Data Processing Addendum

1. Scope and roles

This Data Processing Addendum (“DPA”) forms part of the agreement between AI Models and the customer (“Customer”) for the Services. It applies where we process personal data contained in Customer Content on Customer’s behalf. Customer is the controller and AI Models is the processor.

2. Processing instructions

We process personal data only on Customer’s documented instructions, including as set out in the agreement and through Customer’s configuration of the Services, unless required otherwise by law. We will not use Customer personal data to train shared models.

3. Details of processing

Subject matter, nature and purpose: providing the Services. Duration: the term of the agreement plus any retention period. Categories:

• Data subjects: Customer’s users and any individuals whose data Customer submits.
• Personal data: account details, usage data and any personal data included in prompts, files and outputs.

4. Confidentiality and security

We ensure that personnel authorised to process personal data are bound by confidentiality. We implement appropriate technical and organisational measures, including encryption in transit and at rest, access controls, logging and monitoring, business-continuity planning and regular review of these measures.

5. Subprocessors

Customer authorises us to engage subprocessors to help provide the Services. We impose data-protection obligations on each subprocessor that are no less protective than this DPA, remain responsible for their performance, and will notify Customer of new subprocessors with an opportunity to object. A current list is available on request.

6. Data subject requests

Taking into account the nature of processing, we will assist Customer, through the Services’ features or otherwise, in responding to requests from individuals exercising their rights.

7. Personal data breaches

We will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data, and provide information reasonably needed to meet Customer’s obligations.

8. International transfers

Where personal data is transferred across borders, we rely on appropriate safeguards such as standard contractual clauses, which are incorporated by reference where required.

9. Audits

We will make available information reasonably necessary to demonstrate compliance with this DPA, including responses to security questionnaires, and allow for audits as agreed in the Enterprise agreement.

10. Deletion and return

On termination, we will delete or return Customer personal data in accordance with Customer’s instructions and our retention schedule, unless retention is required by law.

11. Contact

To request a countersigned copy of this DPA, contact support@omnico.site or use our contact page.