Data Processing Addendum (DPA)

1. Definitions

"Controller", "Processor", "Sub-processor", "Data Subject", "Personal Data", "Processing", and "Supervisory Authority" have the meanings in GDPR (EU) 2016/679 and the UK GDPR. "Data Protection Laws" means all privacy and data protection laws applicable to a party's processing, including GDPR, UK GDPR, and the CCPA/CPRA.

2. Roles of the parties

Albi's product supports two arrangements, and this DPA covers both:

• (a) Customer processes a third party's data (e.g. a consultant's end-client). The Customer acts as a Processor on behalf of its end-client (the Controller), and Albi acts as a Sub-processor. Customer warrants it has the end-client's authorization and a lawful basis to engage Albi as a sub-processor and to give the instructions in this DPA.
• (b) Customer processes its own organization's data. The Customer is the Controller and Albi is the Processor.

In both cases Albi processes Customer Data only on Customer's documented instructions (this DPA, the Terms, and Customer's use of the Service's features), unless required by law (in which case Albi will notify Customer where permitted).

3. Subject matter, duration, nature & purpose

• Nature/purpose: hosting; designing and fielding Customer's pricing surveys (through a survey panel, Customer's own link, or synthetic respondents); quality checks; analysis and reporting; where Customer asks for it, Albi's team helping to design, run or interpret Customer's studies (the managed service); and, only when Customer connects it, reading Customer's own billing system.
• Duration: for the term of the Terms plus the deletion period in §9.

4. Categories of data & data subjects (Annex I)

• Data subjects: Customer's and its end-clients' customers, contacts, and survey respondents; Customer's own personnel.
• Personal data categories: business contact details, customer/account identifiers, subscription and billing records; for survey respondents, panel participant IDs, survey answers (including free text), and survey-taking metadata (timing, questions shown, quality signals). Customer must not submit special-category data except as expressly agreed.
• Business (non-personal) data: pricing, products, subscriptions, invoices, competitive/market data.

5. Customer obligations

Customer warrants that (a) it has a valid legal basis and all necessary rights and consents to submit Customer Data and to instruct the processing here; (b) in arrangement 2(a), it is authorized by its end-client to do so; and (c) its instructions will not cause Albi to violate Data Protection Laws.

6. Albi obligations

Albi will: (a) process only on documented instructions (§2); (b) ensure persons authorized to process are under confidentiality; (c) implement the technical and organizational measures in §8; (d) assist Customer, taking into account the nature of processing, with data-subject requests and with obligations under Articles 32–36 GDPR; (e) make available information needed to demonstrate compliance and allow for audits per §10; (f) notify Customer without undue delay on becoming aware of a Personal Data Breach; and (g) limit access by Albi personnel to Customer Data to what is needed to deliver the managed service, provide support, operate and secure the Service, or act on Customer's request. Albi personnel do look at Customer Data, including survey responses, for those purposes. For a Managed Study (Terms §3A), named personnel assigned to Customer's account design, run and analyze the study in Customer's workspace, including reading individual survey responses, and access only the accounts they are assigned to. Personnel with access are bound by written confidentiality. Albi does not give contractors access to Customer Data without first listing them as Sub-processors under §7.

7. Sub-processors

• Customer authorizes Albi to engage the Sub-processors listed in the pack in Annex III and at https://albiagents.com/site/security, namely Vercel (hosting), Supabase (database/auth/storage), Anthropic (AI processing), Stripe (payments and Customer-connected billing data), Resend (email), Mixpanel and PostHog (product analytics and error tracking), PureSpectrum and Cint (optional survey panels).
• AI note: Customer Data submitted for analysis/generation is transmitted to Anthropic as a Sub-processor. Anthropic does not train on data sent through its commercial API (Anthropic commercial terms).
• Survey panels: when Customer runs a panel study, Albi sends the panel provider the study's settings and receives participant IDs. Prolific acts as an independent controller of its participants' data under its own terms; it is not a Sub-processor. PureSpectrum and Cint are Sub-processors, listed above; Cint's panel suppliers are independent controllers of their own panelists' data. Survey answers stay in Albi.
• Albi imposes data-protection obligations on each Sub-processor no less protective than this DPA and remains liable for their performance.
• Albi will give Customer 30 days' notice of a new or replacement Sub-processor by email to the account owner and an update to the sub-processor page; Customer may object on reasonable data-protection grounds, and the parties will work in good faith to resolve it.

8. Security measures (Annex II)

Encryption in transit (TLS) and at rest; per-project encryption of connected billing credentials (AES-256); role-based access control and least-privilege; tenant/project isolation; audit logging of syncs and sensitive actions; secure SDLC and dependency management; access limited to personnel who need it (§6(g)).

9. Return & deletion

On termination or on Customer request, Albi will delete or return Customer Data within 30 days, and delete existing copies except where retention is required by law. Backups roll off within a further 30 days. Survey respondent data is also deleted on the schedule in the Respondent Privacy Notice: panel IDs 120 days after a study closes, answers 12 months after it closes.

10. Audit

Albi will make available information reasonably necessary to demonstrate compliance with this DPA and allow audits by Customer or its mandated auditor no more than once per year, on reasonable notice, subject to confidentiality, or by providing third-party audit reports/certifications where available.

11. International transfers

Where Customer Data is transferred out of the EEA/UK/Switzerland to a country without an adequacy decision, the transfer is governed by the EU Standard Contractual Clauses (incorporated by reference: Module 2, controller to processor, where Customer is Controller under §2(b); Module 3, processor to processor, where Customer is a Processor under §2(a)) and the UK International Data Transfer Addendum, with Annexes populated from this DPA.

12. CCPA/CPRA

To the extent the CCPA/CPRA applies, Albi is a "Service Provider": it processes personal information only to provide the Service, and will not sell or share it, nor retain, use, or disclose it outside the direct business relationship or as permitted by the CCPA.

13. Liability

Each party's liability under this DPA is subject to the limitations in the Terms.

14. General

This DPA is incorporated into the Terms. On conflict about data protection, this DPA prevails. Governed by the State of Delaware.

Annex II — Technical & organizational measures

Populated from §8 above.

Annex III — Sub-processors

Not a Sub-processor: Prolific Academic Ltd (483 Green Lanes, London N13 4BS, United Kingdom), the survey panel, acts as an independent controller of its participants' data (§7). Prolific states that it stores user data on Google Cloud Platform servers in Belgium. It receives study settings (title, reward, eligibility filters, completion code) and approve/reject decisions, and returns participant IDs. It does not receive survey answers.