Data Processing Agreement

This Data Processing Agreement ("DPA") is between PILOTLAB LLC, a Wyoming limited liability company, doing business as VM Hunter ("VM Hunter", "we", "us"), 1309 Coffeen Ave Ste 1200, Sheridan, WY 82801, United States (the "Processor"), and the customer that has accepted the Terms of Service (the "Customer").

It applies automatically, with no signature needed, whenever the Customer submits personal data to the Service as a controller, and it is incorporated into the Terms of Service. It covers personal data the Processor processes on the Customer's behalf, mainly call audio and the data derived from it ("Customer Personal Data"). Data the Processor handles as a controller, such as account and billing data, is covered by the Privacy Policy instead.

Terms such as "controller", "processor", "personal data breach" and "data subject" have the meaning given in the EU General Data Protection Regulation ("GDPR"), and include the equivalent terms in the UK GDPR, the Swiss Federal Act on Data Protection and US state privacy laws where those apply.

• The Customer is the controller of Customer Personal Data and the Processor is its processor.
• The Processor processes Customer Personal Data only on the Customer's documented instructions. These are the Terms of Service, this DPA, the Customer's configuration of the Service and its portal settings. If the law requires other processing, the Processor will tell the Customer first unless the law forbids it.
• The Processor will tell the Customer if, in its opinion, an instruction infringes data protection law.
• The Customer is responsible for the lawfulness of its instructions and of the calls it sends to the Service, including having a lawful basis and giving any notice or obtaining any consent that call-recording, telemarketing and privacy laws require for the processing described in this DPA.

The Customer authorises VM Hunter to use call audio, transcripts and detection results to train and improve VM Hunter's detection models, unless the Customer opts out. To opt out, the Customer emails support@vmhunter.com from the address on its account. The opt-out applies to Customer Personal Data received after it takes effect. Trained models contain no recordings and are not shared with other customers or with third parties.

The Processor ensures that everyone it authorises to process Customer Personal Data, including its employees and contractors, is bound by a duty of confidentiality and accesses the data only as needed to provide, secure and support the Service.

The Processor implements the technical and organisational measures in Annex II and keeps them appropriate to the risk. It may update them as long as the overall level of protection does not decrease.

• The Customer gives the Processor general authorisation to engage sub-processors. Annex III lists them by category and country.
• The current named list of sub-processors is given to the Customer on written request to support@vmhunter.com. The list is the Processor's confidential information, and the Customer may not share it with third parties.
• The Processor gives at least 30 days' notice of a new or replaced sub-processor by email to customers who have asked to be notified. To ask, email support@vmhunter.com.
• The Customer may object on reasonable data protection grounds within those 30 days. The parties will discuss the objection in good faith. If they cannot resolve it, the Customer may terminate the affected part of the Service.
• The Processor imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible to the Customer for its sub-processors' performance.

• Data subject requests. Taking into account the nature of the processing, the Processor helps the Customer respond to requests to exercise data subject rights. If the Processor receives such a request directly, it passes it to the Customer where it can identify the Customer, and does not answer it except on the Customer's instructions.
• Impact assessments and regulators. The Processor gives reasonable help with data protection impact assessments (DPIAs) and with prior consultations with supervisory authorities that relate to the Service.

The Processor notifies the Customer of a personal data breach affecting Customer Personal Data without undue delay, and in any case within 48 hours of becoming aware of it. The notice describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. The Processor provides further information as it becomes available and takes reasonable steps to contain the breach.

• During the term, the Customer can export call logs as CSV, listen to and download recordings in the portal, delete recordings individually or all at once, and switch recording storage off.
• When a paid subscription ends the account stays open on the Free plan, and its data is kept. To close its account, the Customer emails support@vmhunter.com. The Processor then deletes Customer Personal Data within 30 days, unless the law requires the Processor to keep it.
• Data already used to train a model before deletion is not recoverable from the trained model, which contains no recordings.

The Processor makes available the information reasonably needed to demonstrate compliance with this DPA and answers reasonable written security questionnaires. The Customer may audit the Processor, itself or through an independent auditor bound by confidentiality, on at least 30 days' written notice, no more than once a year, during business hours, at the Customer's cost, and without access to other customers' data. A supervisory authority may audit more often where the law gives it that right.

VM Hunter is hosted in the United States, and the Processor's staff, including team members in Pakistan, may access Customer Personal Data remotely. Where Customer Personal Data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, the following are incorporated into this DPA by reference:

• The Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914 ("SCCs"): Module 2 (controller to processor) between the Customer and the Processor, and Module 3 (processor to sub-processor) between the Processor and its sub-processors. Clause 7 (docking clause) applies. Under Clause 9, option 2 (general written authorisation) applies with the 30-day notice in section 6. The optional wording in Clause 11 does not apply. Under Clauses 17 and 18, the SCCs are governed by the law of Ireland and disputes go to the courts of Ireland. Annexes I to III of this DPA complete the annexes of the SCCs.
• For UK transfers, the UK International Data Transfer Addendum to the SCCs, issued by the Information Commissioner's Office.
• For Swiss transfers, the SCCs with the amendments the Swiss Federal Data Protection and Information Commissioner requires: references to the GDPR include the Swiss Federal Act on Data Protection, and the Commissioner is a competent supervisory authority.

Where a US sub-processor is certified under the EU-U.S. Data Privacy Framework, the Processor may rely on that certification for transfers to it.

• This DPA lasts as long as the Processor processes Customer Personal Data.
• Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where the SCCs or the law do not allow it.
• If this DPA and the Terms of Service conflict on data protection, this DPA prevails. If this DPA and the SCCs conflict, the SCCs prevail.
• Apart from the SCCs, this DPA is governed by the law and courts set out in the Terms of Service.

The named list is available to the Customer on written request, as described in section 6.