Data Processing Addendum

This Data Processing Addendum (“DPA”) is entered into between Between Technologies FZ-LLC (“b2n.ai”) and the Customer, and forms part of the Terms of Service (the “Agreement”). Capitalised terms not defined here have the meanings given in the Agreement.

“Personal Data” means personal data contained in Customer Data or Prospect Data that b2n.ai processes on behalf of Customer in providing the Services. “Data Protection Laws” means all data protection laws that apply to that processing, including, where applicable, the EU General Data Protection Regulation (“GDPR”), the UK GDPR, UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“UAE PDPL”), and the Saudi Personal Data Protection Law (“Saudi PDPL”), the DIFC Data Protection Law (DIFC Law No. 5 of 2020), the ADGM Data Protection Regulations 2021 and the Swiss Federal Act on Data Protection.

As between the parties, Customer is the controller of the Personal Data and b2n.ai is its processor. Where Customer is itself a processor for a third party, b2n.ai acts as Customer’s sub-processor and Customer is responsible for passing on any instructions of that third party.

This DPA does not apply to Personal Data that b2n.ai processes as a controller: business-contact data b2n.ai holds independently of any customer, b2n.ai’s own outreach, the platform-wide block list in Section 12, and the account, billing and usage data of Customer’s authorised users. Where b2n.ai makes business-contact data it holds available for Customer’s campaigns, b2n.ai discloses it as an independent controller, and Customer is the controller of its use in those campaigns.

This DPA applies to all processing of Personal Data by b2n.ai on behalf of Customer in connection with the Agreement. The subject matter, nature, purpose and duration of the processing, and the categories of data subjects and Personal Data, are set out in Annex 1. This DPA remains in force for as long as b2n.ai processes Personal Data on behalf of Customer, including after termination of the Agreement until the Personal Data is returned or deleted under Section 10.

b2n.ai will process Personal Data only on Customer’s documented instructions, including with regard to transfers, unless required to do otherwise by applicable law, in which case b2n.ai will inform Customer of that legal requirement before processing unless the law prohibits it. The Agreement, this DPA, Customer’s settings in the Services and each campaign Customer launches or approves are Customer’s documented instructions (Agreement, Section 6.4).

Customer is responsible for the lawfulness of its instructions and for having a lawful basis for the processing. b2n.ai will inform Customer promptly if, in b2n.ai’s opinion, an instruction infringes Data Protection Laws, and may suspend the affected processing until Customer confirms or changes the instruction (Agreement, Section 6.6).

b2n.ai will ensure that all persons it authorises to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to those who need it to provide the Services.

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, b2n.ai will implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, including the measures described in Annex 2. b2n.ai may update those measures, provided that the overall level of protection is not reduced.

Customer gives b2n.ai general authorisation to engage the sub-processors in the categories listed in Annex 3. b2n.ai will impose on each sub-processor, by written contract, data protection obligations no less protective than those in this DPA, including the restriction on training AI models in Section 8 of the Agreement, and remains responsible to Customer for the performance of each sub-processor’s obligations.

b2n.ai will notify Customer at least 30 days before adding or replacing a sub-processor that processes Personal Data. Customer may object in writing to privacy@b2n.ai on reasonable data-protection grounds within that period. The parties will discuss the objection in good faith; if they cannot resolve it within 30 days, Customer may terminate the affected Services by written notice and receive a refund of prepaid fees for the unused remainder of the term. The named list of sub-processors forms part of Annex 3.

Taking into account the nature of the processing, b2n.ai will assist Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling Customer’s obligation to respond to requests from data subjects to exercise their rights under Data Protection Laws. If b2n.ai receives such a request relating to Customer’s processing, b2n.ai will forward it to Customer without undue delay and will not respond to it other than to direct the data subject to Customer, except that b2n.ai will act on unsubscribes and objections to direct marketing under Section 12. b2n.ai will also assist Customer, taking into account the information available to b2n.ai, with its obligations on security, breach notification, data protection impact assessments and prior consultation.

b2n.ai will notify Customer without undue delay after becoming aware of a personal data breach affecting Personal Data. The notice will describe, to the extent then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it, and will name a contact for further information. Where not all information is available at once, b2n.ai will provide it in phases without undue further delay. b2n.ai will take reasonable steps to contain and remedy the breach and will cooperate with Customer in meeting its own notification obligations.

b2n.ai will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, starting with b2n.ai’s security overview and written answers to Customer’s reasonable questions. Where that documentation does not reasonably satisfy Customer’s obligations, Customer may, no more than once in any twelve-month period and on reasonable prior written notice, carry out an audit itself or through an independent auditor bound by confidentiality, during business hours and without access to data of other customers. Each party bears its own costs of an audit. Additional audits are permitted where required by a supervisory authority or following a personal data breach affecting Customer’s Personal Data.

Upon termination of the Agreement, Customer may export Customer Data and the Personal Data processed for its campaigns for a period of 30 days from the effective date of termination (Agreement, Section 10). b2n.ai retains the Personal Data until Customer asks b2n.ai in writing to delete it, which Customer may do at any time. b2n.ai will then, without undue delay, delete or anonymise the Personal Data, unless applicable law requires b2n.ai to retain it, in which case b2n.ai will keep it confidential and process it only for the purpose for which it is retained. Records of opt-outs and objections are retained for as long as necessary to continue honouring them. This Section does not apply to data b2n.ai processes as a controller (Section 1).

Where the processing involves a transfer of Personal Data from the EEA, the UK or Switzerland to a country without an adequacy decision, the Standard Contractual Clauses in the Annex to Commission Implementing Decision (EU) 2021/914 (Module 2 where Customer is a controller, Module 3 where Customer is a processor) are incorporated by reference, with Customer as data exporter and b2n.ai as data importer, and completed as follows: Clause 7 applies; Clause 9(a) Option 2 applies, with the notice period in Section 6; the option in Clause 11(a) does not apply; for Clause 13, the competent supervisory authority is that of the Member State in which Customer is established or, where Customer is not established in the EEA, the authority determined under Clause 13(a); and Annexes I, II and III are Annexes 1, 2 and 3 of this DPA, with the parties’ details as set out in the Agreement. For transfers from the UK, the International Data Transfer Addendum issued by the Information Commissioner (version B1.0) applies, with Tables 1 to 3 completed by this DPA. For transfers from Switzerland, the Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection where it applies.

Transfers of Personal Data outside the United Arab Emirates are made in accordance with Articles 22 and 23 of the UAE PDPL. Transfers of Personal Data outside the Kingdom of Saudi Arabia are made in accordance with the Saudi PDPL and its implementing regulations on transfers outside the Kingdom.

Communications prepared, scheduled or sent by the Services for Customer, including through mailboxes, domains or accounts operated by b2n.ai, are sent on Customer’s behalf. As between the parties, Customer is their sender and is responsible for their lawfulness as set out in Section 6.1 of the Agreement. Customer instructs b2n.ai to apply opt-outs across the Services: b2n.ai suppresses opt-outs and objections it identifies across all of Customer’s campaigns, and suppresses hard bounces, spam traps and explicit spam complaints across the Services. b2n.ai keeps that platform-wide block list as an independent controller, only to protect recipients and deliverability.

In the event of a conflict, the following order of precedence applies: (a) the Standard Contractual Clauses, where they apply; (b) this DPA; and (c) the rest of the Agreement. Otherwise, the Agreement, including its limitation of liability, applies to this DPA.

Except where the Standard Contractual Clauses or Data Protection Laws require otherwise, this DPA is governed by the laws of the Dubai International Financial Centre, and the parties submit to the exclusive jurisdiction of the DIFC Courts (Dubai International Financial Centre), as set out in Section 15 of the Agreement.

Subject matter. The provision of the Services to Customer under the Agreement.

Nature of the processing. Collection, research, enrichment, storage, scoring of accounts and contacts for fit, drafting and sending of messages, classification of replies, booking of meetings, suppression of opt-outs, and deletion.

Purpose. To find, research and contact business prospects for Customer, and to operate the Services, on Customer’s instructions.

Categories of data subjects. (a) Customer’s authorised users; and (b) prospects: business contacts that Customer researches or contacts through the Services.

Categories of Personal Data. For authorised users: content they compose or approve in the Services and their activity in campaigns (b2n.ai processes their account, billing and usage data as a controller under its Privacy Policy). For prospects: name, job title, employer, work email and phone, professional profile URL, company information, engagement with messages, the content of replies and conversations, opt-out records, and fit scores. b2n.ai does not intend to process special categories of personal data.

Duration. The term of the Agreement and afterwards until the Personal Data is deleted under Section 10.

• Encryption of Personal Data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent).
• Access to production systems limited to b2n.ai’s founding team, with multi-factor authentication, on a principle-of-least-privilege basis.
• Security review of vendors before engagement.
• Vulnerability monitoring.
• An incident-response process consistent with GDPR Articles 32 and 33.
• No use of Customer Data, Prospect Data or message content to train, fine-tune or otherwise adapt any AI model, with equivalent restrictions imposed on sub-processors by contract.
• Personal Data is never sold.