Data Processing Addendum
Last updated: September 13, 2026
This Data Processing Addendum forms an integral part of the agreement between the Parties for the provision of services as set forth in the main Agreement.
This DPA applies where the Data Processor processes Personal Data on behalf of the Data Controller in connection with the services provided under the Agreement.
1. Definitions
Any term defined in the Agreement shall have the same meaning in this Data Processing Addendum unless otherwise specified.
1.1 “AI Act” means Regulation (EU) 2024/1689 on harmonised rules on artificial intelligence, together with any implementing or delegated acts.
1.2 “AI Features” means any feature of the Service that uses machine learning, large language models, or other artificial intelligence or automated-reasoning technology to analyse, generate, predict, classify, recommend or otherwise process data.
1.3 “AI Output” means any content, prediction, score, classification, recommendation or other result generated by or through the AI Features.
1.4 “AI Provider” means a third party that provides, hosts or operates an artificial intelligence model used by the AI Features.
1.5 “Agreement” means the agreement between the Data Controller and Data Processor concerning the provision of the Services.
1.6 “DPA” means this Data Processing Addendum.
1.7 “Data Controller” means the User that determines the purposes and means of the Processing of Personal Data, as defined in Article 4(7) GDPR.
1.8 “Data Processor” means the Company that processes Personal Data on behalf of the Data Controller, as defined in Article 4(8) GDPR.
1.9 “Data Protection Laws” means the GDPR, its supplementary national data protection laws, and other related legal acts applicable to the processing of Personal Data.
1.10 “Data Subject” means any identified or identifiable natural person whose Personal Data is processed under this DPA.
1.11 “Derived Data” means AI Output and any score, indicator, inference, connection path or other data generated by the Service from Personal Data processed under this DPA, to the extent that it relates to an identified or identifiable natural person.
1.12 “GDPR” means Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the Processing of Personal Data, the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
1.13 “Member States” means EEA Member States.
1.14 “Parties” means the User, as the Data Controller, and the Company, as the Data Processor, collectively.
1.15 “Personal Data” means any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR.
1.16 “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data, as defined in Article 4(12) GDPR.
1.17 “Processing” means any operation or set of operations performed on Personal Data, as defined in Article 4(2) GDPR, including but not limited to collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, restriction, erasure, or destruction.
1.18 “Sub-Processor” means any third party engaged by the Data Processor to process Personal Data on behalf of the Data Controller.
1.19 “Supervisory Authority” means the public authority established under Article 51 GDPR, responsible for monitoring compliance with data protection laws, which, in the case of the Data Processor, is the Office of the Data Protection Ombudsman of Finland.
1.20 “Technical and Organisational Measures” means the security measures implemented by the Data Processor to protect Personal Data, as required under Article 32 GDPR.
2. Scope and Purpose
2.1 This Data Processing Addendum (DPA) set out the rights and obligations of the Data Controller and the Data Processor, when Processing Personal Data on behalf of the Data Controller.
2.2 The DPA have been designed to ensure the parties’ compliance with Article 28(3) GDPR.
2.3 In the context of the provision of the services, namely offering the Service (Homie Platform) to the Data Controller, the Data Processor will process Personal Data on behalf of the Data Controller in accordance with the DPA.
2.4 The DPA shall take priority over any similar provisions contained in other agreements between the parties.
2.5 Three appendices are attached to the DPA and form an integral part of the DPA.
2.6 Appendix A contains details about the Processing of Personal Data, including the purpose and nature of the Processing, type of Personal Data, categories of data subject and duration of the Processing.
2.7 Appendix B contains the Data Controller’s conditions for the Data Processor’s use of Sub-Processors and a list of Sub-Processors authorised by the Data Controller.
2.8 Appendix C contains the Data Controller’s instructions with regards to the Processing of Personal Data, the minimum security measures to be implemented by the Data Processor.
2.9 The DPA along with appendices shall be retained available by the Data Processor on its website.
2.10 The DPA shall not exempt the Data Processor from obligations to which the Data Processor is subject pursuant to the General Data Protection Regulation (the GDPR) or other legislation.
3. The Rights And Obligation of the Data Controller
3.1 The Data Controller is responsible for ensuring that the Processing of Personal Data takes place in compliance with the GDPR (see Article 24 GDPR), the applicable EU or Member State data protection provisions and this DPA.
3.2 The Data Controller has the right and obligation to make decisions about the purposes and means of the Processing of Personal Data.
3.3 The Data Controller shall be responsible, among other, for ensuring that the Processing of Personal Data, which the Data Processor is instructed to perform, has a legal basis.
4. Data Processor Acts According to Instructions
4.1 The Data Processor shall process Personal Data only on documented instructions from the Data Controller, unless required to do so by Union or Member State law to which the processor is subject. Such instructions shall be specified in appendices A and C. Subsequent instructions can also be given by the Data Controller throughout the duration of the Processing of Personal Data, but such instructions shall always be documented and kept in writing, including electronically, in connection with the DPA.
4.2 The Data Processor shall immediately inform the Data Controller if instructions given by the Data Controller, in the opinion of the Data Processor, contravene the GDPR or the applicable EU or Member State data protection provisions.
4.3 The Data Controller’s enabling or use of the AI Features within the Service constitutes a documented instruction to process Personal Data by means of those features, as described in section 9 and Appendix A.
5. Confidentiality
5.1 The Data Processor shall only grant access to the Personal Data being processed on behalf of the Data Controller to persons under the Data Processor’s authority who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and only on a need to know basis. The list of persons to whom access has been granted shall be kept under periodic review. On the basis of this review, such access to Personal Data can be withdrawn, if access is no longer necessary, and Personal Data shall consequently not be accessible anymore to those persons.
5.2 The Data Processor shall at the request of the Data Controller demonstrate that the concerned persons under the Data Processor’s authority are subject to the abovementioned confidentiality.
6. Security of Processing
6.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Data Processor shall implement appropriate Technical and Organisational Measures to ensure a level of security appropriate to the risk.
6.2 To the extent required under applicable Data Protection Laws, the Data Processor shall also – independently from the Data Controller – evaluate the risks to the rights and freedoms of natural persons inherent in the Processing and implement measures to mitigate those risks. To this effect, the Data Controller shall provide the Data Processor with all information reasonably necessary to identify and evaluate such risks.
6.3 Furthermore, the Data Processor shall assist the Data Controller in ensuring compliance with the Data Controller’s obligations under applicable Data Protection Laws , by inter alia providing the Data Controller with information concerning the Technical and Organisational Measures already implemented by the Data Processor along with all other information necessary for the Data Controller to comply with the Data Controller’s obligation under the applicable Data Protection Laws.
6.4 If subsequently – in the assessment of the Data Controller – mitigation of the identified risks require further measures to be implemented by the Data Processor, than those already implemented by the data, the Data Controller can request details concerning these measures by contacting the Data Processor.
7. Use of Sub-Processors
7.1 The Data Processor shall meet the requirements specified under applicable Data Protection Laws including Article 28(2) and (4) GDPR in order to engage another processor (a Sub-Processor).
7.2 The Data Processor shall therefore not engage another processor (Sub-Processor) for the fulfilment of the DPA without the prior general written authorisation of the Data Controller.
7.3 The Data Processor has the Data Controller’s general authorisation to engage Sub-processors. Details regarding the listing of Sub-processors and the procedure for notifying additions or replacements are specified in Appendix B.
7.4 Where the Data Processor engages a Sub-Processor for carrying out specific Processing activities on behalf of the Data Controller, the same data protection obligations as set out in the DPA shall be imposed on that Sub-Processor by way of a contract or other legal act under EU or Member State law, in particular providing sufficient guarantees to implement appropriate Technical and Organisational Measures in such a manner that the Processing will meet the requirements of the DPA and the GDPR.
7.5 The Data Processor shall therefore be responsible for requiring that the Sub-Processor at least complies with the obligations to which the Data Processor is subject pursuant to the DPA and the GDPR.
7.6 A copy of such a Sub-Processor agreement and subsequent amendments shall – at the Data Controller’s request – be submitted to the Data Controller, thereby giving the Data Controller the opportunity to ensure that the same data protection obligations as set out in the DPA are imposed on the Sub-Processor. Amendments to the Sub-Processor agreement on business related issues do not affect the legal data protection content of the Sub-Processor agreement, shall not require submission to the Data Controller.
7.7 If the Sub-Processor does not fulfil his data protection obligations, the Data Processor shall remain fully liable to the Data Controller as regards the fulfilment of the obligations of the Sub-Processor. This does not affect the rights of the Data Subjects under the GDPR – in particular those foreseen in Articles 79 and 82 GDPR – against the Data Controller and the Data Processor, including the Sub-Processor.
7.8 An AI Provider engaged by the Data Processor is a Sub-Processor for the purposes of this section 7 and Appendix B. A change to the artificial intelligence model used by an existing AI Provider does not constitute the addition or replacement of a Sub-Processor, provided that the Processing remains with that AI Provider and within the same hosting location. The engagement of a new AI Provider constitutes the addition of a Sub-Processor, and the notification and objection procedure in Appendix B applies to it.
8. Transfer of Data to Third Countries
8.1 Any transfer of Personal Data to third countries or international organisations by the Data Processor shall only occur on the basis of documented instructions from the Data Controller and shall always take place in compliance with Chapter V GDPR.
8.2 In case transfers to third countries or international organisations, which the Data Processor has not been instructed to perform by the Data Controller, is required under EU or Member State law to which the Data Processor is subject, the Data Processor shall inform the Data Controller of that legal requirement prior to Processing unless that law prohibits such information on important grounds of public interest.
8.3 The Data Controller shall only transfer Personal Data to a Data Controller or a Data Processor in a third country or an international organisation, to a Sub-Processor in a third country, or allow Personal Data to be processed in a third country by the Data Processor where Appendix C instructs to do so.
8.4 The Data Controller’s instructions regarding the transfer of Personal Data to a third country including, if applicable, the transfer tool under Chapter V GDPR on which they are based, shall be set out in Appendix C.
8.5 The DPA shall not be confused with standard data protection terms within the meaning of Article 46(2)(c) and (d) GDPR, and the DPA cannot be relied upon by the parties as a transfer tool under Chapter V GDPR.
8.6 Processing carried out by the AI Features takes place within the Member States. The Data Processor shall give notice in accordance with Appendix B before any AI Provider begins to process Personal Data in a third country.
9. Artificial Intelligence Features
9.1 The Service includes AI Features. The Data Processor shall process Personal Data by means of the AI Features only in order to provide the Service to the Data Controller and on the Data Controller’s documented instructions as set out in section 4 and Appendix C.
9.2 The AI Features analyse business network and relationship data in order to identify how closely a person is connected to a user of the Service within a professional network and to indicate possible warm introduction paths. The categories of Personal Data processed and the Derived Data generated are described in Appendix A.
9.3 The Data Processor shall not use Personal Data processed on behalf of the Data Controller to train the general-purpose artificial intelligence models underlying the AI Features. This section 9.3 does not restrict Processing that is necessary to provide, maintain, secure and improve the Service for the Data Controller’s own account, and is subject to section 9.9.
9.4 The Data Processor shall require each AI Provider, by way of a contract or other legal act under EU or Member State law, (a) not to use Personal Data processed under this DPA for its own purposes, including the training or fine-tuning of any model; (b) not to retain such Personal Data for longer than is necessary to return the AI Output and to comply with the AI Provider's own legal obligations; and (c) to engage AI Providers only under a written contract imposing obligations that meet the requirements of section 7.
9.5 Each AI Provider engaged by the Data Processor shall process Personal Data within the Member States. The Data Processor shall not engage an AI Provider that processes Personal Data in a third country otherwise than in accordance with sections 7 and 8.
9.6 AI Output is generated using probabilistic models and may be incomplete, inaccurate or outdated. The Data Controller is responsible for ensuring that AI Output is reviewed by a qualified human before it is relied upon, and shall not instruct the Data Processor to use the AI Features as the sole basis for a decision that produces legal effects concerning, or similarly significantly affects, a Data Subject.
9.7 For the purposes of the AI Act, the Data Processor acts as a provider and the Data Controller acts as a deployer in respect of the AI Features, and each party is responsible for its own obligations in that capacity. The Data Controller is responsible for informing individuals where required under Article 50 of the AI Act, and for assessing whether its particular use of the AI Features constitutes a high-risk AI system within the meaning of Article 6 and Annex III of the AI Act.
9.8 At the request of the Data Controller, the Data Processor shall provide information about the AI Features that is reasonably necessary for the Data Controller to carry out a data protection impact assessment or to meet its own obligations under the AI Act.
9.9 The Data Processor may aggregate and anonymise Personal Data processed under this DPA so that it no longer relates to an identified or identifiable natural person, and may use the resulting anonymised data for the development and improvement of the Service, including the AI Features. The Data Processor may do so only where (a) the Data Controller has agreed to it in writing, or (b) a user with account administrator rights has enabled the corresponding setting within the Service. The Data Controller may withdraw that agreement, or disable that setting, at any time with effect for the future.
9.10 Anonymisation under section 9.9 shall be carried out so that re-identification is not reasonably possible by any means reasonably likely to be used, taking account of all objective factors. The Data Processor shall not attempt to re-identify anonymised data and shall not combine it with other data for that purpose. In respect of anonymised data the Data Processor acts for its own purposes, and such data is not subject to sections 4, 10 and 12.
10. Assistance to the Data Controller
10.1 Taking into account the nature of the Processing, the Data Processor shall assist the Data Controller by appropriate Technical and Organisational Measures, insofar as this is possible, in the fulfilment of the Data Controller’s obligations to respond to requests for exercising the Data Subject’s rights laid down in Chapter III GDPR.
10.2 This entails that the Data Processor shall, insofar as this is possible, assist the Data Controller in the Data Controller’s compliance with:
a. the right to be informed when collecting Personal Data from the Data Subject
b. the right to be informed when Personal Data have not been obtained from the Data Subject
c. the right of access by the Data Subject
d. the right to rectification
e. the right to erasure (‘the right to be forgotten’)
f. the right to restriction of Processing
g. notification obligation regarding rectification or erasure of Personal Data or restriction of Processing
h. the right to data portability
i. the right to object
j. the right not to be subject to a decision based solely on automated Processing, including profiling
10.3 In addition to the Data Processor’s obligation to assist the Data Controller pursuant to section 10.1, the Data Processor shall furthermore, taking into account the nature of the Processing and the information available to the Data Processor, assist the Data Controller in ensuring compliance with:
a. the Data Controller’s obligation to without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the Personal Data Breach to the Supervisory Authority, Office of the Data Protection Ombudsman, unless the Personal Data Breach is unlikely to result in a risk to the rights and freedoms of natural persons;
b. the Data Controller’s obligation to without undue delay communicate the Personal Data Breach to the Data Subject, when the Personal Data Breach is likely to result in a high risk to the rights and freedoms of natural persons;
c. the Data Controller’s obligation to carry out an assessment of the impact of the envisaged Processing operations on the protection of Personal Data (a data protection impact assessment);
d. the Data Controller’s obligation to consult the Supervisory Authority, prior to Processing where a data protection impact assessment indicates that the Processing would result in a high risk in the absence of measures taken by the Data Controller to mitigate the risk.
10.4 The parties shall define in Appendix C the appropriate Technical and Organisational Measures by which the Data Processor is required to assist the Data Controller as well as the scope and the extent of the assistance required. This applies to the obligations foreseen in section 10.1. and 10.2.
10.5 The Data Processor’s assistance under section 10.1 extends to Derived Data. At the Data Controller’s instruction, the Data Processor shall locate, rectify, restrict, export or erase Derived Data relating to an identified Data Subject, including AI Output generated about that Data Subject.
10.6 Where a Data Subject objects to Processing carried out by the AI Features, or requests human intervention in relation to AI Output, the Data Processor shall refer the request to the Data Controller and shall, at the Data Controller’s instruction, cease to apply the AI Features to that Data Subject where technically feasible.
11. Notification of Personal Data Breach
11.1 In case of any Personal Data Breach, the Data Processor shall, without undue delay after having become aware of it, notify the Data Controller of the Personal Data Breach.
11.2 The Data Processor’s notification to the Data Controller shall, if possible, take place within 72 hours after the Data Processor has become aware of the Personal Data Breach to enable the Data Controller to comply with the Data Controller’s obligation to notify the Personal Data Breach to the Supervisory Authority, cf. Article 33 GDPR.
11.3 In accordance with section 10.2 (a), the Data Processor shall assist the Data Controller in notifying the Personal Data Breach to the Supervisory Authority, meaning that the Data Processor is required to assist in obtaining the information listed below which, pursuant to Article 33(3)GDPR, shall be stated in the Data Controller’s notification to the Supervisory Authority:
a. The nature of the Personal Data including where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned;
b. the likely consequences of the Personal Data Breach;
c. the measures taken or proposed to be taken by the controller to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.
11.4 The parties shall define in Appendix C all the elements to be provided by the Data Processor when assisting the Data Controller in the notification of a Personal Data Breach to the Supervisory Authority
12. Erasure of Data
12.1 On termination of the Agreement, including also the removal of the User’s account from the Service (Homie Platform) the Data Processor shall be under obligation to delete all Personal Data processed on behalf of the Data Controller unless Union or Member State law requires storage of the Personal Data. This removal shall be carried out within 90 days from the termination and removal of removal of the User’s account from the Service (Homie Platform).
12.2 Erasure under section 12.1 includes Derived Data. Erasure does not extend to data that has been anonymised in accordance with section 9.9.
13. The Parties’ Agreement on Other Terms
13.1 The parties may agree other terms concerning the provision of the Personal Data Processing service specifying e.g. liability, as long as they do not contradict directly or indirectly the DPA or prejudice the fundamental rights or freedoms of the Data Subject and the protection afforded by the GDPR.
14. Commencement and Termination
14.1 The DPA shall become effective when the Agreement becomes effective between the Parties.
14.2 The DPA shall apply for the duration of the provision of Services under the Agreement. For the duration of the provision of the Services, the DPA cannot be terminated unless other DPA governing the provision of the Services have been agreed between the parties.
14.3 If the Agreement is terminated, including the removal of the User’s account from the Service (Homie Platform), and the Personal Data is deleted or returned to the Data Controller pursuant to section 12.1, this DPA shall automatically cease to apply between the Parties.
15. Data Controller and Data Processor Contacts
15.1 In connection with this DPA such as in case of a data breach the Data Processor shall contact the Data Controller using the contact details listed in the User’s contact details in the Service (Homie Platform). The Data Controller is liable to ensure that the contact details listed in the User’s profile in the Service are up-to-date at all times.
15.2 The Data Controller shall contact the Data Processor using the contact details listed in the Data Controller’s website.
16. Changes to the Data Processing Appendix
16.1 This DPA is an appendix to the main Agreement and may be updated from time to time by the Data Processor to reflect changes in the Processing of Personal Data. Any updates to this DPA shall be made in accordance with the amendment process outlined in the main Agreement.
16.2 If a revision to this DPA is material, the Data Processor shall provide prior notice to the Data Controller, as further specified in the main Agreement.
17. Governing Law and Dispute Resolution
17.1 This DPA shall be governed by the laws specified in the main Agreement. However, if the main Agreement is governed by the laws of a non-Member State, this DPA shall instead be governed by the laws of Finland.
17.2 Any disputes arising in connection with this DPA shall be resolved in the venue specified in the main Agreement. However, if the venue specified in the main Agreement is not a court of law (e.g., arbitration) or is located outside a Member State, disputes relating to this DPA shall be finally settled by the District Court of Helsinki.
17.3 Nothing in this clause shall affect the application of the GDPR, including any statutory provisions that may override the governing law and dispute resolution provisions of this DPA.
Appendix A: Details of the Processing
1. The purpose of the data processor’s Processing of personal data on behalf of the data controller is to facilitate the provision of the services in connection with the Homie platform offered by the data processor to the data controller.
2. The data processor’s Processing of personal data on behalf of the data controller shall mainly pertain to (the nature of the Processing):
a. The data processor’s Processing of personal data on behalf of the data controller shall primarily involve collecting, storing, and analysing personal information to facilitate the functionalities of the Homie platform.
b. The Processing involves identifying sales paths through the networks of employees, customers, partners, and other advocates, enabling the data controller to connect with ideal customers more effectively. Additionally, the Processing supports functionalities such as advocate introductions and referral tracking, thereby streamlining customer acquisition efforts.
c. Besides the sales paths, networks and advocates related Processing the data processor processed data in connection with user accounts, communication between users, and ensuring the platform’s security and operational efficiency.
d. The Processing includes analysis carried out by the AI Features, which determine how closely a person is connected to a user of the Homie platform within a professional network and indicate possible warm introduction paths. That analysis generates Derived Data.
3. The Processing includes the following types of personal data about data subjects:
a. Personal Identification Information: Name, social media accounts related identifiers, data and connections, and contact details such as email address and phone number.
b. Account Information: Username, password, and other credentials necessary for account access.
c. Usage Data: Information on how data subjects interact with the Homie platform, including service usage patterns and preferences.
d. Communication Records: Logs of communications between data subjects and the platform, including messages and support inquiries.
e. Technical Data: IP addresses, device information, and other technical identifiers connected to data subjects.
f. Network and Relationship Data: Connections between data subjects and users of the Homie platform, shared connections, and the professional relationships between them.
g. Derived Data: Connection-strength and proximity indicators, suggested introduction paths, and other results generated by the AI Features about a data subject.
4. Processing includes the following categories of data subject:
a. Prospects and Customers: Individuals who have registered on the Homie platform to access services.
b. Co-Workers: Staff members of the data controller whose information is processed for operational purposes and to facilitate the use of Homie platform.
c. Service Providers: Third-party vendors or contractors engaged by the data controller, whose data is necessary for service facilitation.
d. Platform Visitors: Individuals who interact with the Homie platform’s online interfaces, including potential customers and casual browsers.
e. Prospective Business Contacts: Individuals who have not registered on the Homie platform and whose connection to the network of the data controller or its co-workers is analysed by the AI Features.
5. The Data Processor’s Processing of Personal Data on behalf of the data controller may be performed when the DPA commence. The Processing shall take place for the duration of the agreement between the controller and the processor concerning the Homie platform and will cease upon when the agreement is no longer in effect between the Parties.
Appendix B: Sub-Processors
1. On commencement of the DPA, the Data Processor shall be entitled to use Sub-Processors listed in the Data Processor’s website (www.usehomie.com/legal/sub-processors/). The Data Processor shall ensure that the listing is constantly updated in case of any changes, namely additions or replacements of the Sub-Processors.
2. When a new Sub-Processor is to be engaged by the data processor for Processing activities under the agreement and this DPA, notice shall be sent via email to the data controller’s contact person at least 30 days prior to engaging the new processor.
3. The data controller may object to the engagement of a new processor by sending a notification via email to the contact person specified in the DPA, provided that there are substantial grounds for deeming the processor non-compliant with the obligations set forth by the GDPR. If no objection is raised within the 30-day period following the date of notice to the data controller, the sub-processor may be engaged in the Processing activity by the data processor.
4. AI Providers engaged by the Data Processor are Sub-Processors and are included in the listing referred to in paragraph 1 of this Appendix B. A change to the artificial intelligence model used by an existing AI Provider does not constitute the addition or replacement of a Sub-Processor, as set out in section 7.8
Appendix C: Instruction on the Processing
1. The data processor’s Processing of personal data on behalf of the data controller shall be carried out by the data processor performing the following:
a. Collecting, storing, and organising personal data as instructed by the data controller to facilitate the agreed-upon services.
b. Processing data to support functionalities of the services provided under the agreement, including communication with data processor customers, prospects and other stakeholders, and platform operations.
c. Ensuring secure management of personal data, including implementing Technical and Organisational Measures to safeguard data.
d. Deleting personal data upon termination of the agreement provided that the User’s account has been removed from the Service (Homie Platform).
e. Processing Personal Data by means of the AI Features in order to identify how closely a person is connected to a user of the Homie platform and to indicate possible warm introduction paths, as described in section 9 and Appendix A.
2. The level of security shall take into account:
a. The personal data processed by the data processor on behalf of the data controller involves generic data about the co-workers, customers, prospects and other stakeholders that are connected to the data controller.
b. The data does not include any sensitive data that is subject to Article 9 GDPR on ‘special categories of personal data’ and the scope of the Processing is limited to data that does not impose high risk for the rights and freedoms of the individuals.
c. The parties acknowledge that the Processing carried out by the AI Features may involve the evaluation of personal aspects relating to natural persons within the meaning of Article 35(3)(a) GDPR. The data controller is responsible for assessing whether a data protection impact assessment is required in respect of its use of the AI Features, and the data processor shall assist in accordance with section 9.8.
d. Based on the relevant factors in connection with the risk level deemed appropriate by the data processor the data processor shall establish relevant technical and organisational security measures that are to be applied for the data Processing. The Data Controller may request details concerning the Technical and Organisational Measures by contacting the Data Processor.
3. The data processor shall insofar as this is possible assist the data controller in accordance with section 10.1. and 10.2. by having relevant communication tool and resources to communicate with the data controller in case of Personal Data Breach and means and methods to provide details required by the GDPR in connection with incident and being capable to provide notice to the Supervisory Authority whenever required by the GDPR.
4. The data processor shall impose on each AI Provider the restrictions set out in section 9.4, including the prohibition on using Personal Data for model training and the limitation on retention of Personal Data.
5. The following instructions have been provided regarding the storage period and Personal Data erasure procedures:
a. Personal data is stored for the period during which the data subject uses the service and maintains an account on the platform, or for the duration of the agreement between the data controller and the data processor, whichever comes first. After this period, the personal data is erased by the data processor. A data subject may, at any time, decide to remove their account from the platform, in which case the personal data is automatically erased by the data processor’s system.
b. Upon termination of the provision of personal data Processing services, the data processor shall delete the personal data in accordance with section 12.1, unless the data controller and data processor have explicitly agreed contrary in writing. Such agreement shall be signed by the representatives of both data processor and data controller in connection with the DPA.
6. The Data Controller instructs the Data Processor to share Personal Data with other independent data controllers and independent processors of the Data Controller in connection with executing third-party integrations with the Service when carried out by the Data Processor within the Service (Homie Platform). The Data Controller, in connection with this data sharing, has executed relevant agreements with the independent data controllers and their independent data processors. These recipients are considered independent data recipients under Data Protection Laws and receive Personal Data to the extent authorised by the Data Controller as part of the platform.
7. Processing of the personal data under the DPA can be performed at any location of the data processor and its sub-processor provided that when transferring data to third countries appropriate safeguards are in place, namely adequacy decision, standard contractual clauses or similar appropriate safeguards.
8. The data controller instructs the data processor and its sub-processors to transfer personal data to third countries (countries other than Member States) only if the following conditions are met:
a. An adequacy decision has been issued by the European Commission for the recipient country or organisation (Article 45 GDPR);
b. Appropriate safeguards, such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs), are in place (Article 46 GDPR)
c. The transfer is based on specific derogations as outlined in Article 49 GDPR, and the data controller has provided that the Processing shall take place.
9. If the Data Controller notifies the Data Processor of a new Sub-Processor that relies on the Standard Contractual Clauses (SCCs) and processes Personal Data in countries other than Member States, the Data Processor shall ensure that the DPA is updated when necessary. Furthermore, in circumstances where the Data Controller relies on the SCCs, it shall ensure that it has executed all relevant agreements with the Sub-Processor concerning the transfer of Personal Data to countries outside the Member States, in compliance with the GDPR.