Data processing addendum

Where we process personal data to deliver an order form, you are the controller or business and we are the processor or service provider. Where we process data to train, calibrate, validate, and improve models, generate derived or synthetic data, or produce aggregate insights, we act as an independent controller on the basis of our legitimate interest in developing and validating our technology. You warrant that you have given required notice and obtained required consent.

The order form sets the subject matter, duration, nature, purpose, data subjects, and personal-data categories and forms part of this DPA.

We process personal data only on documented instructions unless law requires otherwise. Authorized personnel are bound by confidentiality. We maintain the controls described at subconscious.ai/trust, bind approved subprocessors to protective terms, provide reasonable assistance with data subject requests and GDPR Articles 35 and 36, notify you of a confirmed security incident without undue delay and within 72 hours, and delete personal data on termination as the agreement provides.

You maintain a valid legal basis, give required notices, obtain consents, honor opt-outs, and ensure your instructions comply with law. Do not send personal data outside the order-form scope or any prohibited category listed in the agreement.

When we act as your service provider, we do not sell or share the personal information we process for you. We do not retain, use, or disclose it outside the business purposes and direct relationship set by the agreement, or combine it with another source except as applicable law permits a service provider. You may take reasonable steps to stop and remediate unauthorized use.

Our models do not store personal data in retrievable form, and one record's influence cannot be removed from a trained model without retraining. Deletion requests remove personal data from active systems and backups and exclude it from later training runs. They do not require retraining, roll back, modification, or deletion of derived data, synthetic data, or aggregate insights.

We do not submit personal data to consumer or free-tier AI services. Foundation model providers are engaged under terms prohibiting training on data we submit.

For GDPR transfers to a country without adequacy, we incorporate the EU Standard Contractual Clauses, Decision (EU) 2021/914, Module Two where we are processor and Module One where we are independent controller, together with the UK International Data Transfer Addendum where UK data is in scope. Clause 7 applies; Clause 9 uses Option 2 with 15 days' notice; Clause 11 optional redress does not apply; Clause 17 uses Option 1 and Irish law; Clause 18(b) uses the courts of Ireland. Annex I is the order form, Annex II is our security page, and Annex III is our subprocessor list.

The current list and request process are at subconscious.ai/trust/subprocessors. Notice and objection work as the applicable agreement provides.

Questions: privacy@subconscious.ai.