Data Processing Addendum (DPA)

(GDPR · UK GDPR · LGPD · PDPL · CCPA/CPRA) · Last Updated: April 21, 2026 · Version 2.0

1. Definitions

• "CCPA/CPRA" — the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020.
• "Data Protection Laws" — all applicable laws relating to the Processing of Personal Data, including GDPR, UK GDPR, Swiss FADP, LGPD (Brazil, Law No. 13.709/2018), UAE PDPL (Federal Decree-Law No. 45/2021), CCPA/CPRA, Argentina's Ley 25.326, Canada's PIPEDA and Quebec Law 25, and any other applicable national, state, or provincial data-protection law.
• "Data Subject," "Personal Data," "Personal Data Breach," "Process," "Processor," "Controller," "Supervisory Authority" — have the meanings given in the GDPR and corresponding meanings in other Data Protection Laws.
• "EEA" — European Economic Area.
• "Sub-processor" — any third party engaged by Geniri to Process Personal Data. Current list: legal@geniri.ai.
• "Standard Contractual Clauses" or "SCCs" — (a) the EU SCCs approved in Decision 2021/914 (Module Two: Controller-to-Processor, or Module Three: Processor-to-Processor); (b) for UK transfers, the UK International Data Transfer Addendum; (c) equivalent Swiss clauses.

2. Scope, Roles, and Duration

2.1 Roles

With respect to Personal Data Processed under this DPA: (a) Customer is the Controller (or, where Customer itself acts as a processor for a third-party controller, the Processor); and (b) Geniri is the Processor (or, as applicable, Sub-processor). Under CCPA/CPRA, Geniri acts as a Service Provider and Customer is the Business.

2.2 Subject Matter and Purpose

Geniri Processes Personal Data solely for the purpose of providing, maintaining, securing, and supporting the Service in accordance with the Agreement and Customer's documented instructions.

2.3 Duration

This DPA applies for the duration of the Agreement and any period thereafter during which Geniri Processes Personal Data.

2.4 Customer Instructions

The Agreement, this DPA, and Customer's use of the features and settings of the Service constitute Customer's complete and documented instructions to Geniri. Geniri shall Process Personal Data only on those instructions unless required otherwise by Applicable Law, in which case Geniri shall, to the extent permitted, inform Customer of that legal requirement before Processing.

3. Customer Obligations as Controller

Customer represents, warrants, and covenants that:

• it has and will maintain a valid legal basis under all applicable Data Protection Laws for Processing Personal Data;
• it has provided all required notices to Data Subjects and, where required, obtained all required consents (under GDPR, LGPD, PDPL, ePrivacy rules) or documented its legitimate-interest basis;
• its instructions comply with Data Protection Laws;
• the Personal Data is accurate, adequate, relevant, and limited to what is necessary for the purposes of the Processing;
• it will respond to Data Subject requests and Supervisory Authority inquiries concerning the Personal Data it controls;
• it will not provide to Geniri any special categories of Personal Data (GDPR Article 9) or sensitive Personal Data under LGPD without express agreement.

4. Geniri's Obligations as Processor

4.1 Processing on Instructions

Geniri shall Process Personal Data only on Customer's documented instructions, including with regard to transfers to a third country, except as required by Applicable Law. Geniri shall immediately inform Customer if, in its opinion, an instruction violates Data Protection Laws.

4.2 Confidentiality of Personnel

Geniri shall ensure that persons authorized to Process Personal Data are subject to appropriate confidentiality obligations and receive appropriate data-protection training.

4.3 Security

Geniri shall implement and maintain appropriate technical and organizational measures ("TOMs") appropriate to the risk, as described in Annex II.

4.4 Assistance with Data Subject Rights

Taking into account the nature of the Processing, Geniri shall assist Customer, by appropriate technical and organizational measures and insofar as possible, to respond to requests by Data Subjects to exercise their rights (access, rectification, erasure, restriction, portability, objection, withdrawal of consent). Where Geniri receives such a request directly from a Data Subject, Geniri shall promptly forward it to Customer without responding.

4.5 Assistance with DPIAs and Prior Consultations

Geniri shall provide Customer with reasonable assistance necessary to perform DPIAs and prior consultations with Supervisory Authorities under Articles 35 and 36 GDPR and equivalent provisions.

4.6 Personal Data Breach Notification

The notification will include, to the extent known: (a) nature of the breach, categories and approximate number of Data Subjects and records; (b) likely consequences; (c) measures taken or proposed; (d) contact details. Geniri shall cooperate in investigating and mitigating the breach. Notifications to Data Subjects and Supervisory Authorities are Customer's responsibility (as Controller), except where Geniri is directly required by law to notify.

4.7 Return and Deletion

Upon termination of the Agreement, or upon Customer's earlier written request, Geniri shall, at Customer's choice, return or delete all Personal Data Processed on Customer's behalf, unless Applicable Law requires retention. Geniri shall delete existing copies within ninety (90) days of termination. Back-ups and logs are deleted in accordance with Geniri's retention schedule and remain subject to this DPA until deletion.

4.8 Records of Processing

Geniri shall maintain records of all categories of Processing activities in accordance with Article 30(2) GDPR and equivalent Data Protection Laws, and shall make such records available to Customer and Supervisory Authorities upon reasonable request.

4.9 No Sale of Personal Data

Geniri shall not "sell" or "share" Personal Data within the meaning of CCPA/CPRA, shall not retain, use, or disclose Personal Data for any purpose other than the specific purpose of performing the services specified in the Agreement, and shall not retain, use, or disclose Personal Data outside the direct business relationship with Customer.

5. Sub-processors

5.1 General Authorization

Customer provides a general authorization to Geniri to engage Sub-processors, subject to the following conditions.

5.2 Current Sub-processors

A current list of Sub-processors is published at legal@geniri.ai and reproduced in Annex III. Customers may subscribe to email notifications by emailing privacy@geniri.ai.

5.3 Notice of New Sub-processors

Geniri shall provide at least thirty (30) days' prior notice of any new or replacement Sub-processor. Customer may object on reasonable data-protection grounds by written notice to privacy@geniri.ai. If the parties cannot resolve the objection, Customer may, as its sole remedy, terminate the affected part of the Service and receive a pro rata refund of any prepaid, unused fees.

5.4 Sub-processor Obligations

Geniri shall enter into a written agreement with each Sub-processor imposing data-protection obligations substantially equivalent to those in this DPA. Geniri remains liable to Customer for the acts and omissions of its Sub-processors as if they were Geniri's own.

6. International Data Transfers

Where Personal Data originating from the EEA, United Kingdom, Switzerland, Brazil, or another jurisdiction imposing transfer restrictions is transferred to Geniri or Sub-processors in a third country without an adequacy decision, such transfers are governed by the Standard Contractual Clauses incorporated by reference:

• EEA transfers: Module Two (Controller-to-Processor) or Module Three (Processor-to-Processor); Customer as data exporter, Geniri as data importer; Clause 9(a) Option 2 with the notice period in §5.3; governing law and jurisdiction Ireland; Annexes I–III populated by reference to Annexes I–III of this DPA.
• UK transfers: UK International Data Transfer Addendum to the EU SCCs.
• Swiss transfers: SCCs with references to GDPR read as references to the Swiss FADP; Swiss FDPIC as competent authority.
• LGPD transfers from Brazil: SCCs or equivalent mechanisms approved by the ANPD.

The parties shall implement supplementary technical, contractual, and organizational measures as further described in Annex II, including where required by Schrems II transfer-impact-assessment principles.

7. Audit Rights

7.1 Information Obligation

Geniri shall make available to Customer all information reasonably necessary to demonstrate compliance with this DPA, including summaries of its most recent third-party security audit reports (SOC 2, ISO 27001, or similar), subject to confidentiality obligations.

7.2 Audits

Customer may audit Geniri's compliance with this DPA no more than once per year, upon at least 60 days' prior written notice, during normal business hours, and subject to confidentiality. Audits will be conducted by Customer or by an independent auditor mutually agreed to by the parties (excluding Geniri's competitors). Customer bears audit costs unless the audit reveals a material breach, in which case Geniri bears reasonable costs.

8. CCPA/CPRA Service-Provider Terms

With respect to Personal Data subject to CCPA/CPRA:

• Customer discloses Personal Data to Geniri solely for the limited and specified business purpose of providing the Service;
• Geniri is prohibited from: (i) selling or sharing the Personal Data; (ii) retaining, using, or disclosing it for any purpose other than the business purpose; (iii) retaining, using, or disclosing it outside the direct business relationship with Customer; and (iv) combining the Personal Data with data from other sources, except as permitted by CCPA/CPRA;
• Geniri shall provide the same level of privacy protection as required of businesses;
• Customer has the right to take reasonable steps to stop and remediate unauthorized use;
• Geniri shall notify Customer if it determines it can no longer meet its obligations under CCPA/CPRA.

9. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Agreement. This DPA does not increase or decrease the parties' liability otherwise limited in the Agreement, except where Data Protection Laws require otherwise. Nothing in this DPA limits a Data Subject's rights against either party or a party's liability that cannot be limited under Data Protection Laws.

10. General

10.1 Precedence

In case of conflict between this DPA and the Agreement, this DPA prevails with respect to the Processing of Personal Data. In case of conflict between this DPA and the SCCs, the SCCs prevail to the extent required by Data Protection Laws.

10.2 Governing Law

Except where mandatory Data Protection Laws or the SCCs provide otherwise, this DPA is governed by the law of the State of Florida, United States.

10.3 Updates

Geniri may update this DPA from time to time to reflect changes in the Service, Sub-processors, or Data Protection Laws, provided that updates do not materially reduce the protections for Personal Data.

10.4 Contact