Data Processing Agreement

Version 1.0 · Effective 21 October 2026

This Data Processing Agreement (“DPA”) forms part of the Zammo Terms and Conditions (the “Terms”) between Zammo Inc. (“Zammo”) and the Customer. It is the Data Processing Agreement referred to in section 10 of the Terms. Capitalized terms not defined here have the meaning given in the Terms.

1. When this DPA applies

1.1 This DPA applies whenever Zammo processes Customer Personal Data on the Customer’s behalf in providing the Services, under any Purchase Path. The Customer accepts it by accepting the Terms.

1.2 Where the Customer has a signed MSA that contains its own data processing terms, those terms apply instead of this DPA.

1.3 ZOT Software. When the Customer uses the ZOT Software, the Services are deployed as an Azure Managed Application into the Customer’s own Azure subscription, in the Azure region the Customer selects at deployment, and Customer Personal Data is stored and processed there. As publisher of the Managed Application, Zammo manages the resources in the managed resource group, including access management to those resources, backup and data retention, and applies the measures in Annex 2 to them. This DPA applies to that processing. The Customer remains responsible for its Azure tenant and subscription outside the managed resource group, including identity and tenant-level security configuration, subscription-level policies, and any access it grants to its own users.

1.4 This DPA does not apply to personal data Zammo processes as a controller, such as Authorized Users’ account details, billing information, and sales and support contacts. The Privacy Policy describes that processing.

2. Definitions

• “Data Protection Laws” means all laws on the processing of personal data that apply to the processing under this DPA, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection (“FADP”), and US state privacy laws.

• “GDPR” means Regulation (EU) 2016/679. “UK GDPR” means the GDPR as it forms part of the law of the United Kingdom.

• “Customer Personal Data” means personal data in Customer Content or End User Conversation Data that Zammo processes on the Customer’s behalf.

• “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

• “Sub-processor” means a third party Zammo engages to process Customer Personal Data.

• “Standard Contractual Clauses” or “SCCs” means the clauses approved by the European Commission in Implementing Decision (EU) 2021/914.

• “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0).

• “Controller”, “processor”, “data subject”, “personal data” and “processing” have the meanings given in the GDPR.

3. Roles and instructions

3.1 The Customer is the controller of Customer Personal Data (or a processor acting for its own customer), and Zammo is its processor (or sub-processor).

3.2 Zammo processes Customer Personal Data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s configuration and use of the Services are the Customer’s instructions. Zammo will tell the Customer if it believes an instruction breaks Data Protection Laws and is not required to follow it.

3.3 If law requires Zammo to process Customer Personal Data other than on the Customer’s instructions, Zammo will tell the Customer before doing so, unless that law forbids it.

3.4 The Customer is responsible for having a lawful basis for its processing, for giving End Users the notices Data Protection Laws require, including that they are interacting with an AI agent, and for the lawfulness of the data it, its Authorized Users and its End Users put into the Services. The Customer is also responsible for obtaining any consent required to record, transcribe or monitor a voice interaction, including in jurisdictions that require the consent of all parties, and for giving any required recording notice.

3.5 Zammo does not use Customer Personal Data to train, fine-tune or improve any AI model, and does not sell it.

3.6 Automated decision-making. Zammo does not make decisions about data subjects using the Services. The Customer determines whether and how an AI agent is used in connection with decisions producing legal or similarly significant effects, and is responsible for any resulting obligation to provide human review or intervention, to disclose the use of automated decision-making, or to allow a data subject to contest a decision.

3.7 Autonomous actions. Where the Customer configures an AI agent to take autonomous actions, the Customer determines the scope of that authority and the systems the agent may access. Zammo will make available to the Customer the records of autonomous actions that the Services provide.

3.8 AI regulatory assistance. Zammo will provide the Customer with documentation reasonably necessary for the Customer to meet its obligations under applicable artificial intelligence laws, including information required for a data protection impact assessment or an algorithmic or AI impact assessment.

4. Zammo personnel

Zammo ensures that everyone it authorizes to process Customer Personal Data is bound by confidentiality, has received data protection training, and has access only as far as their role needs.

5. Security

5.1 Zammo implements the technical and organizational measures described in Annex 2 to protect Customer Personal Data, appropriate to the risk.

5.2 Zammo may update those measures over time, provided the overall level of protection is not reduced.

5.3 Some security settings are in the Customer’s control, such as Authorized User access, roles, the personal information (PII) redaction level of each agent, and which Channels and connected systems an agent uses. The Customer is responsible for configuring them appropriately.

6. Sub-processors

6.1 The Customer gives Zammo general authorization to engage Sub-processors. The Sub-processors in use on the effective date are listed in Annex 3.

6.2 Zammo will impose data protection obligations on each Sub-processor that are no less protective than this DPA and remains responsible to the Customer for each Sub-processor’s performance.

6.3 Notice of changes. Zammo will tell the Customer by email to the account owner’s email address at least 30 days before a new Sub-processor starts processing Customer Personal Data. The Customer is responsible for keeping that email address current.

6.4 Objection. The Customer may object to a new Sub-processor on reasonable data protection grounds by emailing dpo@zammo.ai within that 30-day period. Zammo will work with the Customer in good faith to address the objection. If that is not possible, the Customer may terminate the affected Services by written notice, and Zammo will refund any prepaid Fees for the unused part of the term.

6.5 In an emergency, for example to keep the Services secure or available, Zammo may replace a Sub-processor with shorter notice. It will notify the Customer as soon as reasonably possible, and the objection right in 6.4 still applies.

7. Data subject requests

7.1 Most requests from End Users (access, correction, deletion and the other rights under Data Protection Laws) can be handled by the Customer through the Services, which let the Customer view, export and delete conversation data.

7.2 Where the Customer cannot handle a request itself, Zammo will provide reasonable assistance, taking into account the nature of the processing.

7.3 If Zammo receives a request directly from a data subject about Customer Personal Data, it will pass the request to the Customer without undue delay and will not respond to it, except to direct the data subject to the Customer, unless the Customer authorizes it.

8. Personal Data Breaches

8.1 Zammo will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach, by email to the account owner’s email address. Unsuccessful access attempts and routine events such as pings, port scans and denial of service attempts that do not compromise Customer Personal Data are not Personal Data Breaches.

8.2 The notification will describe, as far as Zammo then knows: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it and mitigate its effects; and a contact point for more information. Where information is not all available at once, Zammo will provide it in phases without further undue delay.

8.3 Zammo will take reasonable steps to contain and remedy the breach and will cooperate with the Customer so it can meet its own obligations to notify supervisory authorities and data subjects. Zammo will bear the costs of remediating a Personal Data Breach caused by its breach of this DPA. Zammo will not notify a supervisory authority or data subject about a breach affecting Customer Personal Data on the Customer’s behalf without the Customer’s prior written consent, unless required by law.

8.4 Notifying a Personal Data Breach is not an admission of fault or liability.

9. Impact assessments and consultation

Zammo will provide reasonable information and assistance to help the Customer carry out data protection impact assessments and any prior consultation with a supervisory authority that the Customer is required to carry out in relation to the Services.

10. Deletion and return

10.1 During the term, the Customer can export and delete Customer Personal Data through the Services.

10.2 After the Customer’s subscription ends, Zammo will delete or de-identify Customer Personal Data within 60 days, unless the law requires Zammo to keep it. Copies in backups are overwritten as backups expire, which takes up to four weeks; until then they remain protected by this DPA.

10.3 For the ZOT Software, deleting the Zammo Managed Application from the Customer’s Azure subscription deletes the Customer Personal Data stored in it, and Zammo retains none of it following removal, other than any copied into support requests, which Zammo deletes within 60 days of removal. Any backups maintained as part of the Managed Application reside within the Customer’s own Azure subscription and are deleted with it, subject to any further backups or retention the Customer or Azure maintains.

11. Audits

11.1 On request, and no more than once a year, Zammo will provide the information reasonably needed to demonstrate compliance with this DPA, such as its security documentation, a completed security questionnaire and evidence from its compliance platform.

11.2 If that information is not enough to demonstrate compliance, or a supervisory authority requires it, or after a Personal Data Breach, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality. The Customer must give at least 30 days’ notice, agree the scope and timing with Zammo in advance, avoid disrupting Zammo’s operations, and bear its own costs.

12. International transfers and regional terms

12.1 Zammo Agents on SaaS is hosted in the United States. For the ZOT Software, Customer Personal Data resides in the Customer’s own Azure subscription in the Azure region the Customer selects at deployment. Sub-processors may process Customer Personal Data in the countries listed in Annex 3. Zammo will only transfer Customer Personal Data out of the European Economic Area, the United Kingdom or Switzerland as permitted by Data Protection Laws.

12.2 EEA. Where the Customer (or its controller) is in the EEA or subject to the GDPR, and Customer Personal Data is transferred to Zammo in a country without an adequacy decision, the SCCs are incorporated into this DPA as follows:

• Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor. The Customer is the data exporter and Zammo is the data importer.

• Clause 7 (docking clause) applies.

• Clause 9: option 2 (general written authorization) applies, with the notice period in section 6.3 of this DPA.

• Clause 11: the optional language does not apply.

• Clause 13: the competent supervisory authority is the one determined under Clause 13(a), as applicable to the data exporter.

• Clause 17: option 1 applies; the SCCs are governed by the law of Ireland.

• Clause 18: disputes are resolved by the courts of Ireland.

• Annexes I and II of the SCCs are completed by Annexes 1 and 2 of this DPA. Annex III is completed by Annex 3.

12.3 United Kingdom. For transfers subject to the UK GDPR, the SCCs apply as amended by the UK Addendum. Tables 1 to 3 of the UK Addendum are completed with the information in section 12.2 and the Annexes of this DPA, and in Table 4 either party may end the UK Addendum as set out in its Section 19.

12.4 Switzerland. For transfers subject to the FADP, the SCCs apply with these changes: references to the GDPR are to the FADP; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; and “Member State” includes Switzerland, so that data subjects in Switzerland can enforce their rights there.

12.5 If the SCCs or the UK Addendum conflict with this DPA or the Terms, the SCCs or the UK Addendum prevail.

12.6 Canada. Where Customer Personal Data relates to individuals in Canada, Zammo will process it in accordance with the Personal Information Protection and Electronic Documents Act and substantially similar provincial legislation and will maintain protections comparable to those required of the Customer. The Customer acknowledges that Customer Personal Data processed outside Canada may be accessible to courts, law enforcement and national security authorities in the jurisdiction where it is processed, and is responsible for giving any notice of this that its own obligations require.

12.7 United States state privacy laws. With respect to Customer Personal Data subject to the California Consumer Privacy Act as amended or a comparable state law, Zammo is a service provider or processor and will not: (a) sell or share Customer Personal Data; (b) retain, use or disclose it for any purpose other than performing the Services, or as otherwise permitted by applicable law; (c) retain, use or disclose it outside the direct business relationship between the parties; or (d) combine it with personal information received from or on behalf of another person, except as permitted by applicable law.

12.8 Zammo certifies that it understands and will comply with the restrictions in section 12.7. Zammo will notify the Customer promptly if it determines it can no longer meet its obligations under applicable state privacy law, and the Customer may take reasonable steps to stop and remediate unauthorized use.

12.9 Voice recordings, transcripts and authentication credentials may constitute sensitive personal information under applicable state law. Zammo will process them only as necessary to provide the Services and will not use them for any purpose requiring a separate right to limit.

13. Liability

Each party’s liability arising out of or relating to this DPA is subject to the exclusions and limitations of liability in section 15 of the Terms, including the limit that applies to claims arising from a data breach or security incident. This does not limit either party’s liability where the SCCs or Data Protection Laws do not permit it to be limited, including liability to data subjects under the SCCs.

14. Governing law and disputes

This DPA is governed by the law, and disputes are resolved in the way, set out in the Terms (sections 18 and 20.1), except that: the SCCs are governed as stated in section 12.2; the UK Addendum is governed by the laws of England and Wales; and the Swiss amendments in section 12.4 are governed by Swiss law where the FADP requires it.

15. Changes to this DPA

Zammo may update this DPA, for example to reflect a change in Data Protection Laws or in the Services. Zammo will not make a change that reduces the overall protection of Customer Personal Data and will tell the Customer by email to the account owner at least 30 days before a material change takes effect.

16. Contact

Questions about this DPA, objections to a Sub-processor and requests under it go to Zammo’s Data Protection Officer at dpo@zammo.ai. Zammo’s EU and UK representatives are named in the Privacy Policy.

Annex 1: Details of the processing