Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement under which Traza provides its services to the Customer (the “Main Agreement”) and governs Traza’s processing of Customer Personal Data under Article 28 GDPR.

1.1 Contracting entity. The Traza entity party to this DPA is the entity party to the Main Agreement:

• Echo AI Technologies Iberia, S.L. (NIF B26809798, Calle Alcalá 74, 5º A, 28009 Madrid, Spain) for Customers established in the EEA, Switzerland or the United Kingdom; or
• Echo AI Technologies, Inc. (2261 Market Street STE 86852, San Francisco, CA 94114, United States) for all other Customers.

“Traza” or “Processor” means the applicable entity; “Customer” or “Controller” means the customer party to the Main Agreement.

1.2 Effect. This DPA applies by reference in the Main Agreement or Traza’s Terms of Service from the earlier of the Main Agreement’s effective date and the date Traza first processes Customer Personal Data, and for as long as Traza processes it. A signed copy is available on request and does not change these terms unless the parties expressly agree amendments in writing.

Terms not defined here have the meaning given in the Main Agreement or, for “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority”, the GDPR. Where the UK GDPR or the Swiss FADP applies, references to the GDPR include the equivalent provisions of those laws.

• “Data Protection Laws”: the GDPR (Regulation (EU) 2016/679), the Spanish Organic Law 3/2018 and other EEA member state law implementing the GDPR, and, where applicable, the UK GDPR, the Swiss FADP and US state privacy laws.
• “Customer Personal Data”: personal data Traza processes on the Customer’s behalf in providing the Services, as described in Annex I.
• “Services”: the Traza platform and related services under the Main Agreement, including AI agents, integrations and support.
• “Sub-processor”: any third party, including a Traza affiliate, that Traza engages to process Customer Personal Data.
• “SCCs”: the standard contractual clauses in Commission Implementing Decision (EU) 2021/914, with the UK Addendum and Swiss amendments where applicable.
• “Trust Center”: Traza’s security and compliance portal at trust.traza.ai.
• “Security Incident”: a personal data breach affecting Customer Personal Data in Traza’s or its Sub-processors’ systems.

3.1 The Customer is controller and Traza is processor. Where the Customer is itself a processor, Traza is its sub-processor and the Customer remains Traza’s sole point of contact.

3.2 Traza processes Customer Personal Data only on the Customer’s documented instructions, unless law to which Traza is subject requires otherwise, in which case Traza informs the Customer before processing unless the law prohibits it. The Main Agreement, this DPA, the Customer’s configuration of the Services (including approval gates and any register of authorised autonomous actions) and the Customer’s use of the Services are the complete instructions. Traza informs the Customer promptly if it considers an instruction infringes Data Protection Laws.

3.3 The Customer is responsible for the lawfulness of the processing it instructs, including lawful basis, notices to data subjects and the accuracy of the data it provides, and will not submit special categories of data or criminal conviction data unless agreed in writing.

3.4 Traza does not sell Customer Personal Data or use it for its own purposes, and does not use it, or allow its AI model providers to use it, to train or fine-tune AI models. Traza may produce aggregated, de-identified usage statistics that identify neither the Customer nor any individual.

4.1 Confidentiality. Only personnel who need access to provide the Services receive it. All are bound by written or statutory confidentiality obligations.

4.2 Security. Traza implements the technical and organisational measures described in the Trust Center, which are incorporated into this DPA by reference and are appropriate to the risk under Article 32 GDPR. Traza may update them provided the overall level of protection is not reduced.

4.3 Assistance. Taking into account the nature of the processing, Traza assists the Customer with data subject requests under Chapter III GDPR, with data protection impact assessments and prior consultations under Articles 35 and 36 GDPR, and with its obligations under Articles 32 to 34 GDPR. Requests received directly from data subjects are forwarded to the Customer within 5 business days. Assistance beyond what is reasonable in scope, or caused by the Customer’s own breach, may be charged at Traza’s then-current rates, agreed in advance.

5.1 The Customer gives Traza general written authorisation under Article 28(2) GDPR to engage Sub-processors. The current list, including each Sub-processor’s location and transfer safeguard, is published in the Trust Center and forms Annex III of this DPA.

5.2 Traza gives at least 30 days’ notice of any intended addition or replacement by updating the Trust Center list and emailing the Customer’s account contact. The Customer may object in writing on reasonable data protection grounds within that period. If the parties cannot agree a reasonable alternative within 30 days, the Customer may terminate the affected Services by written notice, as its sole remedy, and Traza refunds prepaid fees for the period after termination.

5.3 Traza engages each Sub-processor under a written contract imposing data protection obligations no less protective than this DPA and remains responsible to the Customer for its performance.

6.1 For Customers contracting with Echo AI Technologies Iberia, S.L., Traza hosts, stores and processes Customer Personal Data within the EEA, including AI model inference. Each Sub-processor’s location is listed in the Trust Center.

6.2 Traza does not transfer Customer Personal Data outside the EEA, the United Kingdom or Switzerland (as applicable), and does not permit a Sub-processor to, unless covered by an adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified), the SCCs or another mechanism permitted by Data Protection Laws.

6.3 The SCCs are incorporated by reference. Module 2 applies between the Customer and Echo AI Technologies, Inc. where the Customer contracts with it and the processing is subject to the GDPR; Module 3 applies between Echo AI Technologies Iberia, S.L. and any affiliate or Sub-processor outside the EEA. Clause 7 applies; in clause 9, option 2 applies with the notice period in clause 5.2; the optional wording in clause 11 does not apply; the law and courts of Spain apply under clauses 17 and 18; Annex I of this DPA and the Trust Center complete the SCC annexes; the competent supervisory authority is the Agencia Española de Protección de Datos (AEPD), unless the SCCs require otherwise. Where UK or Swiss law applies, the SCCs apply as amended by the UK Addendum or the Swiss amendments respectively, with the Information Commissioner or the Federal Data Protection and Information Commissioner as competent authority. If the SCCs conflict with this DPA, the SCCs prevail.

7.1 Traza notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Security Incident, by email to the Customer’s security or account contact. The notice describes, to the extent known, the nature of the incident including the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed, and a contact point. Information not yet available is provided in phases without undue delay.

7.2 Traza takes reasonable steps to contain and remedy the incident and cooperates with the Customer under Articles 33 and 34 GDPR. Traza does not notify authorities or data subjects on the Customer’s behalf unless instructed or required by law. Notification is not an admission of fault. Unsuccessful attempts that do not compromise Customer Personal Data are not Security Incidents.

8.1 Traza makes available all information reasonably necessary to demonstrate compliance with Article 28 GDPR, including its most recent SOC 2 Type II report or equivalent independent attestation, its security policies and answers to reasonable security questionnaires (no more than once per year), through the Trust Center. This information satisfies the Customer’s audit right unless it is reasonably insufficient, a Security Incident has occurred or a supervisory authority requires an audit.

8.2 In those cases the Customer, or an independent auditor bound by confidentiality who is not a Traza competitor, may audit on at least 30 days’ written notice with a proposed scope, no more than once in any 12-month period, during business hours, for no more than 2 business days and without disrupting Traza’s operations. Audits do not extend to other customers’ data or to Sub-processors, whose own reports Traza provides instead. Each party bears its own costs; if an audit reveals a material breach by Traza, Traza bears the Customer’s reasonable audit costs and remedies the breach promptly. Results are Traza’s confidential information, except that the Customer may share them with a supervisory authority that requests them.

9.1 The Customer may export Customer Personal Data at any time through the Services. On termination of the Main Agreement, Traza makes it available for export for 30 days in a common machine-readable format, then deletes it from production systems within 30 days and from backups within 90 days in the ordinary course of backup rotation, and confirms deletion in writing on request. Traza may retain data where law to which it is subject requires it, in which case this DPA continues to apply to the retained data.

9.2 If a public authority requests Customer Personal Data, Traza redirects the authority to the Customer where legally possible, notifies the Customer promptly unless the law prohibits it, challenges requests it considers unlawful or disproportionate, and discloses only the minimum required.

10.1 Liability. Each party’s liability under this DPA, including the SCCs to the extent permitted, is subject to the limitations and exclusions of liability in the Main Agreement. Nothing in this DPA limits liability to data subjects under Article 82 GDPR or to supervisory authorities where the law does not permit it.

10.2 Precedence. In case of conflict: (a) the SCCs, (b) this DPA, (c) the Main Agreement. A signed version of this DPA prevails over the version published online.

10.3 Changes. Traza may update this DPA to reflect changes in Data Protection Laws, regulatory guidance or the Services, provided the update does not materially reduce the protection of Customer Personal Data, with at least 30 days’ notice of material changes. Earlier versions are available on request.

10.4 Governing law. This DPA is governed by the law of Spain and the courts of Madrid, unless the Main Agreement provides for the law and courts of another EU member state. For Customers contracting with Echo AI Technologies, Inc., the governing law and jurisdiction of the Main Agreement apply, except where the SCCs require otherwise.

10.5 US state privacy laws. Where they apply, Traza acts as the Customer’s service provider or processor, does not sell or share Customer Personal Data, and does not retain, use or disclose it for any purpose other than providing the Services. Traza notifies the Customer if it can no longer meet these obligations.

10.6 Severability. If any provision is found invalid, the rest remains in force and the invalid provision is replaced by a valid one closest to its intent. Clauses 7, 9 and 10 survive termination.

Traza’s technical and organisational measures (Annex II) and current Sub-processor list (Annex III) are published in the Trust Center and are incorporated into this DPA by reference. Changes to Sub-processors are notified under clause 5.2.