This Data Processing Addendum ("DPA") is part of the YottaBot Business Terms and the YottaBot Enterprise SaaS Terms (the "Agreement") between YottaBot Inc. ("YottaBot") and the customer ("Customer"). It applies when YottaBot processes personal data in Customer Content on Customer's behalf in the YottaBot cloud service. Terms not defined here have the meanings in the Agreement. If this DPA conflicts with the Agreement, this DPA controls for personal data.
1. Roles
Customer is the controller, or a processor acting for its own controller, of personal data in Customer Content. YottaBot is Customer's processor and, under California law, its service provider.
2. Instructions
YottaBot processes personal data only on Customer's documented instructions, which are the Agreement, this DPA, and Customer's use and configuration of the Services, unless the law requires otherwise. YottaBot will tell Customer if it believes an instruction violates the law.
YottaBot does not sell or share Customer's personal data, retain, use, or disclose it outside the direct business relationship with Customer, or combine it with other data except as the law allows for a service provider.
3. Confidentiality and Personnel
YottaBot ensures that people authorized to process personal data are bound by confidentiality obligations and access it only as described in the SaaS Privacy Policy's section on staff, support, and operational access.
4. Security
YottaBot maintains technical and organizational measures designed to protect personal data, including access control, encryption in transit, short-lived credentials, audit logging, and the isolation described in the SaaS Privacy Policy.
5. Subprocessors
Customer authorizes the subprocessors listed on the YottaBot Subprocessors page. YottaBot will update that page before a new subprocessor processes personal data and will impose data-protection terms on each subprocessor no less protective than this DPA. Customer may object to a new subprocessor on reasonable data-protection grounds by emailing support@yotta.bot.
6. Assistance
Taking into account the nature of the processing, YottaBot will reasonably assist Customer with requests from individuals exercising their rights, and with data-protection impact assessments and consultations with authorities where required.
7. Personal Data Breaches
YottaBot will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer's personal data, and will provide the information Customer reasonably needs to meet its own obligations.
8. Deletion and Return
When the Agreement ends, YottaBot will delete Customer's personal data in the Services as described in the SaaS Privacy Policy's data retention section, unless the law requires it to be kept. Customer may export its data before the Agreement ends where the Services allow.
9. Audits
YottaBot will make available information reasonably needed to demonstrate compliance with this DPA, such as security documentation and summaries of third-party assessments when available. Further audits may be agreed in writing at Customer's expense, with reasonable notice and confidentiality.
10. International Transfers
Where personal data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, the parties agree to the applicable Standard Contractual Clauses, which are incorporated by reference.