Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service and any Customer Agreement between you ("Customer", "Controller", or "you") and Pingstreams ("Processor", "we", "us", or "our"). This DPA governs the processing of Personal Data by Pingstreams on behalf of Customer in connection with the provision of the Services.

This DPA applies where and to the extent that Pingstreams processes Personal Data on behalf of Customer as a Processor in the provision of the Services, and such Personal Data is subject to Data Protection Laws including the EU General Data Protection Regulation (GDPR), UK GDPR, or similar privacy legislation.

2. Definitions

• Personal Data means any information relating to an identified or identifiable natural person that is processed by Pingstreams on behalf of Customer in the course of providing the Services.
• Data Protection Laws means all applicable laws and regulations relating to privacy and data protection, including GDPR, UK GDPR, CCPA, and equivalent legislation.
• Controller, Processor, Data Subject, Processing, and Sub-processor have the meanings given in applicable Data Protection Laws.
• Services means Pingstreams' AI-powered omnichannel customer service platform and related services as described in the Terms of Service.
• Standard Contractual Clauses or SCCs means the standard data protection clauses for the transfer of personal data to third countries approved by the European Commission or equivalent authority.

3. Roles and Scope

Customer is the Controller of Personal Data and determines the purposes and means of Processing. Pingstreams is the Processor and processes Personal Data only on behalf of and in accordance with Customer's documented instructions.

The subject matter, duration, nature, and purpose of Processing, as well as the types of Personal Data and categories of Data Subjects, are described in Annex A below.

4. Customer Instructions and Processing

Pingstreams will process Personal Data only on documented instructions from Customer, unless required to do so by applicable law. The primary instruction is to provide the Services in accordance with the Terms of Service and this DPA.

If Pingstreams believes any instruction violates Data Protection Laws, we will promptly inform Customer. Pingstreams is not responsible for compliance with Data Protection Laws applicable to Customer's industry or use case that are outside Pingstreams' reasonable control.

5. Security Measures

Pingstreams implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of Personal Data in transit and at rest where appropriate.
• Measures to ensure ongoing confidentiality, integrity, availability, and resilience of systems and services.
• Regular testing, assessment, and evaluation of the effectiveness of technical and organizational measures.
• Access controls and authentication mechanisms.
• Incident response and breach notification procedures.

A description of current security measures is available upon request or documented in our Security Practices documentation.

6. Sub-processors

Customer authorizes Pingstreams to engage Sub-processors to process Personal Data. A current list of Sub-processors is available at pingstreams.com/subprocessors or upon request.

Pingstreams will notify Customer of any intended changes to Sub-processors (additions or replacements) and provide Customer an opportunity to object to such changes. If Customer reasonably objects within 30 days, Pingstreams will either not use the new Sub-processor or work with Customer to find an alternative solution, which may include termination of the affected Services.

Pingstreams ensures that Sub-processors are bound by data protection obligations substantially similar to those in this DPA and remains liable for Sub-processor performance.

7. Data Subject Rights

Pingstreams will, to the extent legally permitted, promptly notify Customer if it receives a request from a Data Subject to exercise their rights under Data Protection Laws (access, rectification, erasure, restriction, portability, or objection).

Pingstreams will provide reasonable assistance to Customer in fulfilling its obligations to respond to Data Subject requests, taking into account the nature of the Processing. Customer is responsible for responding to Data Subject requests.

8. Data Breach Notification

Pingstreams will notify Customer without undue delay (and in any event within 72 hours) after becoming aware of a Personal Data breach affecting Customer Data. The notification will include available information to enable Customer to meet any data breach reporting obligations.

Pingstreams will cooperate with Customer and take reasonable steps to remediate the breach and mitigate its effects. Notification will be delivered to Customer's designated security or privacy contact email.

9. Data Retention and Deletion

Pingstreams will retain Personal Data for the duration necessary to provide the Services and as instructed by Customer. Upon termination or expiration of the Services, Pingstreams will (at Customer's choice):

• Delete all Personal Data in accordance with our standard deletion procedures (typically within 90 days), or
• Return Personal Data to Customer in a commonly used format, subject to technical feasibility.

Pingstreams may retain Personal Data to the extent required by applicable law, and such retained data will remain subject to this DPA.

10. Audits and Compliance

Pingstreams will make available to Customer information necessary to demonstrate compliance with this DPA and allow for and contribute to audits and inspections.

Customer may conduct audits (including inspections) no more than once per year, upon reasonable notice, during business hours, and in a manner that does not unreasonably interfere with Pingstreams' operations. Audits may be conducted by an independent third-party auditor bound by confidentiality.

Customer will be responsible for the costs of any audit unless the audit reveals material non-compliance by Pingstreams.

11. International Transfers

Customer acknowledges that Pingstreams may transfer and process Personal Data globally, including to countries outside the European Economic Area (EEA), United Kingdom, or Customer's jurisdiction.

Where such transfers occur, Pingstreams will ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent authority.
• Adequacy decisions by relevant data protection authorities.
• Other lawful transfer mechanisms under applicable Data Protection Laws.

Upon request, Pingstreams will provide Customer with copies of executed SCCs or documentation of other transfer mechanisms.

12. Limitation of Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set forth in the Terms of Service. Nothing in this DPA reduces either party's liability under Data Protection Laws.

13. Term and Termination

This DPA will remain in effect for as long as Pingstreams processes Personal Data on behalf of Customer. Upon termination of the Services, the data deletion and return provisions of Section 9 will apply.

14. Contact

For DPA-related questions, data subject requests, or to report data breaches, contact:

privacy@pingstreams.io

legal@pingstreams.io

Annex A: Details of Processing

Subject Matter

Provision of Pingstreams' AI-powered omnichannel customer service platform and related services.

Duration

The term of the Customer Agreement or until all Personal Data is deleted or returned.

Nature and Purpose

Processing of Personal Data necessary to provide customer service, communication routing, AI-powered assistance, chatbot functionality, analytics, and related platform features as directed by Customer.

Types of Personal Data

• Contact information (names, email addresses, phone numbers)
• Customer identifiers and account information
• Communication content (messages, chat transcripts, attachments)
• Technical data (IP addresses, device information, timestamps)
• Any other Personal Data submitted by Customer or end users through the Services

Categories of Data Subjects

• Customer's end-user customers and support contacts
• Customer's employees and authorized users
• Other individuals whose Personal Data is processed through the Services