Data Processing Addendum

1. Scope

This Data Processing Addendum ("DPA") forms part of the Terms of Service or other agreement (the "Agreement") between A11y Labs, Inc. ("Processor") and the customer ("Customer"). It applies when Inclusivio processes Customer Personal Data, meaning personal data contained in Customer Content, on Customer's behalf. It is effective automatically when Customer accepts the Agreement; a countersigned copy is available on request.

Terms such as "controller", "processor", "personal data", and "processing" have the meanings given in the GDPR, UK GDPR, and applicable US state privacy laws ("Data Protection Laws").

2. Details of processing

• Subject matter and purpose: providing the Service, including scanning web pages, storing results, generating AI fix suggestions, and support.
• Duration: the term of the Agreement plus the deletion period in section 9.
• Data subjects: Customer's authorized users, and any individuals whose personal data appears on web pages Customer scans.
• Categories of data: user names, emails, and organization roles; and any personal data contained in scanned page HTML, screenshots, or media. Customer should not scan pages containing special category data.
• Nature of processing: collection, storage, analysis, transmission to subprocessors, and deletion.

3. Processor obligations

Inclusivio will:

• Process Customer Personal Data only on Customer's documented instructions, which are the Agreement and Customer's use of the Service, unless the law requires otherwise, in which case we will inform Customer unless prohibited.
• Ensure personnel who access Customer Personal Data are bound by confidentiality.
• Implement the security measures described on our Security page.
• Not sell or share Customer Personal Data, not retain, use, or disclose it outside the direct business relationship, and not combine it with other data except as permitted by Data Protection Laws.
• Not use Customer Personal Data to train AI models.
• Assist Customer, taking into account the nature of processing, with data subject requests, security, breach notifications, and data protection impact assessments.

4. Subprocessors

Customer authorizes Inclusivio to engage the subprocessors listed on our Subprocessors page. We impose data protection terms on each subprocessor that are at least as protective as this DPA and remain responsible for their performance.

We will update the Subprocessors page at least 30 days before a new subprocessor begins processing Customer Personal Data. Customer may object on reasonable data protection grounds within that period; if we cannot reasonably resolve the objection, Customer may terminate the affected Service and receive a pro-rated refund of prepaid fees.

5. Security incidents

Inclusivio will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. We will provide available information to help Customer meet its own obligations.

6. International transfers

Inclusivio processes data in the United States. For transfers of personal data from the EEA, the parties agree to Module Two (controller to processor) of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, which are incorporated by reference. Clause 7 (docking) applies; Clause 9 option 2 (general authorization) applies with the notice period in section 4; Clause 11 optional language does not apply; Clause 17 and 18 select the law and courts of Ireland. Annex I is completed by section 2 of this DPA and Annex II by our Security page.

For UK transfers, the UK International Data Transfer Addendum to the SCCs applies. For Swiss transfers, the SCCs apply with references read as references to the Swiss Federal Act on Data Protection.

7. Audits

On written request, no more than once per year, Inclusivio will provide information reasonably necessary to demonstrate compliance with this DPA, such as security documentation and answers to questionnaires. Any on-site audit requires reasonable advance notice, is at Customer's expense, and is subject to confidentiality.

8. Customer obligations

Customer is responsible for having a lawful basis and any notices or consents needed for Inclusivio to process Customer Personal Data, and for scanning only websites it is authorized to test.

9. Deletion and return

On termination of the Agreement, Customer may export its data for 30 days. Afterwards, Inclusivio will delete Customer Personal Data within 30 days, unless retention is required by law. Backups are overwritten on their normal cycle.

10. General

Liability under this DPA is subject to the limitations in the Agreement. If this DPA conflicts with the Agreement, this DPA controls for the processing of Customer Personal Data; the Standard Contractual Clauses control over both.

Contact for data protection matters: contact@thea11ylabs.com.