Data Processing Agreement

1. About this agreement

This Data Processing Agreement ("DPA") is between Turntwo Technology B.V. ("Provider", "we", "us"), registered at Niasstraat 35, 1095 TV Amsterdam, The Netherlands, KVK 42217973, and the organization named as subscriber in an Order Form for Turntwo Interact ("Subscriber", "you").

The DPA is part of the agreement between Provider and Subscriber, which consists of the Order Form, the Subscription Terms and this DPA (together, "the Agreement"). It sets out how we process personal data on your behalf when we provide Interact, as required by Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR", in Dutch "AVG").

If the DPA and the Order Form conflict, the Order Form prevails.

2. Definitions

Terms such as personal data, processing, controller, processor, data subject and personal data breach have the meaning given to them in Article 4 of the GDPR. In addition:

• Interact means the Turntwo Interact platform and the services we provide with it under the Agreement.
• Subscriber Data means the data you, your users or your connected systems bring into Interact, or that Interact produces for you, such as data retrieved from your warehouse, reports, chats and files.
• Subprocessor means a third party we engage to process personal data in Subscriber Data on your behalf.

3. Roles and scope

For personal data in Subscriber Data, you are the controller and we are the processor. The processing we carry out is described in Annex 1.

For the account data of your users (such as name, email address, role and login activity) we act as an independent controller. That processing is described in our Privacy Policy, not in this DPA.

Services that you choose and connect to Interact yourself are not our subprocessors. This includes sign-in providers (such as Google or Microsoft), notification channels (such as Slack, Microsoft Teams or email addresses you configure), data connectors to your own warehouse or platforms, and MCP platforms. When a user in your organization approves an action by an agent on such a platform, the action is carried out on your instruction and the platform processes the data under your own agreement with that platform.

4. Your instructions

We process personal data only on your documented instructions. The Agreement, this DPA and the way you configure and use Interact (for example the connectors, agents, jobs, monitors and notification channels you set up) are your complete instructions. Further instructions must be in writing and fit within the scope of the Agreement.

We tell you if we believe an instruction breaks the GDPR or other data protection law. We may suspend that instruction until you confirm or change it.

We may process personal data without your instruction only where EU or Dutch law requires it. In that case we tell you first, unless that law forbids it.

We do not use personal data in Subscriber Data to train AI models or models that are used for other subscribers, and we do not sell it or use it for advertising, as set out in section 11 of the Subscription Terms.

5. Anonymized data and benchmarks

You instruct us to anonymize and aggregate Subscriber Data for usage data and benchmarks, as set out in section 15 of the Subscription Terms, including its safeguards and your right to opt out. Anonymized data is no longer personal data, and this DPA does not apply to it.

6. Your responsibilities

You are responsible for the lawfulness of the processing you instruct, including having a valid legal basis, giving data subjects the required information and obtaining any consents you need.

Interact is built for marketing and business analytics. Do not bring special categories of personal data (Article 9 GDPR) or data about criminal convictions (Article 10 GDPR) into Interact, and keep the personal data you connect to what your analysis needs.

Each party indemnifies the other against claims by third parties, including data subjects and supervisory authorities, that result from its own breach of the GDPR or this DPA. Claims that result from us following your instructions are covered by your indemnity. Our indemnity is subject to the limitations of liability in section 15.

7. Confidentiality

Everyone at Provider who can access personal data in Subscriber Data is bound by a duty of confidentiality, through their employment contract or a separate agreement, and accesses it only as far as needed to provide Interact.

8. Security

We take appropriate technical and organizational measures to protect personal data against loss and unlawful processing, taking into account the state of the art, the costs, and the nature and risks of the processing. Annex 2 describes these measures. We may update them over time, as long as the overall level of protection does not decrease.

We make reasonable efforts to keep Interact secure, but no system is completely secure and we cannot guarantee that our measures will be effective in every circumstance.

You are responsible for the security of everything under your control, including who in your organization has access, the roles you assign, whether you require two-factor authentication, and the credentials of the systems you connect.

9. Subprocessors

You give us general authorization to engage subprocessors. The current subprocessor list shows their purpose and location.

At least 14 days before a new subprocessor starts processing personal data, we update that list and notify the administrators of your organization by email. You may object on reasonable data protection grounds within those 14 days by emailing info@turntwo.com. We will then discuss the objection with you in good faith. If we cannot resolve it, your only remedy is to terminate the part of the Agreement that depends on the new subprocessor.

We impose data protection obligations on each subprocessor that offer the same level of protection as this DPA. We remain liable to you for the performance of our subprocessors' obligations.

10. International transfers

We process personal data in Subscriber Data within the European Union / European Economic Area where we can. Some subprocessors, in particular the AI model providers, are located in or can access data from outside the European Economic Area (EEA), mainly the United States. For these transfers we rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified providers, or on the Standard Contractual Clauses adopted by the European Commission. The subprocessor list shows where each subprocessor processes data.

11. Requests from data subjects

If a data subject contacts us with a request about personal data in Subscriber Data, we forward it to you without undue delay and do not respond to it ourselves, unless you ask us to.

Interact lets you view, export and delete most Subscriber Data yourself. Where you need more help to respond to a request, we provide reasonable assistance. We may charge for this at our standard rates.

12. Other assistance

Taking into account the nature of the processing and the information available to us, we provide reasonable assistance with your obligations on security, data protection impact assessments and prior consultation with the Autoriteit Persoonsgegevens or another supervisory authority. We may charge for this at our standard rates.

13. Personal data breaches

We notify you without undue delay, and in any event within 72 hours, after we become aware of a personal data breach affecting Subscriber Data. We send the notification to the administrators of your organization in Interact, or to the contact person named in the Agreement.

The notification includes what we know at that point and, as it becomes available: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures we have taken or propose. We take reasonable steps to contain the breach and limit its consequences.

You decide whether to notify the supervisory authority and the data subjects concerned. We do not notify them on your behalf, unless you ask us to in writing. Notifying you of a breach is not an acknowledgement of fault or liability.

14. Audits

On request, we make available the information you reasonably need to verify that we comply with this DPA. We do this first through documentation of our information security management system, which is aligned with ISO/IEC 27001, and by answering a reasonable security questionnaire once a year.

If that information is not sufficient, you may have an audit carried out:

• at most once per calendar year, or at any time after a substantiated suspicion that we do not comply with this DPA;
• with at least 30 days' written notice and an agreed scope;
• by an independent auditor bound by confidentiality, who is not a competitor of Provider;
• during business hours and without unreasonable disruption to our operations or access to other subscribers' data.

You bear the costs of the audit, including our time at our standard rates, unless the audit shows a material breach of this DPA by us. We receive a copy of the audit report, and we fix any non-compliance it identifies within a reasonable period.

15. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. Those limitations do not apply to damage caused by intent or willful recklessness ("opzet of bewuste roekeloosheid") of a party's management.

16. Term, return and deletion

This DPA applies for as long as we process personal data in Subscriber Data on your behalf.

Until the Agreement ends, you can export your Subscriber Data from Interact. Within 90 days after the Agreement ends, we delete the personal data in Subscriber Data, unless EU or Dutch law requires us to keep it. Data in backups is deleted when those backups expire in their normal cycle, and is not restored in the meantime except to recover from an incident.

Obligations that by their nature continue after the end of this DPA, such as confidentiality and liability, remain in force.

17. Changes to this DPA

We may change this DPA, for example when the law or our services change. Changes follow section 20 of the Subscription Terms. New subprocessors follow section 9 of this DPA.

18. Governing law and jurisdiction

This DPA is governed by the laws of the Netherlands. Any dispute will be submitted to the competent court in Amsterdam, the Netherlands, unless mandatory law provides otherwise.

Annex 1. Description of the processing

Annex 2. Technical and organizational measures

• An information security management system aligned with ISO/IEC 27001, with documented policies, risk assessment and periodic review.
• Encryption of data in transit (TLS) and at rest.
• Credentials for connected systems stored encrypted, using a managed key management service.
• Role-based access within Interact, with each organization's data separated from that of other organizations.
• Two-factor authentication, which your organization can make mandatory for all its users.
• Provider's staff access to your environment limited to what is needed for support and operations, and only as far as your organization's support access settings allow.
• Least-privilege access for staff to production systems, revoked when no longer needed.
• Error monitoring, logging of key activity and alerting on incidents.
• Regular backups with point-in-time recovery of the application database.
• Actions by agents on external platforms carried out only after explicit approval by a user.
• Confidentiality obligations and security awareness for staff.

Annex 3. Subprocessors

The current subprocessor list shows each subprocessor's purpose and location. Earlier versions of that list remain available on the same page.