Data Processing Addendum

This Data Processing Addendum ("DPA") is incorporated by reference into the Terms of Service or other written agreement (the "Agreement") between Customer and brightstack AI, Inc. (brightstack) governing Customer's use of the Service. This DPA governs the Processing of Personal Data by brightstack on behalf of Customer in connection with the Agreement.

This DPA is a click-through agreement: by accepting the Agreement and using the Service, Customer accepts this DPA on behalf of itself and any Authorized Affiliates whose Personal Data is Processed by brightstack under the Agreement. Customers requiring a counter-signed version may contact [email protected].

In the event of a conflict between this DPA and the Agreement with respect to the Processing of Personal Data, this DPA controls.

Capitalized terms not defined in this DPA have the meanings given in the Agreement or in applicable Data Protection Laws. The following terms apply throughout this DPA:

• "Customer Personal Data" means Personal Data that brightstack Processes on behalf of Customer in providing the Service.
• "Data Protection Laws" means all laws and regulations applicable to the Processing of Customer Personal Data, including (i) the EU General Data Protection Regulation 2016/679 ("EU GDPR"); (ii) the UK Data Protection Act 2018 and the UK GDPR ("UK GDPR"); (iii) the Swiss Federal Act on Data Protection ("Swiss FADP"); and (iv) US state privacy laws including the CCPA / CPRA, VCDPA, CPA, CTDPA, and equivalents.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision 2021/914 of 4 June 2021 (Module 2: Controller to Processor).
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the UK Information Commissioner.
• "Subprocessor" means any Processor engaged by brightstack (or by another Subprocessor) to Process Customer Personal Data.

The terms Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Process/Processing, and Supervisory Authority have the meanings given in the GDPR.

• For the purposes of Data Protection Laws, Customer is the Controller of Customer Personal Data and brightstack is the Processor.
• Where Customer Personal Data originates from a third-party Controller (for example, Customer's own customer or end user), Customer is acting as a Processor or sub-Processor and brightstack is acting as a sub-Processor. Customer is responsible for obtaining the necessary authorizations from the upstream Controller.
• Each party will comply with its obligations under applicable Data Protection Laws.

brightstack will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing as well as the risk to Data Subjects. The current measures are described in Annex II (Technical and organizational measures). brightstack may update these measures from time to time, provided that no update will materially decrease the overall level of protection.

• Customer grants brightstack a general authorization to engage Subprocessors, subject to this Section 5.
• brightstack maintains a current list of Subprocessors at brightstack.ai/legal/subprocessors, which is incorporated into this DPA by reference and reproduced in Annex III.
• brightstack will provide Customer with at least 10 business days' prior written notice (which may be by email or a notice on the Subprocessors page) of any new Subprocessor or material change to an existing one. Customer may subscribe to change notifications by emailing [email protected] with the subject "subprocessors."
• Customer may object on reasonable grounds related to data protection within the notice period by emailing the address above. brightstack will work in good faith to resolve the objection. If no resolution can be reached, Customer may terminate the affected portion of the Service for convenience without penalty.
• brightstack will impose data protection obligations on each Subprocessor that are no less protective than those in this DPA and remains liable to Customer for the acts and omissions of its Subprocessors as if they were its own.

Taking into account the nature of the Processing, brightstack will assist Customer by appropriate technical and organizational measures, insofar as this is possible, in fulfilling Customer's obligation to respond to requests from Data Subjects to exercise their rights under Data Protection Laws (including rights of access, rectification, erasure, restriction of Processing, data portability, and objection).

If brightstack receives a request directly from a Data Subject relating to Customer Personal Data, brightstack will, unless legally prohibited, promptly forward the request to Customer and will not respond on Customer's behalf except on Customer's documented instructions or as required by law.

brightstack will notify Customer without undue delay (and in any event within seventy-two (72) hours) after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will, to the extent then known and as such information becomes available, describe: (i) the nature of the Personal Data Breach including the categories and approximate number of Data Subjects and records concerned; (ii) the likely consequences; (iii) the measures taken or proposed to address the Personal Data Breach and to mitigate its possible adverse effects; and (iv) the contact point at brightstack for further information.

brightstack's notification of a Personal Data Breach is not an acknowledgment of fault or liability.

Taking into account the nature of the Processing and the information available to brightstack, brightstack will provide reasonable assistance to Customer with any Data Protection Impact Assessments and prior consultations with Supervisory Authorities that Customer is required to carry out under Data Protection Laws.

On termination or expiration of the Agreement, or upon Customer's written request, brightstack will, at Customer's choice, return or delete all Customer Personal Data in brightstack's possession or control. brightstack will hard-delete Customer Personal Data from active systems within thirty (30) days of termination, unless retention is required by applicable law. Encrypted backups are retired on their normal rotation schedule, no later than ninety (90) days after deletion.

• brightstack will make available to Customer, upon reasonable request and not more than once per year, the most recent third-party security audit report (for example, SOC 2 Type II) and a summary description of the technical and organizational measures in place. These materials may be provided under NDA.
• To the extent the audit reports made available do not provide sufficient information to demonstrate compliance with this DPA, Customer may, at its own expense, conduct an audit of brightstack's relevant processing activities. Audits will be conducted during business hours, with at least thirty (30) days' prior written notice, no more than once per twelve-month period (except following a Personal Data Breach), and subject to reasonable confidentiality and security requirements. The auditor must not be a competitor of brightstack.

• Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Agreement.
• This DPA will continue in force for as long as brightstack Processes Customer Personal Data on behalf of Customer.
• In the event of any conflict between this DPA and the SCCs, the SCCs prevail to the extent strictly necessary to comply with applicable Data Protection Laws.

brightstack maintains the following measures, which may evolve over time provided they do not materially decrease the overall level of protection.

• Encryption. All Customer Personal Data in transit is protected with TLS 1.2 or higher. All Customer Personal Data at rest is encrypted with AES-256 or equivalent.
• Access control. Production access is restricted to authorized personnel, gated by single sign-on with mandatory multi-factor authentication and short-lived credentials. Access follows least privilege and is reviewed at least quarterly.
• Network and infrastructure security. Production workloads run on hardened cloud platforms (Fly.io, Neon, Upstash) with network isolation, rate limiting, and continuous monitoring.
• Logging and monitoring. Centralized logging and metrics in Datadog with alerting on security-relevant events; logs are retained for at least 90 days.
• Secure software development. Code review for production changes, automated dependency scanning, static analysis on the main branch, and a documented release process.
• Vulnerability management. Regular vulnerability scanning, patching of critical findings on a defined SLA, and an internal program to triage external reports.
• Backups. Encrypted backups of primary data stores with periodic restore testing.
• Incident response. Documented incident response plan with defined roles, escalation paths, and breach notification procedures aligned with Section 7 of this DPA.
• Personnel. Background checks where permitted by law, security training at onboarding and at least annually, and contractual confidentiality obligations for all personnel with access to Customer Personal Data.
• Vendor management. Subprocessors are reviewed before engagement and contractually bound to data protection obligations no less protective than this DPA.
• Business continuity. Disaster-recovery procedures with defined RTO and RPO targets and periodic testing.
• Data minimization. Customer Personal Data is collected and retained only as necessary to provide the Service.

The following Subprocessors are authorized as of the effective date of this DPA. The current list is maintained at brightstack.ai/legal/subprocessors.