data retained solely because of legal obligations will be isolated, protected, used only for that obligation, and deleted when it ends. Backups must remain protected and expire under the agreed schedule; restored data must have prior deletion instructions reapplied. UserGist will provide reasonable confirmation of completion when requested.

A billing cancellation does not replace the customer’s instruction to delete. The current code does not establish universal deletion deadlines for every storage or vendor. Those open operational items must be closed before the DPA is made effective.

US service-provider and processor terms

Where applicable US state law requires a service-provider, contractor, or processor agreement, UserGist will process personal information for the specified business purposes in Schedule A, under the customer’s instructions, and provide the legally required level of protection. It will not sell or share the information for covered advertising purposes or retain, use, disclose, or combine it outside the permitted purposes and relationship, except as law permits.

The customer may take reasonable steps to verify compliance and stop or remediate unauthorised use. UserGist must inform the customer if it cannot comply, assist with applicable consumer requests and assessments, and apply equivalent obligations to permitted subprocessors. The parties must confirm the relevant state definitions, coverage, and required certifications before execution.

Schedule A · Description of processing

Schedule B · Security measures

• Product controls: authenticated operator access, app/workspace authorisation, scoped SDK subject tokens, consent gates, property filtering, audit records, and protected private exports.
• Credential protection: application-level AES-256-GCM encryption for configured integration/push credentials, versioned keys, and separation of public write keys from management authority.
• Transport/storage: production HTTPS enforcement and host-specific secure cookies where implemented; verify private service links, bucket access, vendor at-rest encryption, SDK storage fallbacks, and key administration before execution.
• Operational measures requiring evidence: staff access/MFA and confidentiality, onboarding/offboarding, patching, vulnerability management, incident response, backup/restore and re-deletion, vendor reviews, retention checks, and regular access reviews.
• Do not insert unverified claims of SOC 2, ISO 27001, HIPAA certification, universal certificate pinning, a per-app KMS envelope scheme, or encrypted storage on every SDK platform.

Execution and outstanding annex details

Before signature or electronic acceptance, complete the legal parties and addresses, authorised signatories, customer contacts, approved vendor locations and agreements, final security measures, return/deletion schedule, and any mandatory transfer instruments. Record the accepted document version and date. This page’s draft label must not be removed until that work is complete.

Contact [email protected] with the subject “Privacy request” or “Legal request”, as appropriate. Do not send passwords, API keys, payment card numbers, or identity documents in an initial message.