Download this document (Markdown) · Use your browser’s Print command to save a PDF.

Template — completion required. This document must be completed for the actual customer and deployment before signature. Publishing it does not execute its schedules or authorize processing.

Autonomized Data Processing Addendum

Proposed version AUT-DPA-2026-09-15.1. Not effective or published. This Addendum is incomplete until the parties, processing particulars, security measures, subprocessors, and applicable transfer schedules below are completed and accepted. Describing a requirement does not establish that a deployment satisfies it.

1. Parties, roles, and scope

This Addendum forms part of the agreement between Autonomized LLC and the Customer named in the Order. It governs personal data processed by Autonomized on Customer's behalf through the Services, called Customer Personal Data. The terms controller, processor, personal data, processing, and personal data breach carry their meanings under applicable data-protection law. Corresponding U.S. service-provider and contractor terms apply where relevant.

Customer acts as controller, or as a processor authorized by its controller to appoint Autonomized as subprocessor. Autonomized acts as processor or subprocessor for Customer Personal Data. Each remains responsible for legal duties arising from its actual activities. Account, billing, and other information for which Autonomized independently determines purposes is covered by the Privacy Notice and applicable controller obligations; it is not removed from data-protection law by this distinction.

Applicable Data Protection Law means data-protection law applying to the relevant processing, including the EU GDPR, UK GDPR and Data Protection Act 2018 as amended, and applicable U.S. state privacy laws. This does not represent that every statute applies to every Customer.

2. Documented instructions and purpose limitation

Autonomized will process Customer Personal Data only on lawful documented instructions from Customer, including the agreement, completed schedules, and properly authorized service configurations, unless law requires otherwise. In that case it will notify Customer before processing unless legally prohibited. Instructions must identify permitted purposes, features, recipients, and relevant locations. General access credentials do not authorize unrelated use.

Autonomized will inform Customer if it believes an instruction violates applicable data-protection law and may suspend the affected processing while the parties resolve the issue. Customer is responsible for the lawfulness of its instructions, data collection, disclosures, and authority to engage Autonomized. Autonomized does not promise a complete legal review of every instruction and remains responsible for duties applicable directly to it.

Autonomized will not sell Customer Personal Data, share it for cross-context behavioral advertising, retain or use it outside the specified purposes or direct business relationship except as law permits, or combine it with unrelated personal information in a manner prohibited for its role. It will provide the level of protection required for the relevant service-provider or contractor relationship and notify Customer if it determines it can no longer meet applicable obligations. Customer may take reasonable steps to verify, stop, and remediate unauthorized use as required by law.

3. AI processing

Selected AI providers may receive only the Customer Personal Data reasonably needed for the authorized function, under the listed provider terms and safeguards. Autonomized will not use that data to train general-purpose models for unrelated customers or authorize a subprocessor to do so without separate, specific lawful instructions and appropriate contractual changes. This does not permit a controller to authorize processing it has no lawful basis to authorize.

Customer-specific retrieval, configuration, and permitted customization must be distinguished from general model training in the processing schedule. Provider retention, abuse review, feedback, logging, and human access must be recorded rather than assumed to be disabled. Customer instructions to “improve Anna” do not alone approve a new purpose or an unrestricted training dataset.

4. Confidentiality and security

Autonomized will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations or appropriate statutory duties and receive access limited to their responsibilities. It will implement and maintain the measures described in Schedule B, taking account of the nature and risk of processing, available technology, and implementation considerations under applicable law.

Measures must cover appropriate access management, tenant separation, authentication, encryption where specified, credential protection, secure development, change control, logging, vulnerability handling, backup and recovery, deletion, and incident response. Autonomized may update measures without materially reducing the agreed overall protection. Material changes requiring Customer instructions or transfer reassessment must be handled accordingly.

Customer is responsible for its own account permissions, endpoints, lawful instructions, and appropriately secured connections. A shared-responsibility description does not excuse either party's own breach. Security certifications and particular recovery objectives exist only if expressly and accurately documented in the completed schedule.

5. Subprocessors

Customer grants general written authorization only for the subprocessors identified in the completed Schedule C. Before adding or replacing a subprocessor, Autonomized will provide at least 30 days' advance notice where practicable, stating the entity, role, processing locations, and relevant data. If an urgent replacement is needed to protect continuity or security, Autonomized will provide as much advance notice as reasonably practicable and explain the circumstances; processing must still remain lawful.

Customer may object on reasonable data-protection grounds within the notice period. The parties will work in good faith on a suitable alternative or mitigation. If no reasonable solution exists, Customer may end the affected service without penalty and receive a proportionate refund of unused prepaid fees. A generalized right to object must not be rendered meaningless by starting unlawful processing first.

Autonomized will impose materially equivalent relevant data-protection obligations on each subprocessor and remain responsible for its performance of those obligations as required by applicable law. A customer-selected independent integration is not automatically a subprocessor; its role and instructions must be documented. Autonomized cannot disclaim responsibility for a provider it selects to perform its own processing obligations simply by calling it independent.

6. Rights requests and regulatory assistance

Taking account of the processing and information available, Autonomized will reasonably assist Customer in responding to applicable data-subject requests. If it receives a request concerning Customer-controlled data, it will notify Customer promptly and avoid responding substantively except on instructions or as law requires. No instruction may prevent compliance with a direct legal duty.

Autonomized will assist with applicable security obligations, breach notifications, data-protection impact assessments, regulator consultation, and records necessary to demonstrate compliance. Fees for extraordinary assistance may be reasonably agreed in advance, but must not delay urgent compliance, charge for remedying Autonomized's own breach, or prevent exercise of a nonwaivable right. Customer must not supply unnecessary third-party data in a support request.

7. Personal data breaches

Autonomized will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, using Customer's designated incident contact. It will provide the nature of the breach, known categories and approximate scope, likely consequences, containment or remediation measures, and a contact for follow-up, to the extent available. It will supplement incomplete information as investigation progresses rather than wait for complete certainty.

The parties will cooperate reasonably to contain and investigate the breach, preserve relevant evidence, and make notifications required of each by law. Customer generally decides notifications for its controller responsibilities; Autonomized retains its own direct duties. Neither party may condition a legally required notification on the other's approval. Ordinary unsuccessful attacks with no personal-data breach are not automatically notification events, but material related risks must be handled under the relevant security obligations.

This contractual notice standard does not substitute for a controller's separate statutory reporting deadline, including a 72-hour deadline where applicable. A numeric contractual promise must be added only if operations can support it. Notification is not an admission of fault, and allocation of costs follows responsibility, the agreement, and mandatory law.

8. Audit and compliance information

Autonomized will make information reasonably necessary to demonstrate compliance available to Customer and permit and contribute to appropriate audits, including inspections, as required by applicable law. The parties should first use relevant current reports, questionnaires, and evidence where that reasonably meets the need.

Ordinary audits require reasonable notice, confidentiality, and safeguards for other customers' data and service security, and should avoid unnecessary duplication. These conditions cannot prevent an audit required by a regulator, following a material incident or credible noncompliance concern, or otherwise required by law. No universal once-a-year restriction overrides those exceptions. Allocation of reasonable audit costs may be agreed without blocking a statutory right or charging Customer for Autonomized's necessary remediation.

9. Return, deletion, and legal holds

At Customer's choice on termination, Autonomized will return or delete Customer Personal Data as required by law and the completed retention schedule, and delete remaining copies unless law requires retention. The schedule must specify export timing, active-system deletion, backup expiry, recording retention, and a contact for exceptional retrieval. The standard proposed export-request window is 30 days after termination; operational deletion periods remain to be confirmed before acceptance.

Data retained under a legitimate legal obligation or proportionate hold will be restricted to that purpose and protected until deletion is lawful. Backup data will remain isolated from ordinary use and expire on the documented cycle; restoration will reapply relevant deletions and suppressions. Upon reasonable request, Autonomized will confirm completion and identify lawful retention exceptions. Contract evidence must not be used as a reason to retain every raw call or CRM record.

10. International transfers

Autonomized will not make a restricted transfer without a valid applicable mechanism and any required assessment or supplementary safeguards. Customer's country selection and consent to the commercial contract are not a general derogation for routine international transfers. Remote access and onward transfers are included in the assessment.

Where the European Commission's Decision (EU) 2021/914 standard contractual clauses are applicable to the transfer, the parties will incorporate the official unmodified text using the appropriate module and completed annexes. Module Two is the starting point for controller-to-processor transfers; Module Three is the starting point for processor-to-processor transfers. Applicability, including the importer's own GDPR status, must be checked for the actual transfer. Another required or suitable valid mechanism must be used where those clauses are not applicable.

The standard contractual clauses prevail over conflicting agreement terms. Neither the commercial cap, indemnity, release, forum provision, nor arbitration clause may reduce mandatory clause rights or a data subject's remedies. The parties must assess destination-country law and practice, required government-access safeguards, and the actual provider chain; signing clauses alone is insufficient.

For UK restricted transfers using EU clauses, the parties must complete the applicable approved UK Addendum or use another valid UK mechanism, including the required risk assessment. EU clauses alone do not cover UK restricted transfers. The current approved mandatory text must be attached or incorporated exactly as permitted, with complete tables. This draft does not represent that a transfer instrument has already been executed or that Autonomized is certified under an adequacy framework.

11. Liability and precedence

Commercial liability allocation between Customer and Autonomized follows the applicable Terms to the extent lawful, without limiting data subjects, regulators, mandatory transfer-clause rights, or other nonwaivable obligations. Where law provides contribution based on responsibility, the parties retain that right. Customer does not indemnify Autonomized for Autonomized's independent unlawful processing.

This Addendum controls conflicting processing terms and survives as long as Autonomized holds Customer Personal Data. Material changes must follow the applicable agreement and data-protection requirements. No website edit retroactively authorizes a new purpose.

Schedule A — Processing particulars to complete

Schedule B — Verified technical and organizational measures

Complete a deployment-specific schedule covering authentication and access review; tenant-isolation enforcement; encryption scope and key management; token/secret storage; system and dependency maintenance; secure change approval; monitoring; backup and tested restoration; data minimization; provider access; incident escalation; deletion execution; and evidence retention. For each, record the actual measure, responsible operator, applicable system, supporting evidence, and material limits. Do not enter “SOC 2,” “end-to-end encryption,” “HIPAA compliant,” “zero retention,” or a recovery-time guarantee without evidence and an appropriate commitment.

Schedule C — Subprocessor register

Each row must state the provider's legal entity, selected service, role, categories received, purpose, retention/training settings, processing and support locations, applicable DPA and transfer mechanism, and change-notice method. Existing materials mention Anthropic, Twilio, Stripe, and Supabase; project architecture also identifies voice and hosting functions that may involve ElevenLabs and Cloudflare. These are discovery leads, not a complete verified legal-entity list or authorization schedule. Customer-selected Google/Microsoft or other accounts must be classified separately by actual role.

Schedule D — Transfer completion instructions

For each applicable EU transfer, complete the official instrument's party details, signatures, transfer description, competent supervisory authority, technical measures, and subprocessor information. Select the proper module; consider the optional docking clause; use general subprocessor authorization only with a specified notice period; and identify valid governing law and courts for the transfer clauses. Irish law and Irish courts are proposed where valid, preserving the official data-subject forum rights. Do not impose the U.S. dispute provisions on these clauses.

For the UK Addendum, complete Tables 1–4, identify the approved EU clauses and module, provide the appendix information, and select which parties may end the Addendum on an approved-template change. Include the mandatory text exactly as required by the approved form. Attach the relevant transfer impact/risk assessment and supplementary-measures decision to the controlled compliance record. An incomplete annex, blank table, or missing mandatory clause prevents release of the affected transfer.

Acceptance

Customer legal name, authorized signer, title, signature, date, and Order identifier: complete through the signature record.

Autonomized acceptance and the immutable versions of completed Schedules A–D: complete through the agreement record before affected processing.