Data Processing Addendum

2. Scope and Roles

2.1. Roles. The Customer is the controller of Customer Personal Data, or, where the Customer processes Customer Personal Data on behalf of its own clients, a processor acting on their instructions. open session is the Customer's processor. Where the CCPA applies, the Customer is the business, or a service provider or contractor acting for a business, and open session is the Customer's service provider. Where the Customer acts as a processor, it represents that the relevant controller has authorized the Customer to appoint open session as a sub-processor and to provide the documented instructions contemplated by this DPA.

2.2. Description of Processing. Annex I describes the subject matter, duration, nature, and purpose of the processing, the categories of Customer Personal Data, and the categories of Data Subjects.

2.3. Independent Processing. This DPA does not apply to the personal information that open session processes as an independent controller or business, including account and profile information, sign-in data, usage and device data, product analytics, security logs, communications, and records of agreements, which the Privacy Policy describes. open session's product analytics do not capture Customer Content, as the Privacy Policy explains.

2.4. Customer's Responsibilities. The Customer is responsible for having a lawful basis for the processing of Customer Personal Data, for giving any required notices, for the lawfulness of its instructions, and for its Authorized Users' use of the Platform, including the Connected Services they connect and the Third-Party AI Clients they authorize. The Customer will not put into the Platform special categories of personal data, government identification numbers, financial account or payment card numbers, health information, or other sensitive personal information, unless the parties agree in an Order.

3. Processing on Instructions

3.1. Documented Instructions. open session processes Customer Personal Data only on the Customer's documented instructions, which are: the Terms, this DPA, and the Documentation; the Customer's use and configuration of the Platform, including Workspace roles, the Connected Services it connects, the connectors it enables, and the Third-Party AI Clients its Authorized Users authorize; and any further written instructions the Customer gives and open session agrees to. open session may also process Customer Personal Data where Applicable Data Protection Law requires it, in which case open session informs the Customer of the legal requirement before processing unless the law prohibits that on important grounds of public interest.

3.2. Unlawful Instructions. open session will inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend the instruction until the parties resolve the issue. open session is not obliged to review the Customer's instructions for compliance.

3.3. Prohibited Uses. open session will not: (a) sell or share Customer Personal Data; (b) use it for advertising; (c) retain, use, or disclose it for any purpose other than the business purposes in Annex I, or outside the direct business relationship between open session and the Customer; (d) combine it with personal information it receives from other sources, except as Applicable Data Protection Law allows; or (e) use it, or anything derived from it, to create, train, fine-tune, or improve any artificial intelligence or machine-learning model.

3.4. AI Providers. The Customer's instructions include processing of Customer Personal Data by the AI model providers and other Sub-processors identified in the Sub-processor Schedule, as Section 7 of the Terms and Section 8 of the Privacy Policy describe. open session ensures that every AI provider is bound by terms that prohibit it from using Customer Personal Data to train or improve models, and sends requests with zero-retention routing so that no AI provider retains Customer Personal Data after responding, except for the specifically identified functions whose provider, purpose, maximum retention period, and contractual restrictions are disclosed in the Privacy Policy and the Sub-processor Schedule.

4. Confidentiality and Personnel

open session ensures that every person it authorizes to process Customer Personal Data is bound by a contractual or statutory duty of confidentiality and accesses Customer Personal Data only as needed to provide, secure, and support the Platform, under open session's written staff-access rule, whose access limitations are described in Section 7.6 of the Terms, Section 13 of the Privacy Policy, and Annex II.

5. Security

5.1. Measures. Taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of the processing, and the risks to Data Subjects, open session implements and maintains the technical and organizational measures described in Annex II. open session may update those measures from time to time, provided that the updates do not materially reduce the overall level of protection.

5.2. Customer's Part. The Customer is responsible for its Authorized Users' credentials, for setting roles, connections, and access appropriately, for deciding what Customer Personal Data to put into the Platform, and for securing any Customer Personal Data it exports.

6. Sub-processors

6.1. General Authorization. The Customer authorizes open session to engage the Sub-processors listed in the Sub-processor Schedule, which is Annex III of this DPA, and new Sub-processors engaged under this Section 6.

6.2. Notice of New Sub-processors. Before a new Sub-processor processes Customer Personal Data, open session updates the Sub-processor Schedule and gives at least thirty (30) days' notice by email to Workspace owners and to anyone who has asked to be notified as the Sub-processor Schedule describes, except that, where a Sub-processor must be replaced urgently to keep the Platform secure or available, open session may make the change immediately, gives notice as soon as practicable, and the Customer may object under Section 6.3 after the change. A Sub-processor that open session enables only at the Customer's request, as recorded in an Order, is a Sub-processor for that Customer only, is authorized by that Order, and does not require the notice in this Section. A Sub-processor shown on the Sub-processor Schedule as upcoming when the Customer accepts the Terms may begin processing on its stated activation date without further notice only if, at that time, the Sub-processor Schedule identified its legal entity, described its service and the categories of Customer Personal Data it receives completely, confirmed its location and transfer mechanism, and stated a firm activation date. Otherwise, and whenever the Sub-processor, its scope, its location, its transfer mechanism, or its activation date materially changes, the notice period in this Section applies before it begins or continues processing.

6.3. Objection. The Customer may object to a new Sub-processor within the notice period on reasonable grounds relating to data protection. The parties will discuss the objection in good faith. If they do not resolve it before the Sub-processor begins processing, the Customer may terminate the affected Workspace or Order on written notice, and open session refunds any prepaid Fees for the remaining term on a pro rata basis. Termination under this Section is the Customer's sole remedy for an objection.

6.4. Flow-Down. open session imposes on each Sub-processor, by written contract, data protection obligations that are no less protective than those in this DPA, including confidentiality, use, retention, onward-transfer, and security restrictions and, for AI providers, the restrictions in Section 3.4. open session remains responsible for the performance of its Sub-processors' obligations. Those terms are in open session’s contract with each Sub-processor or, for the AI model hosting providers, in its AI gateway’s terms with its providers.

6.5. Transfers by Sub-processors. open session ensures that a valid transfer mechanism under Section 11 is in place for any Restricted Transfer of Customer Personal Data to a Sub-processor.

7. Data Subject Rights and Assistance

7.1. Requests. If open session receives a request from a Data Subject relating to Customer Personal Data, it promptly forwards the request to the Customer and does not respond to the Data Subject except to direct the Data Subject to the Customer, unless Applicable Data Protection Law requires otherwise.

7.2. Assistance With Requests. Taking into account the nature of the processing, open session assists the Customer, by appropriate technical and organizational measures, in fulfilling its obligation to respond to Data Subjects' requests to exercise their rights, including through the Platform's own features and, on request, by exporting, correcting, or deleting Customer Personal Data as the Customer instructs.

7.3. Assistance With Compliance. open session provides the Customer with reasonable assistance in meeting its obligations relating to security, Personal Data Breach notification, data protection impact assessments, and prior consultation with supervisory authorities, including by providing, on request, a description of open session's processing and of the AI providers it uses. open session may charge its reasonable costs for assistance beyond what the Platform provides, except where Applicable Data Protection Law requires the assistance to be provided without charge.

8. Personal Data Breach

8.1. Notice. open session will notify the Customer of a Personal Data Breach without undue delay and, in any event, within forty-eight (48) hours after becoming aware of it. Notice is given by email to the Workspace owners and to any contact the Customer designates for this purpose.

8.2. Content. The notice describes, to the extent known, the nature of the Personal Data Breach, the categories and approximate number of Data Subjects and records concerned, its likely consequences, the measures taken or proposed to address it, and a contact point. open session may provide the information in phases as it becomes available.

8.3. Cooperation. open session takes reasonable steps to contain and remedy the Personal Data Breach, cooperates with the Customer, and provides reasonable assistance with any notification the Customer must make to supervisory authorities or Data Subjects. open session does not notify the Customer's Data Subjects or supervisory authorities on the Customer's behalf unless the law requires it or the parties agree. A notice under this Section is not an admission of fault. open session also notifies the providers of any Connected Services whose data is involved, as their terms require, and coordinates with the Customer on any public statement.

9. Deletion and Return

9.1. Export. During the Term, and for thirty (30) days after it ends, the Customer may obtain a copy of Customer Personal Data as Section 10.7 of the Terms describes.

9.2. Deletion. After that period, or earlier on the Customer's written instruction, open session deletes Customer Personal Data from its active systems as Section 10.8 of the Terms describes: items deleted in the Platform are permanently deleted about thirty (30) days after deletion; a deleted Workspace is purged after a thirty (30) day recovery period; copies in backups expire within fourteen (14) days; and copies held by Sub-processors are deleted under the terms disclosed in the Privacy Policy and the Sub-processor Schedule. open session certifies deletion in writing on request.

9.3. Retained Data. open session may retain Customer Personal Data only where Applicable Data Protection Law or another law requires retention. This DPA continues to apply to retained Customer Personal Data, which open session will keep confidential and process only for the legally required purpose. Account, agreement-acceptance, and other records that open session processes as an independent controller are outside this DPA under Section 2.3.

10. Audits and Information

10.1. Information. open session makes available to the Customer the information necessary to demonstrate compliance with its obligations under this DPA and Article 28 of the GDPR and the UK GDPR, including, on request and not more than once in any twelve (12) months, a completed security questionnaire of reasonable length and summaries of any third-party assessments or certifications open session holds.

10.2. Audits. Where Applicable Data Protection Law requires an audit that the information in Section 10.1 does not satisfy, or following a Personal Data Breach, the Customer, or an independent auditor the Customer appoints that is bound by confidentiality and is not a competitor of open session, may audit open session's processing of Customer Personal Data not more than once in any twelve (12) months, on at least thirty (30) days' written notice, during business hours, at the Customer's cost, and in a manner that does not disrupt open session's operations or expose other customers' data. open session may require that the audit be conducted through reviews of documentation and remote interviews where that is practicable.

The frequency and notice limitations above do not apply where an additional or expedited audit is required by Applicable Data Protection Law, the Standard Contractual Clauses, a supervisory authority, a Personal Data Breach, or credible evidence of material noncompliance. In those circumstances, the Customer will provide as much notice as is reasonably practicable.

10.3. California. The Customer may take reasonable and appropriate steps to ensure that open session uses Customer Personal Data consistently with its obligations under the CCPA, and, on notice, to stop and remediate any unauthorized use.

10.4. Results. Audit results and the information provided under this Section are Confidential Information of both parties, and the Customer discloses them only as Applicable Data Protection Law requires.

11. International Transfers

11.1. Locations. open session processes Customer Personal Data in the United States and in the locations shown in the Sub-processor Schedule.

11.2. EU Standard Contractual Clauses. Where a transfer of Customer Personal Data subject to the GDPR to open session is a Restricted Transfer, the SCCs are incorporated into this DPA and apply as follows: Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) applies where the Customer is a processor; the Customer is the data exporter and open session is the data importer; Clause 7 (docking clause) applies; in Clause 9(a), Option 2 (general written authorization) applies with the time period in Section 6.2; the optional language in Clause 11(a) does not apply; in Clause 13, the competent supervisory authority is determined as Annex I.C states; in Clause 17, Option 1 applies and the SCCs are governed by the laws of Ireland; in Clause 18(b), disputes are resolved before the courts of Ireland; and Annexes I, II, and III of the SCCs are Annexes I, II, and III of this DPA. Where this DPA conflicts with the SCCs, the SCCs prevail.

11.3. United Kingdom. Where a transfer of Customer Personal Data subject to the UK GDPR to open session is a Restricted Transfer, the SCCs as incorporated in Section 11.2 apply as amended by the UK Addendum, with the tables in Part 1 of the UK Addendum completed as Annex IV states, and the mandatory clauses in Part 2 of the UK Addendum apply. Where the UK Addendum conflicts with the SCCs or this DPA in respect of such a transfer, the UK Addendum prevails.

11.4. Switzerland. Where a transfer of Customer Personal Data subject to the FADP to open session is a Restricted Transfer, the SCCs as incorporated in Section 11.2 apply with these adaptations: references to the GDPR are read as references to the FADP; the Federal Data Protection and Information Commissioner is the competent supervisory authority under Clause 13; the term "Member State" is not read so as to exclude Data Subjects in Switzerland from bringing claims in Switzerland under Clause 18(c); and, where a transfer is subject exclusively to the FADP, references to EU law in the SCCs are read as references to Swiss law.

11.5. Data Privacy Framework. open session is not certified under the EU-U.S. Data Privacy Framework and does not rely on it for its own transfers. Where the Sub-processor Schedule shows that a Sub-processor relies on a Data Privacy Framework certification, open session relies on that certification for the transfer to that Sub-processor only where the certification covers that entity and that processing.

11.6. Replacement Mechanisms and Transfer Assessments. If a transfer mechanism in this Section is invalidated, amended, or replaced, the parties will cooperate in good faith to implement a replacement without delay. On request, open session provides the information reasonably needed for the Customer's transfer impact assessment, including its processing locations, the safeguards it applies, and whether it has received requests from public authorities for access to Customer Personal Data. As of the date of this DPA, open session has received no such request.

11.7. Customer's Own Transfers. Transfers that the Customer or its Authorized Users direct, including to Connected Services, connectors, and Third-Party AI Clients, are the Customer's own transfers and are not governed by this Section.

12. California Service Provider Terms

Where the CCPA applies to Customer Personal Data, the Customer discloses it to open session only for the limited and specified business purposes in Annex I, and open session: (a) processes it only for those business purposes; (b) does not sell or share it; (c) does not retain, use, or disclose it for any purpose other than those business purposes, including any commercial purpose, or outside the direct business relationship between open session and the Customer; (d) does not combine it with personal information that it receives from or on behalf of another person, or collects from its own interactions with consumers, except as the CCPA and its regulations allow; (e) complies with the CCPA and provides the same level of privacy protection that the CCPA requires of businesses; (f) grants the Customer the right to take reasonable and appropriate steps to ensure that open session uses Customer Personal Data in a manner consistent with the Customer's obligations under the CCPA; (g) notifies the Customer if it determines that it can no longer meet its obligations under the CCPA; (h) grants the Customer the right, on notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data; and (i) engages Sub-processors only under written contracts that impose these obligations and notifies the Customer of them as Section 6 describes, in open session’s contract with each Sub-processor or, for the AI model hosting providers, in its AI gateway’s terms with its providers. open session certifies that it understands these restrictions and will comply with them. open session assists the Customer in responding to verifiable consumer requests as Section 7 describes, and does not attempt to reidentify any deidentified information it receives from the Customer.

13. Liability

Each party's liability under this DPA is subject to Section 19 of the Terms, including the higher cap in Section 19.3 for breaches of data protection and security obligations, and the liability of a party and its affiliates under this DPA and the Terms is aggregated for that purpose. Nothing in this DPA limits a party's liability to Data Subjects under the SCCs or the UK Addendum, or any liability that Applicable Data Protection Law does not allow to be limited.

14. Term, Precedence, and General

14.1. Term. This DPA applies for as long as open session processes Customer Personal Data, including during the export and deletion periods in Section 9 and for any data retained under Section 9.3.

14.2. Precedence. If this DPA conflicts with the Terms, the Sub-processor Schedule, or the Documentation, this DPA prevails on data protection. The SCCs and the UK Addendum prevail over this DPA where they apply. An Order prevails over this DPA only where it says so expressly, and may add to but not reduce the protections in this DPA.

14.3. Governing Law. This DPA is governed by the law that governs the Terms, except that the SCCs are governed by the law stated in Section 11.2 and the UK Addendum by the law it specifies.

14.4. Changes. open session may update this DPA as Section 1 of the Terms describes, including to reflect changes in Applicable Data Protection Law or in the SCCs or the UK Addendum, provided that an update does not materially reduce the protections in this DPA.

14.5. Notices. Notices under this DPA are given as Section 24.4 of the Terms describes. Notices to open session concerning this DPA go to privacy@opensession.co with "Data Protection" in the subject line. The Customer designates its contact for Personal Data Breach notices by writing to that address; until it does, notices go to the Workspace owners.

14.6. Severability and Survival. If any provision of this DPA is held invalid, the remaining provisions continue in effect and the invalid provision is replaced with a valid provision that achieves its purpose as closely as possible. Sections 3.3, 4, 9, 11, 12, 13, and 14 survive termination of the Terms for as long as open session holds Customer Personal Data.

Annex I – Description of the Processing

A. List of Parties

Data exporter. The Customer. Before a Restricted Transfer begins, the following must be stated for the Customer: its legal name; its address; its role as controller or processor; its privacy contact; and the relevant Workspace or Order. BOS does not collect all of these details at sign-up. A Customer supplies any detail BOS does not hold through its Order or by email to privacy@opensession.co, or through an election form once open session provides one, and the Restricted Transfer may begin only once it has done so. Until the Customer designates a privacy contact, its Workspace owners are its contact persons.

Data importer. open session Inc., a Delaware corporation, 4231 Balboa Avenue #1448, San Diego, CA 92117, United States; contact: privacy@opensession.co. Role: processor. EU and UK representatives: to be named here before BOS is offered to users in the European Economic Area or the United Kingdom.

B. Description of the Processing

Categories of Data Subjects. The Customer's Authorized Users and the people it invites; the Customer's personnel, contractors, and clients whose personal data appears in Customer Content; and individuals who appear in images, videos, documents, or other material that the Customer or its Authorized Users upload or import.

Categories of personal data. Names, email addresses, job titles, roles, and other identifiers of Authorized Users and invitees; personal data contained in brand assets, guidelines, documents, chats, AI inputs and outputs, generated files, and imported files, including images and videos that may show people and metadata that those files carry; and data derived from that content, such as embeddings, extracted text, thumbnails, previews, and generated names, descriptions, and tags.

Sensitive data. Sensitive data is not requested and may not be submitted unless the parties authorize it in an Order. Customer Content may nevertheless incidentally contain special-category, sensitive, or similarly protected personal data, including information appearing in images, videos, documents, or free-form text. If such data is processed, the restrictions and safeguards in this DPA apply, together with any additional safeguards agreed in the applicable Order.

Frequency. Continuous, for the duration of the Term.

Nature of the processing. Hosting, storage, organization, display, and transmission of Customer Content; import of files from Connected Services that Authorized Users connect; processing by AI Features, including generation of responses, names, descriptions, and tags, document structuring, extraction of colors and themes, web search through the model providers’ own search tools, creation of embeddings for search where embedding-based search is enabled for a Workspace, and text extraction, through the providers identified in the Sub-processor Schedule; connection to third-party services that Authorized Users enable, through the connection platform provider identified there; search; export; backup; and deletion.

Purpose. To provide the Platform to the Customer as the Customer configures it, including to the Third-Party AI Clients its Authorized Users authorize and the connectors it enables.

Duration. The Term, plus the export and deletion periods in Section 9 of this DPA.

Transfers to Sub-processors. As the Sub-processor Schedule describes, for the subject matter, nature, and duration stated there and in this Annex.

C. Competent Supervisory Authority

Determined in accordance with Clause 13 of the SCCs. Where the Customer is established in a Member State of the European Union, the supervisory authority of that Member State is competent. For transfers subject to the UK GDPR, the Information Commissioner is competent. For transfers subject to the FADP, the Federal Data Protection and Information Commissioner is competent.

Annex II – Technical and Organizational Measures

Part A – Measures in place. As of the date this DPA is published, open session maintains the following measures to protect Customer Personal Data. Part A lists only the controls in place on that date, as the Privacy Policy describes them.

• Encryption. Encryption in transit (TLS) for data sent to and from the Platform; encryption at rest by open session's database and storage providers; application-level encryption, on top of database encryption, for the tokens and secrets that connect the Platform to other services, with the encryption keys kept in the hosting environment's configuration, separate from the database.
• Authentication and sessions. Credentials stored in hashed form by the sign-in provider; session cookies that scripts cannot read and that travel only over HTTPS, with protection against cross-site request forgery; PKCE and single-use state on Google sign-in and service connections.
• Access control within the Platform. Role-based access inside each Workspace; Third-Party AI Client access limited to the brand an Authorized User selects, with access tokens that expire after one (1) hour and refresh tokens after thirty (30) days; private Workspace Content files served only through short-lived signed links.
• Administrative access. A written staff-access rule limiting access to Customer Content to the cases in Section 7.6 of the Terms; multi-factor authentication on every administrative console used to operate the Platform.
• Content protection. No use of Customer Content by open session to train artificial intelligence or machine-learning models; product analytics that mask Customer Content, and terms with AI providers that prohibit training and restrict retention, as Sections 2.3 and 3.4 describe; and malware scanning of files up to 4 GB imported into the asset library.
• Sub-processor management. Review of each Sub-processor's location and transfer mechanism before it is listed; the notice and objection process in Section 6; written data protection terms with every Sub-processor, in open session’s contract with each Sub-processor or, for the AI model hosting providers, in its AI gateway’s terms with its providers.
• Incident response. A written incident-response runbook used to handle Personal Data Breaches under Section 8.
• Vulnerability reporting. A private channel for reporting vulnerabilities (security@opensession.co).
• Data lifecycle. Automated deletion of items thirty (30) days after they are deleted in the Platform and purge of deleted Workspaces after the thirty (30) day recovery period, as Section 9 describes; backups that expire within fourteen (14) days; retention periods as the Privacy Policy states.
• Personnel. Confidentiality agreements with all personnel and contractors who have access to Customer Personal Data.

Part B – Scheduled measures. open session will implement the following measures by February 28, 2027, and will add each to Part A when it is in place: data protection training for all personnel with access to Customer Personal Data; periodic access review; security logging and monitoring; vulnerability and patch management; backup-restoration testing; business-continuity and disaster-recovery procedures; periodic security testing; and deletion verification. open session will not admit users from the European Economic Area, the United Kingdom, or Switzerland until the measures in Part B are in place.

Annex III – Sub-processors

The Sub-processor Schedule published at https://bos.live/legal/subprocessors, as updated under Section 6, is Annex III of this DPA and the list of sub-processors for the purposes of the SCCs and the UK Addendum.

Annex IV – UK Addendum Tables

Table 1: Parties. Start date: the date on which this DPA first applies under its opening paragraph. Exporter: the Customer, with the details in Annex I.A, acting through its Workspace owners as key contacts. Importer: open session Inc., with the details in Annex I.A; key contact: privacy@opensession.co. The parties enter into the UK Addendum by incorporation under Section 11.3, and no separate signature is required.

Table 2: Selected SCCs, Modules, and Selected Clauses. The version of the Approved EU SCCs that this UK Addendum is appended to is the version incorporated in Section 11.2, including the Appendix information, with Module Two or Module Three as Section 11.2 states; Clause 7 (docking) applies; Clause 11 optional language does not apply; Clause 9(a) Option 2 applies with the time period in Section 6.2; and the governing law and forum in Clauses 17 and 18 are as Section 11.2 states, subject to the UK Addendum's mandatory clauses.

Table 3: Appendix Information. Annex 1A (List of Parties): Annex I.A of this DPA. Annex 1B (Description of Transfer): Annex I.B of this DPA. Annex II (Technical and organisational measures): Annex II of this DPA. Annex III (List of Sub-processors): Annex III of this DPA.

Table 4: Ending this Addendum when the Approved Addendum changes. Importer may end the UK Addendum as set out in its Section 19.