Data Processing Addendum

1. Scope and Formation

1.1 This Data Processing Addendum ("DPA") forms part of the Vector Data Loader Terms of Service (the "Terms") between Bipath, LLC ("Bipath") and the Customer. It applies when Bipath processes Customer Personal Data on the Customer's behalf in providing the Service. Under Terms §15.2, accepting the Terms accepts this DPA, and no separate signature is needed. Capitalized terms not defined here have the meanings given in the Terms.

1.2 Definitions.

• "Data Protection Laws" means laws on personal-data processing that apply to the relevant processing under the Agreement, including the EU General Data Protection Regulation 2016/679 ("EU GDPR"); the UK GDPR as defined in section 3(10) of the UK Data Protection Act 2018, together with that Act; the Swiss Federal Act on Data Protection ("FADP"); and applicable US state privacy laws, including the California Consumer Privacy Act as amended and its implementing regulations ("CCPA"), in each case as amended and in force.
• "Customer Personal Data" means personal data that Bipath processes on the Customer’s behalf in providing the Service, including personal data in Customer Content, Derived Data, extracted text and images, chunks, embeddings, outputs and associated metadata. Data remains covered while it is personal data under applicable Data Protection Laws; transformation or pseudonymization alone does not remove it from scope.
• "Personal Data Breach" means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by Bipath or its Subprocessors.
• "Subprocessor" means a third party Bipath engages to process Customer Personal Data on its behalf.
• "SCCs" means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under s.119A of the Data Protection Act 2018.
• "controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the applicable Data Protection Laws. "Business", "service provider", "sell" and "share" have the meanings given in the CCPA.

1.3 What this DPA doesn't cover.

• Personal data to the extent Bipath lawfully processes it as a controller for its own purposes, such as administering accounts and billing, maintaining business contacts, and conducting its own security or marketing activities. The Privacy Policy describes that processing. Customer Personal Data used to support or secure the Customer’s use of the Service remains subject to this DPA to the extent Bipath acts on the Customer’s behalf. Roles depend on the actual purpose and processing activity, not the name of a data field or system.
• Processing performed independently by a Source or Third-Party Provider that the Customer engages directly under its own agreement, to the extent that provider is not acting as Bipath’s Subprocessor. Bipath’s own retrieval, transmission and other processing through the integration remain covered by this DPA. A customer-supplied API key does not by itself determine a provider’s role. Where the actual arrangement makes a provider Bipath’s Subprocessor, Sections 4 and 5 apply (Terms §6.4).

2. Roles

2.1 The Customer is the controller of Customer Personal Data, or a processor acting for its own clients or controllers, and Bipath is its processor or subprocessor.

2.2 The Customer is responsible for:

• having a lawful basis, and giving all notices and obtaining all consents, needed for Bipath's processing under this DPA;
• the accuracy and quality of Customer Personal Data;
• the instructions it gives.

Where the Customer acts as a processor, it warrants that its instructions, including its appointment of Bipath, are authorized by the relevant controller.

3. Bipath's Obligations as Processor

3.1 Instructions. Bipath processes Customer Personal Data only on the Customer’s documented instructions, including for international transfers. The Agreement, the Customer’s configuration and use of the Service, and further written instructions agreed by the parties constitute those instructions. A legal requirement permits departure only to the extent recognized by applicable Data Protection Laws: for processing governed by EU GDPR Article 28(3)(a), the exception is a requirement of Union or Member State law; for the UK equivalent, it is applicable domestic law. Bipath informs the Customer before such processing unless the relevant law prohibits that notice on important grounds of public interest. Requests under other countries’ laws remain subject to Section 5 and any applicable SCC safeguards. Bipath will immediately inform the Customer if, in its opinion, an instruction infringes Data Protection Laws and may suspend the affected processing while the parties resolve the issue. Bipath need not develop a new feature or accept instructions outside the agreed Service, but that restriction does not excuse mandatory assistance or other duties under this DPA.

3.2 Confidentiality. Bipath ensures that personnel authorized to process Customer Personal Data are bound by contractual or statutory confidentiality obligations and access it only as needed to provide, support and secure the Service. Support access through the application uses authorized, time-limited and logged sessions as described in Annex II. Other necessary privileged operational access is restricted to authorized personnel under the access controls in Annex II.

3.3 Security. Bipath implements the technical and organizational measures in Annex II and the measures required by applicable Data Protection Laws, taking account of the nature, scope, context and purposes of processing and the risks to individuals. Bipath may update its measures without materially reducing the overall protection of Customer Personal Data or failing to meet applicable legal requirements. The Customer remains responsible for its own security measures, credentials, Users’ access, Third-Party Provider accounts and vector stores (Terms §15.1).

3.4 Assistance with data-subject requests. Taking into account the nature of processing, Bipath assists the Customer through appropriate technical and organizational measures, insofar as possible, in responding to data-subject requests under applicable Data Protection Laws. Bipath promptly notifies the Customer of a request it receives directly about Customer Personal Data and, where appropriate, refers the requester to the Customer. Bipath does not otherwise respond substantively unless the Customer authorizes it or law requires it. Where Module 3 applies, Bipath also assists and cooperates with the relevant controller as required by the SCCs. The Customer supplies the information and instructions reasonably needed for assistance.

3.5 Other assistance. Taking account of the nature of processing and information available to Bipath, Bipath assists the Customer with security, breach notification, data-protection impact assessments and prior consultation obligations, including applicable GDPR Articles 32–36 and comparable duties under other Data Protection Laws. Bipath may ordinarily use existing documentation and standard support processes. To the extent permitted by law, Bipath may charge reasonable, disclosed rates for additional assistance requested by the Customer, excluding work needed to remedy Bipath’s breach of this DPA. A fee dispute or absence of an agreed fee does not delay assistance required by law or the SCCs.

3.6 Personal Data Breaches. Bipath notifies the Customer without undue delay after becoming aware of a Personal Data Breach, using the Customer’s designated security contact or, if none is supplied, the Owners’ email addresses. To the extent available, the notice describes the nature of the breach, affected data and data-subject categories and approximate numbers, likely consequences, containment or remediation measures, and a contact for further information. Bipath supplies missing information in phases without undue further delay and does not postpone initial notice until its investigation is complete. Bipath takes appropriate steps to contain and remediate the breach and cooperates with the Customer’s legally required notifications. Notification is not an admission of fault or liability. Unsuccessful attempts that do not compromise Customer Personal Data are not Personal Data Breaches.

3.7 Deletion and return. At the end of the relevant processing services, the Customer may choose return of Customer Personal Data followed by deletion of Bipath’s remaining copies, or deletion without return. The Customer should communicate its choice before closure; if it gives no return instruction after a reasonable opportunity to choose, the Customer instructs deletion. Bipath provides return through available export features or another secure, reasonably usable method for data it holds on the Customer’s behalf. A suspension or account closure does not by itself eliminate the return right; an alternative secure process may be used where restoring application access would create a security or legal risk.

Bipath completes return, if requested, and deletes Customer Personal Data in its and its Subprocessors’ active systems within 30 days after the relevant services end, subject to an applicable mandatory retrieval period. Backup copies are placed beyond ordinary use pending deletion or overwrite no later than 35 days after the relevant processing services end [CONFIRM: this outside limit and coverage of every backup, snapshot, log and provider copy]. If a backup is restored, deletion instructions are reapplied before the data resumes ordinary processing. Bipath certifies completed deletion where the SCCs require it and otherwise confirms completion on request.

Bipath may retain data only to the extent and for the period legally required under applicable Data Protection Laws and transfer instruments, with continuing protection and use limited to that legal requirement. For independently engaged Customer providers, the Customer controls return and deletion under its provider agreements; Bipath remains responsible for its own processing and for its Subprocessors. Integration deletion commands depend on valid access and provider operation and do not necessarily remove a provider’s backups or independently retained copies (Terms §6.5). Applicable EU Data Act switching, retrieval and deletion requirements prevail (Terms §16.5).

3.8 Demonstrating compliance and audits. Bipath makes available the information necessary to demonstrate compliance with this DPA. The Customer should first use current documentation, available independent assurance reports and reasonable written questionnaires. Routine questionnaires are ordinarily limited to once in 12 months, but that limit does not restrict information reasonably required by law, a competent authority, a material change or indications of noncompliance. Bipath allows and contributes to audits, including inspections, by the Customer or an independent auditor it mandates, at reasonable intervals and where there are indications of noncompliance. Existing evidence may satisfy a request if it adequately addresses the relevant obligations; it does not automatically replace the audit right. Audits are subject to proportionate safeguards:

• ordinarily at least 30 days’ notice, with shorter notice where reasonably necessary for an incident, suspected noncompliance or a legal or regulatory deadline;
• during normal business hours unless urgent circumstances or an authority’s requirements reasonably require otherwise;
• a scope, method and duration reasonably related to the relevant processing obligations, with measures to minimize disruption and protect other customers’ data, privileged material and trade secrets; redaction or alternative evidence may protect those interests without defeating verification;
• the Customer bears its auditor’s costs; Bipath may recover reasonable, disclosed assistance costs to the extent permitted by law, except costs attributable to remedying Bipath’s breach. Cost arrangements must not frustrate a required audit.

Auditors must be bound by appropriate confidentiality duties. Audit information is confidential and may be used only to assess or enforce compliance, but may be disclosed as necessary to the relevant controller, professional advisers, a competent authority or as required by law, subject to appropriate confidentiality protections where permitted.

4. Subprocessors

4.1 General authorization. The Customer gives Bipath general written authorization to engage the Subprocessors identified in Annex III and replacements or additions notified under Section 4.3. Where the Customer acts as a processor, it confirms the relevant controller’s authorization and transmits required notices and objections. The current list is published at https://vectordataloader.app/legal/subprocessors and forms Annex III. Bipath maintains the information needed to identify each Subprocessor’s legal entity, processing activity and location and makes it available for the Customer’s assessment.

4.2 Bipath’s commitments. Bipath binds each Subprocessor by a written contract imposing the same data-protection obligations in substance as this DPA to the extent applicable to the subcontracted processing, including required security, assistance, deletion and transfer safeguards. Bipath remains responsible to the Customer for the Subprocessor’s performance of those obligations, subject to Section 7 and without limiting responsibility required by the SCCs or applicable law. Bipath provides relevant subprocessing terms where the SCCs or applicable law require, with permitted redactions and meaningful summaries protecting confidential information.

4.3 Notice of changes. Bipath gives at least 30 days’ advance written notice before a new or replacement Subprocessor begins processing the Customer’s Personal Data, by updating the list and emailing the designated privacy contact or the Owners. Notice identifies the Subprocessor, purpose, location and information reasonably needed to assess the change. A shorter period requires the Customer’s specific prior written authorization and any required upstream-controller authorization, consistent with applicable Data Protection Laws and the SCCs. In an emergency Bipath may suspend affected processing or use a previously authorized arrangement while obtaining authorization; an operational emergency alone does not authorize notice only after the transfer.

4.4 Objection. The Customer may object to a new Subprocessor on reasonable data-protection grounds, in writing to privacy@vectordataloader.app, within the notice period. The parties will discuss the objection in good faith. If Bipath can't reasonably accommodate it, the Customer may close its Organization. Bipath then refunds the amount actually paid for unused Purchased Credits, and, where the Customer has an active Lifetime Deal and the Service continues generally, the Lifetime Deal price paid to Bipath, as in Terms §16.4. That is the Customer's sole remedy for the objection.

5. International Transfers

5.1 Where processing happens. Bipath processes Customer Personal Data in the United States and its Subprocessors process it in the locations identified in Annex III, including disclosed remote-access locations. No dedicated regional residency commitment applies unless expressly agreed in an Enterprise Agreement. The Customer’s configuration of an independent provider may cause additional transfers for which the Customer must arrange appropriate safeguards; that does not excuse Bipath’s own obligations under this DPA.

5.2 EU transfers. Where Customer Personal Data is transferred to Bipath outside the EEA subject to EU GDPR Chapter V, the transfer is not covered by an applicable adequacy decision, and Decision (EU) 2021/914 is available for that transfer, the SCCs are incorporated by reference in full and completed as follows. The Customer is the exporter and Bipath is the importer. Before relying on these SCCs, the parties must establish that Bipath’s relevant processing is within the Decision’s scope. If it is not, the restricted transfer must not begin or continue without another valid transfer mechanism agreed and documented by the parties [CONFIRM: counsel’s assessment of Article 3 territorial scope and the applicable transfer mechanism].

• Module 2 (controller to processor) applies where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor.
• Clause 7 (docking clause) applies.
• Clause 9: option 2 (general written authorization) applies with 30 days’ advance notice, subject only to a specific prior written authorization permitted under Section 4.3.
• Clause 11: the optional language does not apply.
• Clause 13: the competent supervisory authority is determined under Clause 13(a) and Annex I.C.
• Clauses 17 and 18: the law of Ireland governs the SCCs and the courts of Ireland hear disputes under them, without restricting a data subject’s right to bring proceedings in an eligible court under Clause 18(c).
• Annexes I and II of the SCCs are completed by Annexes I and II of this DPA, and Annex III by the Subprocessor list.

5.3 UK transfers. For a restricted transfer of Customer Personal Data to Bipath under the UK GDPR that is not covered by applicable UK adequacy provisions, the UK Addendum, version B1.0 in force from 21 March 2022, including its Part 2 Mandatory Clauses as revised under its Section 18, is incorporated by reference in full. The SCCs selected below apply as modified by that Addendum, whether or not the same transfer is subject to the EU GDPR:

• Table 1 uses Annex I.A for the parties and key contacts; the start date is the effective acceptance date recorded under Section 1.1.
• Table 2 selects the SCCs in Decision (EU) 2021/914, with Module 2 or 3 according to Section 2.1, Clause 7 included, Clause 9 option 2 and 30 days’ notice, and the optional Clause 11 language excluded.
• Table 3 uses Annex I.A for parties, Annex I.B for transfer details, Annex II for security measures and Annex III for Subprocessors.
• Table 4 selects the Importer (Bipath) as a party that may end the UK Addendum under Section 19, subject to that section’s conditions. Ending the Addendum does not authorize a transfer without safeguards or remove duties for data already transferred.

5.4 Swiss transfers. For transfers to Bipath governed by the FADP that require contractual safeguards, the SCCs apply with the modules and options selected in Section 5.2 and these adaptations for the Swiss-law aspects of the transfer:

• the Swiss Federal Data Protection and Information Commissioner is the competent authority for the FADP aspects, alongside any competent EU authority for EU GDPR aspects;
• references to the GDPR mean the corresponding FADP provisions only for the Swiss-law aspects; EU GDPR safeguards remain unmodified where that law also applies;
• Clause 18(c) also permits a data subject habitually resident in Switzerland to bring proceedings before the competent Swiss courts;
• the adaptations do not displace any stronger protection required by a concurrently applicable law.

5.5 Order of precedence. The applicable SCCs, UK Addendum and mandatory Swiss adaptations prevail over conflicting terms of this DPA, the Terms or any other agreement between the parties, including an Enterprise Agreement. This includes conflicting liability, audit, termination, arbitration and forum terms. This DPA otherwise prevails on personal-data processing as provided in Terms §23. No commercial amendment may reduce mandatory protections in an applicable transfer instrument.

5.6 Onward transfers. Bipath makes onward transfers to Subprocessors only under a transfer mechanism recognized by the Data Protection Laws that apply.

5.7 Transfer assessments and public-authority requests. The parties cooperate in completing and documenting required transfer assessments and implementing necessary supplementary safeguards before relying on a transfer instrument. Bipath provides relevant information reasonably available to it and complies with the applicable instrument’s requirements for public-authority access requests, notification, legal review and challenges. If the required safeguards can no longer be maintained, the affected transfer is suspended and the applicable instrument’s remediation, termination and return or deletion provisions apply.

6. US State Privacy Laws

Where applicable US state privacy law governs processing under this DPA, Bipath acts as the Customer’s service provider, contractor or processor, as the actual relationship requires, and:

• (a) receives Customer Personal Data only for these limited business purposes: retrieving and storing Customer-selected content; extracting text and images; chunking and preparing embeddings through configured integrations; synchronizing, updating, returning and deleting data; and providing associated technical support and security. It does not retain, use or disclose that data for any other purpose, including an unrelated commercial purpose, except as applicable law expressly permits;
• (b) does not sell or share Customer Personal Data;
• (c) does not retain, use or disclose it outside the direct business relationship with the Customer, or combine it with personal data from other sources, except as those laws permit;
• (d) complies with applicable duties under those laws and provides the privacy protection required of the Customer for this processing, including reasonable security and required assistance with consumer requests, risk assessments, cybersecurity audits and automated-decision requirements where applicable;
• (e) promptly notifies the Customer after determining that it can no longer meet those obligations;
• (f) permits the Customer to take reasonable and appropriate steps to verify that use of the data is consistent with its legal obligations and, on notice, to stop and remediate unauthorized use. Section 3.8 provides the assessment process without limiting mandatory verification rights;
• (g) enables the Customer to comply with consumer requests and follows its lawful instructions for those requests; the Customer supplies the information reasonably needed to identify and implement them. Bipath imposes the required restrictions on its own Subprocessors. Where a contractor certification is required, Bipath certifies that it understands and will comply with the applicable contractual restrictions.

7. Liability

Bipath’s liability under this DPA is included within, and is not additional to, the aggregate exclusions and limits in Terms §18 to the extent those provisions may lawfully apply. This DPA does not create a separate liability cap or extend Bipath’s protections to the Customer; the Customer’s liability remains governed by the Terms. Neither the Terms nor this DPA limits:

• any rights, liabilities or obligations that the applicable SCCs or UK Addendum do not permit the parties to restrict, including data-subject rights and mandatory liability or contribution between the parties;
• a supervisory authority's powers;
• any liability that can't be limited under applicable law.

8. Term

This DPA applies for as long as Bipath or its Subprocessors process Customer Personal Data on the Customer’s behalf, including during return, restricted backup retention and deletion. Obligations intended or required to survive continue for as long as necessary, including confidentiality, transfer safeguards, completion evidence and accrued rights and liabilities.

---

Annex I: Description of Processing

A. Parties

B. Description of the transfer

• Data subjects. Determined by the Customer. Typically: the Customer's employees, contractors, clients and other individuals whose personal data appears in documents and content the Customer connects or uploads.
• Categories of personal data. Determined by the Customer within the permitted scope: names, business contact details, job and organizational information, document communications and associated metadata, including author or editor names, and personal data in extracted text, images, chunks, embeddings and other Derived Data. The Customer identifies additional relevant categories in documented instructions or an agreed supplement where needed to describe the actual transfer accurately.
• Sensitive data. Not intended. The Customer decides whether Customer Content includes special-category data, and is responsible for having a lawful basis for it. Protected health information and payment card data are prohibited (Terms §7.6). Annex II's measures apply to all Customer Personal Data.
• Frequency. Continuous, for as long as the Customer uses the Service.
• Nature of processing. Retrieving content from Sources the Customer connects, or receiving uploads; storing uploaded files; parsing, extracting text and images, and chunking; transmitting content to the embedding, LLM and vector-store providers the Customer configures; syncing, updating and deleting records in the Customer's vector store on its instructions; storing metadata about documents and syncs; support and security.
• Purpose. Providing, supporting and securing the Service for the Customer.
• Retention. For the duration of the Agreement, then as in Section 3.7.
• Transfers to Subprocessors. The activities, locations and duration are identified in Annex III. Subprocessing continues only for the relevant services and the return, deletion or legally required retention periods under Section 3.7.

C. Competent supervisory authority

For EU transfers, the competent authority is determined under SCC Clause 13(a): the authority responsible for the exporter’s GDPR compliance where it is established in the EEA; otherwise, where Article 3(2) applies, the authority of the Member State in which its Article 27 representative is established; or, if the exporter is not required to appoint a representative, an authority of a Member State where affected data subjects are located. The Customer identifies the specific competent authority and the facts supporting that selection in its acceptance or written annex record [CONFIRM collection of this information]. Ireland is not automatically the supervisory authority merely because Irish law is chosen. The UK authority is the Information Commissioner; the Swiss authority is the Federal Data Protection and Information Commissioner for FADP matters.

Annex II: Technical and Organizational Measures

Annex III: Subprocessors

The current list is maintained at https://vectordataloader.app/legal/subprocessors under Section 4. At this DPA’s effective date, the following are the proposed entries [CONFIRM each contracting/processing entity, scope, addresses or contact details, hosting and remote-access locations, and applicable transfer safeguards]. Only processing on Bipath’s behalf of Customer Personal Data falls within this list.

Stripe’s billing-only processing, to the extent performed for Bipath’s own account and payment administration, is described in the Privacy Policy and is outside this Customer Personal Data subprocessor list. A provider’s role for other activities is assessed separately under Section 1.3.