This Data Processing Agreement ("Agreement") will form part of the Service Agreement between CouldAI ("Data Processor") and the customer entity that accepts this Agreement ("Company" or "Data Controller"). By using CouldAI's services, the Company agrees to be bound by the terms of this Data Processing Agreement.
For questions regarding this Data Processing Agreement or to exercise any rights hereunder, please contact [email protected].
CouldAI shall Process Customer Personal Data only on the Company's documented instructions (including those contained in this Agreement and the Service Agreement) and shall promptly notify the Company if an instruction, in CouldAI's reasonable opinion, violates Applicable Law. CouldAI may refuse, suspend, or propose commercially reasonable alternatives to any instruction it reasonably believes would breach Applicable Law or materially compromise the security, confidentiality, availability, or performance of the Services. This Agreement shall remain in effect for the duration of the Service Agreement.
The Data Processor shall retain Customer Data transmitted through the Service for a maximum of ninety (90) days, after which it will be deleted, except where the Data Processor is required to retain copies under applicable laws, in which case the Data Processor will isolate and protect that Customer Data from any further processing except to the extent required by applicable laws. Data retention periods for other services shall be as specified in the applicable Service Description or Order Form.
The Data Processor shall maintain complete and accurate records of all Processing activities carried out on behalf of the Company as required under Article 30(2) of the GDPR. Such records shall be made available to the Company upon reasonable request and shall include, at minimum:
The Processing comprises the hosting, storage, compilation, scanning, indexing, static and dynamic analysis, AI-assisted generation, and deployment of software-development artifacts (including source code, configuration files, commit history, tickets, comments, and user-profile data) in order to provide, secure, maintain, monitor, and improve the Services
It is the parties' intent that:
The parties expressly acknowledge and agree that:
To the extent the Data Processor's Processing of Customer Personal Data under the Agreement is subject to U.S. Privacy Laws:
The Parties acknowledge that the Data Processor's retention, use and disclosure of personal information authorized by the Company's instructions stated in this Agreement are integral to the Services and the business relationship between the Parties.
The Data Processor:
The Data Processor shall not:
Types of Personal Data: Customer Personal Data may include account identifiers such as names, business-email addresses, usernames, UUIDs and organization IDs; authentication and security information such as hashed passwords, access tokens, multi-factor-authentication status, IP addresses and user-agent strings; development artefacts such as source-code files, commit metadata, pull-request comments, issue-tracker records and attachment filenames; operational telemetry such as build and deployment logs, error traces, performance metrics and usage analytics; collaboration content such as chat threads, review notes, code annotations and other free-text fields supplied by users; and support material, including tickets or diagnostic dumps, voluntarily provided to CouldAI support. Payment data, end-user personally identifiable information or marketing lists are neither required nor expected for normal use of the Services and should not be supplied unless the parties expressly agree otherwise in writing.
Categories of Data Subjects: Developers, engineers, project managers, external contributors or contractors authorized by the Company, and individuals whose personal data is incidentally embedded in code comments, configuration files or other artifacts.
Prohibited Data: The Company shall not upload or provide special-category data under GDPR Article 9, biometric identifiers, children's data below the applicable age threshold, sensitive personal information as defined by the CPRA (e.g., Social-Security numbers or precise geolocation), data governed by sector-specific regimes such as HIPAA, GLBA or PCI-DSS, content subject to export-control or sanctions laws, or any other data whose possession or transfer is unlawful in the relevant jurisdiction, unless CouldAI has given prior written consent and the parties have documented a lawful basis.
The Data Processor agrees to:
a. Process Personal Data only on documented instructions from the Company, including with regard to international data transfers, unless required by law. If CouldAI believes an instruction violates Applicable Law or materially degrades the security or performance of the Services, it will notify the Company and may suspend the relevant Processing until the matter is resolved
b. Not provide the Company with remuneration in exchange for Personal Data from the Company. The parties acknowledge and agree that the Company has not "sold" (as such term is defined by applicable Data Protection Laws) Personal Data to the Data Processor.
c. Not "sell" (as such term is defined by U.S. Privacy Laws) or "share" (as such term is defined by the CCPA) Personal Data, except for internal operations such as security, debugging, or service improvement expressly permitted by Cal. Civ. Code § 1798.140(ad)(2)(A) or equivalent statutes.
d. Not combine any Personal Data with personal data that the Data Processor receives from or on behalf of any other third party or collects from the Data Processor's own interactions with individuals, provided that the Data Processor may combine Personal Data for a purpose permitted under applicable Data Protection Laws if directed to do so by the Company or as otherwise permitted by applicable Data Protection Laws.
e. Ensure that individuals authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
f. Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including, as appropriate:
g. Assist the Company in fulfilling its obligation to respond to Data Subjects' requests to exercise their rights under the GDPR and other applicable Data Protection Laws, including rights of access, rectification, erasure, restriction of processing, data portability, objection, and automated decision-making. The Data Processor shall:
h. Assist the Company in ensuring compliance with obligations concerning the security of processing, notification of Personal Data breaches, data protection impact assessments, and prior consultation with supervisory authorities.
i. Upon termination of this Agreement and at the choice of the Company, delete or return all Personal Data to the Company and delete existing copies, unless applicable law requires storage of the Personal Data, in accordance with Section 10 of this Agreement.
j. CouldAI shall make available compliance documentation, upon request. On-site or remote audits: (i) no more than once in any rolling twelve-month period; (ii) on at least thirty (30) days' written notice; (iii) during normal business hours; (iv) subject to mutually agreed confidentiality terms; and (v) at the Company's expense, including CouldAI's reasonable internal costs. The Company may use an independent, third-party auditor that is not a direct competitor of CouldAI.
Nothing in this Section 5 obliges CouldAI to take actions that (i) would violate Applicable Law, (ii) require disclosure of trade secrets or confidential information of third parties, or (iii) exceed the limitation-of-liability caps set forth in Section 14.
a. The Data Processor shall notify the Company without undue delay, and in any event within seventy-two (72) hours after confirming that a Personal Data Breach has occurred and constitutes a notifiable breach under Applicable Law. "Confirming" means the point at which CouldAI has sufficient evidence to conclude that (i) a breach of security has occurred and (ii) Customer Personal Data has been compromised. Such notification shall include, at a minimum:
b. The Data Processor shall cooperate with the Company and take commercially reasonable steps the Company directs to investigate, mitigate and remediate the breach. Any bespoke assistance exceeding eight (8) person-hours per event is chargeable at CouldAI's then-current professional-services rates, unless prohibited by Applicable Law.
c. The Data Processor shall document all Personal Data Breaches, including the facts of the breach, its effects, and the remedial action taken.
d. The Data Processor's notification of or response to a Personal Data Breach shall not be construed as the Data Processor's acknowledgement of any fault or liability with respect to the Personal Data Breach.
e. If the Company determines to notify any governmental entity, Data Subject(s), the public or others of a Personal Data Breach, to the extent such notice directly or indirectly refers to or identifies the Data Processor, where permitted by applicable laws, the Company agrees to:
f. Enhanced Incident Response: Following any Personal Data Breach, the Data Processor shall:
CouldAI may delay notice to the Company if a competent law-enforcement agency determines that immediate disclosure would impede a criminal investigation, provided CouldAI notifies the Company as soon as the restriction is lifted.
a. The Data Processor shall not engage another processor (Sub-processor) without prior specific or general written authorization of the Company. In the case of general written authorization, the Data Processor shall inform the Company of any intended changes concerning the addition or replacement of other processors, giving the Company ten (10) business days to object to such changes.
b. The Data Processor may continue to use those Sub-processors already engaged by the Data Processor as of the date of this Agreement.
c. The Data Processor maintains an up-to-date list of all Sub-processors engaged in processing Personal Data as set forth in Annex IV of this Agreement (the "Sub-processor List"). This list is updated at least annually and available upon request to [email protected].
d. In the event that the Company does not wish to consent to the use of a new Sub-processor, the Company may notify the Data Processor that the Company does not consent within five (5) business days on reasonable grounds relating to the protection of Personal Data by contacting [email protected]. In such cases, the Company and the Data Processor shall work together in good faith to find a mutually acceptable resolution to address such objection. If the parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, the Company may, as its sole and exclusive remedy, terminate the Agreement and cancel the Services by providing written notice to the Data Processor and receive a refund of any prepaid fees under the Agreement.
e. Where the Data Processor engages another processor for carrying out specific processing activities on behalf of the Company, the same data protection obligations as set out in this Agreement shall be imposed on that other processor by way of a contract.
f. Where that other processor fails to fulfill its data protection obligations, the Data Processor shall remain fully liable to the Company for the performance of that other processor's obligations.
a. The Data Processor shall not transfer Personal Data to a third country or international organization unless:
b. For ex-EEA Transfers, the parties agree that such transfers are made pursuant to the EU SCCs, which are deemed incorporated into this Agreement by reference and completed as follows:
c. For ex-UK Transfers, the parties agree that such transfers are made pursuant to the UK SCCs, which are deemed incorporated into this Agreement by reference, and amended and completed in accordance with the UK Addendum.
d. The Data Processor represents and warrants that:
e. If any transfer mechanism relied upon becomes invalid or is enjoined, the parties will cooperate in good faith to promptly implement an alternative lawful mechanism. CouldAI may suspend the affected transfers (and related processing) until such mechanism is in place, without this constituting a breach of the Agreement.
a. Upon reasonable notice of at least 14 days, the Data Processor shall allow for and contribute to audits, including inspections, conducted by the Company or another auditor mandated by the Company regarding the processing of the Company's Personal Data by the Data Processor. Audits requiring on-site inspection, or more than one audit per twelve (12)-month period, are subject to CouldAI's reasonable fees and reimbursement of out-of-pocket costs.
b. The Company shall conduct audits in a manner designed to minimize disruption to the Data Processor's business operations and may be conducted no more than once per year, unless required by a regulatory authority or following a Personal Data Breach.
c. The Data Processor shall make available to the Company all information necessary to demonstrate compliance with the obligations laid down in this Agreement and shall allow for and contribute to such audits, including inspections. All auditors must execute a non-disclosure agreement acceptable to CouldAI. CouldAI may redact or withhold information that (i) is subject to attorney–client or work-product privilege, (ii) identifies another customer, (iii) constitutes trade secrets, or (iv) is not strictly necessary to verify compliance.
d. If the controls or measures to be assessed in the requested audit are addressed in a SOC 2 Type 2 or similar audit report performed by a qualified third-party auditor within twelve (12) months of the Company's audit request ("Audit Report") and the Data Processor has confirmed in writing that there are no known material changes in the controls audited and covered by such Audit Report(s), the Company agrees to accept provision of such Audit Report(s) in lieu of requesting an audit of such controls or measures.
e. The Data Processor need not give access to its premises for the purposes of such an audit:
f. The Company bears all of its own audit costs. CouldAI may charge (i) reasonable fees for on-site inspections, bespoke document production, or manual assistance that exceeds two (2) person-hours, and (ii) reimbursement of any out-of-pocket expenses. These fees will be invoiced at CouldAI's standard professional-services rates unless prohibited by Applicable Law.
Upon the cessation of all Services involving the Processing of Customer Personal Data (the "Cessation Date"), the Data Processor shall immediately discontinue all Processing activities other than secure storage or any Processing expressly permitted under this Agreement. Within thirty (30) days after the Cessation Date the Company may instruct the Data Processor, in writing, to return or delete all Customer Personal Data then in the Data Processor's possession or control. If no such instruction is received within that period, the Data Processor may, at its discretion, permanently delete or irreversibly anonymize the data in accordance with its documented retention schedule. Following a valid deletion or return instruction, the Data Processor will complete deletion from active systems within ninety (90) days and from immutable or encrypted backup media within three-hundred-sixty-five (365) days, unless a longer retention period is mandated by Applicable Law. Notwithstanding the foregoing, the Data Processor may retain a minimal log of the deletion event and any Customer Personal Data strictly necessary to establish, exercise, or defend legal claims, provided such data remains subject to the confidentiality and security obligations set forth herein. Where manual data-export or bespoke deletion work exceeds two (2) person-hours, the Data Processor may charge the Company its reasonable, documented costs at the then-current professional-services rates, except to the extent such charges are prohibited by Applicable Law. The provisions of this Section 10, together with Sections 11 and 14 (Limitation of Liability), shall survive termination of this Agreement for so long as the Data Processor retains any Customer Personal Data.
This Agreement, and any non-contractual obligations arising out of or in connection with it, shall be governed by and construed in accordance with the laws of Ireland, without regard to conflict-of-law principles. Any dispute that relates primarily to the interpretation or enforcement of EU Data Protection Laws shall be submitted to the exclusive jurisdiction of the courts of Ireland. Any dispute that relates primarily to UK Data Protection Laws may, at either party's option, be submitted to the courts of England and Wales. For all other disputes, the Data Processor may elect, by written notice, either (i) the state or federal courts located in Delaware, USA, or (ii) final and binding arbitration under the Rules of Arbitration of the International Chamber of Commerce, seated in London, conducted in English before a single arbitrator experienced in data-protection law. The parties agree to resolve all disputes solely on an individual basis and waive any right to bring or participate in a class, consolidated, or representative action. Nothing in this Section 11 limits either party's right to seek urgent injunctive or equitable relief in any competent court to protect its Confidential Information or intellectual-property rights.
a. The Company represents, warrants and covenants that it has and shall maintain throughout the term all necessary rights, consents and authorizations to provide the Personal Data to the Data Processor and to authorize the Data Processor to use, disclose, retain and otherwise process Personal Data as contemplated by this Agreement, the Service Agreement and/or other processing instructions provided to the Data Processor.
b. The Company shall comply with all applicable Data Protection Laws.
c. The Company shall reasonably cooperate with the Data Processor to assist the Data Processor in performing any of its obligations with regard to any requests from the Company's data subjects and will reimburse CouldAI for any reasonable, documented costs CouldAI incurs when assistance exceeds the two (2) person-hour allowance set out in Section 5(g).
d. Without prejudice to the Data Processor's security obligations in this Agreement, the Company acknowledges and agrees that it, rather than the Data Processor, is responsible for certain configurations and design decisions for the services and that the Company, and not the Data Processor, is responsible for implementing those configurations and design decisions in a secure manner that complies with applicable Data Protection Laws.
e. The Company shall not provide Personal Data to the Data Processor except through agreed mechanisms. For example, the Company shall not include Personal Data other than technical contact information in technical support tickets or transmit Personal Data to the Data Processor by email, except where expressly authorized. Without limitation to the foregoing, the Company represents, warrants and covenants that it shall only transfer Personal Data to the Data Processor using secure, reasonable and appropriate mechanisms, to the extent such mechanisms are within the Company's control.
f. The Company shall not take any action that would (i) render the provision of Personal Data to the Data Processor a "sale" under U.S. Privacy Laws or a "share" under the CCPA (or equivalent concepts under U.S. Privacy Laws); or (ii) render the Data Processor not a "service provider" under the CCPA or "processor" under U.S. Privacy Laws.
g. The Company agrees that, without limiting the Data Processor's obligations under Section 5 (Obligations of the Data Processor), the Company is solely responsible for its use of the Services, including:
h. The Company agrees that the Service, the Security Measures described in Exhibit B, and the Data Processor's commitments under this Agreement are adequate to meet the Company's needs, including with respect to any security obligations of the Company under applicable Data Protection Laws, and provide a level of security appropriate to the risk in respect of the Customer Personal Data. Accordingly, to the fullest extent permitted by law, the Company releases and will defend, indemnify, and hold harmless CouldAI from any claim, fine, or loss arising out of the Company's failure to implement or maintain the security controls under this Section.
i. The Company shall indemnify and hold harmless CouldAI against any third-party claim, regulatory investigation, or fine arising from (a) the Company's provision of Prohibited Data identified in Section 4.3, (b) the Company's failure to obtain a valid legal basis for Processing, or (c) any instructions that infringe Applicable Law.
j. The Company shall give CouldAI at least thirty (30) days' prior written notice of any change in its processing activities that is likely to increase the risk to Data Subjects or materially alter the categories or volume of Customer Personal Data.
a. The Company acknowledges and agrees that the Data Processor may collect, use and disclose Service Data for its own business purposes, such as for accounting, tax, billing, audit, and compliance purposes; to provide, improve, develop, optimize and maintain the Services; to investigate fraud, spam, wrongful or unlawful use of the Services; training or tuning proprietary machine-learning models used to deliver the Services; and/or as otherwise permitted or required by applicable law.
b. In respect of any such Processing described in Section 13(a), the Data Processor:
c. For the avoidance of doubt, Service Data is not "Customer Personal Data" and the obligations set out in this DPA do not apply to CouldAI's Processing of Service Data. The Data Processor may retain Service Data for as long as it has a legitimate business need, may disclose Service Data to its Affiliates and Sub-processors for the purposes set out in Section 13(a), and may create, commercialize, and publish anonymized, aggregated, or de-identified data from Service Data, provided that such data does not identify the Company or any individual Data Subject. The Data Processor warrants that any de-identification will meet the standard for "de-identified data" under the CPRA and comparable laws.
d. The Company acknowledges that no royalty, fee, or other remuneration is due for CouldAI's Processing of Service Data under this Section 13, and the Company has no right to opt out of such Processing so long as it remains a customer of the Services.
The Company shall defend, indemnify and hold harmless CouldAI and its affiliates from any third-party claim, investigation, fine, loss, or reasonable legal cost that arises from (i) the Company's instructions or configurations, (ii) failure to secure a lawful basis or required consents, (iii) provision of Prohibited Data, or (iv) any breach of this DPA or applicable data-protection laws. CouldAI will give prompt written notice and reasonable cooperation; the Company may control the defense but may not settle any matter that admits fault or imposes non-monetary obligations on CouldAI without CouldAI's prior written consent.
a. In the event of inconsistencies between the provisions of this Agreement and the Service Agreement, the provisions of this Agreement shall prevail.
b. If any provision of this Agreement is held invalid or unenforceable, the remaining provisions will remain in full force, and the Parties shall replace the invalid provision with a valid one that most closely reflects the Parties' original intent.
c. No amendment or modification of this Agreement shall be valid or binding unless made in writing and duly executed by authorized representatives of both Parties, except that CouldAI may update this Agreement as reasonably necessary to comply with changes in Applicable Data Protection Laws by giving at least thirty (30) days' written notice. If the Company objects in writing within that period and the Parties cannot reconcile the objection, either Party may terminate the affected Services without penalty.
d. The Parties agree that this Agreement constitutes the entire understanding between the Parties with respect to the subject matter hereof and supersedes all prior agreements or understandings, whether written or oral.
e. The exchange of Customer Personal Data does not form part of the consideration exchanged between the Parties in respect of the Agreement or any other business dealings.
f. The Data Processor may on notice vary this Agreement to the extent that (acting reasonably) it considers necessary to address the requirements of applicable Data Protection Laws from time to time.
g. To the maximum extent permitted by Applicable Law, the total aggregate liability of CouldAI arising out of or in connection with this DPA (including its Annexes), whether in contract, tort (including negligence), strict liability, indemnity or otherwise, shall under no circumstances exceed the lower of: (a) any aggregate liability cap or limitation set out in the Service Agreement; or (b) an amount equal to the fees actually paid and payable by Customer to CouldAI under the Service Agreement during the twelve (12) month period immediately preceding the event first giving rise to liability. In no event shall either Party be liable to the other for any loss of profits, revenue, goodwill, business interruption, loss or corruption of data, or for any indirect, special, incidental, punitive, exemplary, or consequential damages of any kind, even if advised of the possibility of such loss or damage and regardless of the theory of liability. The foregoing limitations and exclusions apply (i) in the aggregate across this DPA and the Service Agreement, (ii) irrespective of the number or nature of claims, and (iii) notwithstanding any failure of essential purpose of any limited remedy. Nothing in this Section limits or excludes liability that cannot be limited or excluded under Applicable Law.
For the Data Controller (Company)
Name: __________________________
Date: __________________________
Signature: ______________________
For the Data Processor
Name: CouldAI Incorporated
Date: Aug 16, 2025
Signature: ______________________
This Annex I provides a standardized description of the processing activities carried out by the CouldAI Incorporated. ("CouldAI") on behalf of Data Exporter ("Controller/Company") in accordance with Applicable Data Protection Laws.
Data Exporter:
Name: [___________________________]
Address: [_________________________]
Contact: [__________________________]
Role: Controller
Data Importer:
Name: CouldAI Incorporated
Contact: [email protected]
Role: Processor
Nature and Purpose of Processing: The Data Processor will process Personal Data as necessary to perform the Services under the Service Agreement, specifically for providing AI-powered software development services, including managing code repositories, project data, user interactions, and development workflows to enhance application development and deployment services.
Duration of Processing: For the duration of the Service Agreement and for a period 180 days after termination to allow for secure deletion or return of data, unless longer retention is required by law.
Categories of Data Subjects:
Categories of Personal Data:
Special Categories of Data (if applicable): none anticipated; Controller agrees not to provide such data.
Processing Operations: Collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of Personal Data.
Frequency of transfer: Ongoing – as initiated by the Company in and through its use, or use on its behalf, of the Services.
Recipients / onward transfers: Sub-processors listed in Annex IV of this Agreement
Competent Supervisory Authority: For transfers originating in the EEA, the competent supervisory authority shall be the Irish Data Protection Commission.
This Annex sets forth the technical and organizational security measures implemented and maintained by the Processor to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and any other unlawful form of processing. These measures are designed to ensure a level of security appropriate to the risks presented by the processing, consistent with the nature of the personal data and the obligations under Applicable Data Protection Laws. The Processor shall regularly assess, test, and update these measures to address evolving threats and comply with legal and contractual requirements.
By using CouldAI's services, the Company agrees to be bound by the terms of this Data Processing Agreement.
SCCs (Module 3) per Decision (EU) 2021/914 are incorporated.
Data Exporter (Controller): Provide lawful, documented instructions and ensure accuracy and legal basis for processing.
Data Importer (Processor): Shall process personal data only as instructed by the Controller, maintain technical and organizational safeguards per Annex II, and notify the Controller within five (5) business days of any instruction it reasonably believes is unlawful.
Data Subject Rights: Both Parties shall assist each other in responding to access, deletion, and other data subject requests within thirty (30) days, and promptly (within five (5) business days) forward any request received directly from a data subject.
Sub-processors: Both Parties may engage Sub-processors under general authorization, must provide ten (10) business days' notice of changes, and ensure all Sub-processors are bound by equivalent contractual and SCC-based data protection obligations.
Security: Both parties must implement and regularly update security measures described in Annex II and notify the other Party of any actual or suspected personal data breach within seventy-two (72) hours.
Sensitive Data: Both Parties shall apply strong encryption and strict access controls to sensitive data (e.g., financial, or account-related information), ensuring access is limited only to authorized personnel.
Compliance: Both Parties shall maintain records of processing, make them available upon request, and allow audits or assessments per Section 4.9 to verify compliance with this DPA and applicable laws.
The controller has authorized the use of the following sub-processors:
| Name of Sub-processor | Description of Processing | Location of Processing |
|---|---|---|
| Google Cloud Platform (GCP) | Cloud infrastructure for customer applications and databases (Cloud SQL, Firestore, App Engine) | United States |
| OpenAI | AI/ML processing of customer prompts, generated code, and AI interactions | United States |
| Anthropic | AI/ML processing of customer prompts, generated code, and AI interactions (Claude) | United States |
| Google Gemini | AI/ML processing of customer AI prompts and responses | United States |
| Supabase | Database and authentication services for customer data and user authentication | United States |
| GitHub | Code repository hosting for customer source code and potentially customer data in repositories | United States |
| Cloudflare | Content delivery network services, caching of customer web content | United States, United Kingdom, Belgium |
| Sentry | Error monitoring service processing application errors that may contain customer data | United States |
Note: This list includes only third-party service providers that process personal data on behalf of the data importer. Internal business tools that do not process customer data are excluded.
(to the EU Commission Standard Contractual Clauses 2021/914)
Version B1.0 – in force 21 March 2022
Effective Date: _______________________
Data Exporter (Controller)
Name: _____________________
Address: ________________________________
Contact: Privacy / Legal – [email + telephone]
Activities relevant to the transfer: provision of Customer Personal Data to CouldAI for hosting, collaboration-platform and related support services
Role: Controller
Data Importer (Processor)
Name: CouldAI, Inc.
Contact: Data Protection Officer – [email protected]
Activities relevant to the transfer: processing Customer Personal Data to supply the CouldAI developer-experience platform and ancillary services
Role: Processor
The Mandatory Clauses of the UK International Data-Transfer Addendum issued by the UK ICO under s. 119A DPA 2018 (Version B1.0, 21 March 2022) are incorporated in full and form part of this Addendum.
(None – intentionally left blank.)
For the Data Exporter (Controller)
Name: __________________________
Date: __________________________
Signature: ______________________
For the Data Importer (Processor)
Name: CouldAI Incorporated
Date: Aug 16, 2025
Signature: ______________________
(Adapting the Clauses to the revised Swiss Federal Act on Data Protection, in force 1 September 2023)
Parties and Scope. This Addendum applies solely to transfers of personal data that are subject to Swiss law.
Data Exporter (Controller)
Name: [COMPANY LEGAL NAME]
Address: [COMPANY ADDRESS]
Contact: Privacy / Legal – [email + telephone]
Data Importer (Processor)
Name: CouldAI, Inc.
Contact: Data Protection Officer – [email protected]
Incorporation of the EU SCCs. The text of the Commission Implementing Decision (EU) 2021/914, Module 2 for Controller-to-Processor transfers, is incorporated verbatim except as modified below. Throughout the Clauses, references to "EU", "Member State", "Union law", "GDPR", or "supervisory authority" are read as references to Switzerland, Swiss law, the revised Federal Act on Data Protection ("rev-FADP"), and the Swiss Federal Data Protection and Information Commissioner ("FDPIC") respectively. The term personal data includes sensitive personal data as defined in article 5 rev-FADP.
Clause-specific modifications.
Updates and supplementary measures. The importer will maintain the supplementary technical and organizational measures described in Annex II of the DPA and adjust them if Swiss authorities or courts require stronger protection.
Precedence. In the event of conflict, Swiss mandatory law prevails, followed (in descending order) by this Swiss Addendum, the EU SCCs, and the main DPA or Service Agreement.
Execution and entry into force. This Swiss Addendum is deemed signed by the parties on the Effective Date of the DPA and takes effect immediately for all transfers of personal data subject to the rev-FADP.
For the Data Exporter (Controller)
Name: __________________________
Title: __________________________
Date: __________________________
Signature: ______________________
For the Data Importer (Processor)
Name: CouldAI Incorporated
Title: __________________________
Date: __________________________
Signature: ______________________