Data Processing Agreement

1. Parties and scope

This DPA forms part of the agreement between the Customer identified in an Order or account and COVIBES LABS AS, doing business as The Open Engine Company (“Company”). It applies when Company processes personal data in Customer Content for Customer as a processor or subprocessor (“Customer Personal Data”).

Customer is the controller or a processor acting with its controller’s authority. Company is the processor or subprocessor. Terms used in applicable data protection law have the same meaning here. If this DPA conflicts with the Business Terms on processing Customer Personal Data, this DPA controls.

2. Instructions and Customer duties

Company will process Customer Personal Data only on Customer’s documented instructions, including the agreement, Customer’s configuration and use of the Service, support requests, and other lawful written instructions. Company will not sell it, use it for targeted advertising, or use it outside the direct business relationship with Customer.

If law requires other processing, Company will inform Customer before processing unless law prohibits notice. Company will notify Customer if it believes an instruction violates applicable data protection law and may pause that instruction while the parties resolve it.

Customer is responsible for the lawfulness, fairness, accuracy, and scope of its instructions and Customer Personal Data; required notices and legal bases; responding to data subjects; and ensuring the Service is appropriate for its processing.

3. Confidentiality and security

Company will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality and access it only as needed for their duties. Company will maintain measures appropriate to the risk under GDPR Article 32 and equivalent law.

The measures are summarized in Schedule 2. Company may update them as technology and risk change, without materially reducing the overall security of the Service during an Order.

4. Subprocessors

Customer generally authorizes Company to use subprocessors. The current list and processing locations are in Schedule 3. Company will give advance notice before a new subprocessor processes Customer Personal Data, except that an immediate replacement needed for security or service continuity will be notified without undue delay.

Customer may object before the new subprocessor begins processing, or as soon as possible after an immediate replacement, on reasonable data-protection grounds. The parties will seek a reasonable solution; if none is available, Customer may terminate the affected Service.

Company will impose the same data-protection obligations required by this DPA on each subprocessor and remains fully liable to Customer for the performance of those obligations.

5. Assistance

Taking into account the processing and information available to it, Company will reasonably assist Customer with data-subject requests, security obligations, breach notifications, data protection impact assessments, and regulator consultations required by applicable law.

If Company receives a request concerning Customer Personal Data, it will direct the requester to Customer unless law requires Company to respond. Customer will reimburse reasonable costs for assistance that goes beyond the Service’s standard functionality, unless the request results from Company’s breach of this DPA.

6. Personal data breaches

Company will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Notice will include available information reasonably needed for Customer’s notification duties and will be supplemented as information becomes available.

Company will take reasonable steps to contain, investigate, and mitigate the breach. Notification is not an admission of fault or liability. Customer’s security contact is the account contact unless it gives Company another address.

7. Return and deletion

During the term, Customer may retrieve Customer Personal Data through available export functions or request it through legal@theopenengine.com. After the processing service ends, Company will, at Customer’s choice, return or delete all Customer Personal Data and delete existing copies under its retention and backup cycles, unless law requires retention.

The Business Terms govern post-transition retrieval where the EU Data Act applies. If law requires retention, Company will isolate the retained data and process it only for that requirement.

8. Information and audits

Company will provide information reasonably necessary to demonstrate compliance with Article 28 and equivalent processor obligations. Customer should first use current independent reports, certifications, and written responses Company makes available.

If those materials are insufficient, Customer may audit relevant controls no more than once each year, and additionally after a qualifying breach or regulator request. An audit requires reasonable advance notice, must protect other customers and Company security, and must not unreasonably disrupt operations.

Customer bears its audit costs and Company’s reasonable assistance costs unless the audit finds a material Company breach. Company will promptly tell Customer if, in its opinion, an audit instruction infringes applicable data protection law.

9. International transfers

Company will not transfer Customer Personal Data from the EEA or another restricted location unless it uses a lawful transfer mechanism and any required supplementary measures. Schedule 3 identifies each subprocessor’s location and transfer mechanism. Company will make relevant transfer information available to Customer on request.

10. United States processor terms

Where US state privacy law applies, Company acts as Customer’s service provider or processor and Customer discloses Customer Personal Data only for the specific purposes in Schedule 1.

Company will not sell or share the data, retain, use, or disclose it outside those purposes or the direct business relationship, or combine it with personal data from another source except where law permits. Company will provide the same level of protection the applicable law requires, notify Customer if it can no longer comply, and allow Customer to take reasonable steps to stop and remediate unauthorized use. Company certifies that it understands and will comply with these restrictions.

Schedule 1 — Processing details

• Subject: operating and supporting the Service for Customer.
• Duration: the agreement term plus the deletion and backup period described in Section 7.
• Nature: collection, hosting, encryption, organization, transmission, execution, retrieval, and deletion.
• Purpose: providing, securing, supporting, and maintaining Customer-configured Service functions.
• People: Customer users, personnel, clients, suppliers, and others whose data Customer submits.
• Data: identity, contact, technical, usage, code, prompts, files, output, credentials, and submitted data.
• Sensitive data: not intentionally required; Customer must not submit protected health information subject to HIPAA unless the parties have signed a HIPAA-compliant business associate agreement, or other data requiring supplemental regulated-data terms unless Company agrees in writing.
• Frequency: continuous or as initiated by Customer during the term.
• Controller rights: all rights and duties provided by applicable law and this DPA.

Schedule 2 — Security measures

• Encryption for supported data in transit and at rest, with managed key and secret controls.
• Logical tenant isolation, role-based access, least privilege, and controlled administrative access.
• Authentication, session protections, logging, monitoring, and abuse controls.
• Secure development, change control, vulnerability handling, and dependency management.
• Availability, backup, recovery, and continuity measures proportionate to the Service.
• Personnel confidentiality, security awareness, incident response, and vendor risk management.
• Retention, deletion, and credential-scrubbing controls appropriate to the data lifecycle.
• Periodic testing and review of relevant technical and organizational measures.

Schedule 3 — Subprocessors

The notice process in Section 4 applies to changes.

• Amazon Web Services EMEA SARL (Luxembourg), Amazon Web Services, Inc. (United States), and AWS affiliates — cloud hosting, storage, networking, logging, backup, and transactional email; Customer Personal Data stored and primarily processed in AWS regions in the European Union, with limited processing elsewhere where needed to provide or maintain the services, complete customer-directed transfers, or comply with law; AWS Data Processing Addendum, including the EU-US Data Privacy Framework where applicable, applicable EU Standard Contractual Clauses, and supplementary measures.

11. General

The liability provisions in the Business Terms apply to this DPA to the extent law permits. This DPA lasts while Company processes Customer Personal Data. Changes required by data protection law may take effect on notice; other material changes follow the Business Terms.

Notices under this DPA go to legal@theopenengine.com.