Data Processing Agreement

This DATA PROCESSING AGREEMENT ("Agreement") forms part of the Terms of Service ("Principal Agreement") between: (i) Customer (“Controller”); and (ii) Vast.ai Inc. (“Processor” or “Service Provider”). This Agreement is entered into and effective as of the effective day of Customer entering into the Principal Agreement with Processor

The terms used in this Agreement shall have the meanings set forth in this Agreement. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Principal Agreement. Except as modified below, the terms of the Principal Agreement shall remain in full force and effect.

AGREEMENT

• Definitions

  • In this Agreement, the following terms shall have the meanings set out below:

  • “Anonymous Data” means information that relates to a group or category of consumers and/or individuals, from which: (i) the Controller cannot be identified as the source of the information; (ii) personally identifiable information allowing the identification of individuals is removed; and (iii) the information is not reasonably identifiable or linkable to any consumer, individual, household, or device.

  • "Applicable Laws" means the GDPR;

  • "Personal Data" means any Personal Data Processed by the Contracted Processor on behalf of the Controller pursuant to the Principal Agreement;

  • "Contracted Processor" means Processor or a Subprocessor;

  • "EEA" means the European Economic Area;

  • "GDPR" means EU General Data Protection Regulation 2016/679 and its implementing regulations in the EEA and the United Kingdom;

  • “Restricted Transfer” means a transfer of Personal Data subject to the GDPR outside of the EEA;

  • "Services" means the services and other activities to be supplied to or carried out by or on behalf of Contracted Processor for Controller pursuant to the Principal Agreement;

  • “Standard Contractual Clauses” means the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council attached hereto as Schedule A;

  • "Subprocessor" means any person (including any third party, and any Processor Affiliate, but excluding an employee of Processor) or any of its sub-contractors) appointed by or on behalf of Processor or Processor Affiliate to Process Personal Data on behalf of any Controller in connection with the Principal Agreement; and

  • “Processor Affiliate" means an entity that owns or controls, is owned or controlled by or is or under common control or ownership with Processor, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise.

  • The terms, "Commission", "Controller", "Data Subject", "Member State", "Personal Data", "Personal Data Br/each", "Processing" and "Supervisory Authority" shall have the same meaning as in the GDPR.

• Processing of Personal Data

  • Processor and Processor Affiliate shall:

    • comply with all Applicable Laws in the Processing of Personal Data; and

    • not Process Personal Data other than on the Controller’s documented instructions unless Processing is required by Applicable Laws to which the relevant Contracted Processor is subject, in which case Processor or the relevant Processor Affiliate shall to the extent permitted by Applicable Laws inform the Controller of that legal requirement before the relevant Processing of that Personal Data.

  • The Controller shall:

    • instruct Processor and each Processor Affiliate (and authorizes Processor and each Processor Affiliate to instruct each Subprocessor) to:

      • Process Personal Data; and in particular, transfer Personal Data to any country or territory, as reasonably necessary for the provision of the Services and consistent with the Principal Agreement.

  • Processor acknowledges that all Personal Data that it may receive from Controller, Controller’s employees or consultants, or otherwise acquired by virtue of the performance of services under the Principal Agreement shall be regarded by Processor as confidential and held by Processor in confidence.

  • Processor shall not directly or indirectly sell any Personal Data, or retain, use, or disclose any Personal Data for any purpose other than for the purpose of performing services for Controller; or retain, use, or disclose any Personal Data outside the scope of this Agreement or the Principal Agreement.

  • Processor understands the restrictions in this Section 2 and will comply with them.

  • Processor may use Anonymous Data for its own purposes.

  • The Controller warrants and represents that:

    • it is and will at all relevant times remain duly and effectively authorized to give the instructions set out in this section;

    • it has all necessary rights to provide the Personal Data to the Processor for the Processing to be performed in relation to the Services;

    • one or more lawful bases set forth in the Applicable Laws support the lawfulness of the Processing;

    • all necessary privacy notices are provided to data subjects;

    • any necessary data subject consents to the Processing are obtained and a record of such consents is maintained; and

    • should such a consent be revoked by a data subject, and no other lawful basis remains to keep the data subject’s personal data, it will communicate the fact of such revocation to the Processor.

• Processor and Processor Affiliate Personnel

Processor and each Processor Affiliate shall take reasonable steps to ensure the reliability of any employee, agent or contractor of any Contracted Processor who may have access to the Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know / access the relevant Personal Data, as strictly necessary for the purposes of the Principal Agreement, and to comply with Applicable Laws in the context of that individual's duties to the Contracted Processor, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.

• Security

  • Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Processor and Processor Affiliate shall in relation to the Personal Data implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk.

  • In assessing the appropriate level of security, Processor and each Processor Affiliate shall take account in particular of the risks that are presented by Processing, in particular from a Personal Data Br/each.

  • The Parties acknowledge that security requirements are constantly changing and that effective security requires frequent evaluation and regular improvements of outdated security measures. The Parties will negotiate in good faith the cost, if any, to implement material changes required by specific updated security requirements set forth in Applicable Laws or by regulatory authorities of competent jurisdiction.

  • Where an amendment to the Principal Agreement is necessary in order to execute a Controller instruction to the Processor to improve security measures as may be required by changes in Applicable Laws from time to time, the Parties shall negotiate an amendment to the Principal Agreement in good faith.

• Restricted Transfers

  • Processor shall not export, transfer, store, remotely access Personal Data, or permit any of the latter in/from a country which is not part of the European Economic Area and does not benefit from an adequacy recognition decision of the European Commission pursuant to Article 45 of the GDPR, unless such export, transfer, storage, or remote access is secured through the provision of appropriate guarantees, which may consist of: (i) applicable standard data protection clauses pursuant to Article 46.2 c) or d) of the GDPR; (ii) binding corporate rules pursuant to Article 46.2 b) of the GDPR; (iii) derogations for specific situations under Article 49 of the GDPR; or, (iv) any other instrument recognized by the GDPR and approved by the European Commission or a Supervisory Authority.

  • To the extent no adequacy decision or other appropriate guarantees apply, the Parties hereby agree to and incorporate the Standard Contractual Clauses into this Agreement. Controller shall be the Data Exporter and Processor shall be the Data Importer. Appendix 1 and 2 to this Agreement shall be Annex 1 and 2 to the Standard Contractual Clauses.

• Subprocessing

  • Controller authorizes Processor and each Processor Affiliate to appoint (and permit each Subprocessor appointed in accordance with this section to appoint) Subprocessors in accordance with this section and any restrictions in the Principal Agreement.

  • Processor and each Processor Affiliate may continue to use those Subprocessors already engaged by Processor or any Processor Affiliate as of the date of this Agreement.

  • Processor shall give Controller a list of any new Subprocessors engaged after the date of this Agreement, upon reasonable request from the Controller.

  • With respect to each Subprocessor, Processor or the Processor Affiliate shall:

    • ensure that the arrangement between Processor or the Processor Affiliate, on the one hand, and the Subprocessor, on the other hand, is governed by a written contract including terms which offer at least the same level of protection for Personal Data as those set out in this Agreement; and

    • if that arrangement involves a Restricted Transfer, ensure that the Standard Contractual Clauses or other approved transfer mechanism under the GDPR (e.g. Binding Corporate Clauses) are at all relevant times incorporated into the agreement between Processor or the Processor Affiliate, on the one hand, and the Subprocessor, on the other hand.

• Data Subject Rights

  • Taking into account the nature of the Processing, Processor and each Processor Affiliate shall assist each Controller by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Controller’s obligations to respond to requests to exercise Data Subject rights under the Applicable Laws.

  • Processor shall:

    • notify Controller if Processor or a Processor Affiliate receives a request from a Data Subject under any Applicable Laws in respect of Personal Data; and,

    • ensure that the Contracted Processor does not respond to that request except as required by Applicable Laws to which the Contracted Processor is subject, in which case Processor shall to the extent permitted by Applicable Laws inform Controller of that legal requirement before the Contracted Processor responds to the request.

  • Controller shall:

    • be responsible for responding to a request from a Data Subject as required under any Applicable Laws in respect of Personal Data.

    • Assistance to Data Controller

Taking into account the nature of processing and the information available to the Processor, the Processor shall assist the Controller, at Controller’s expense, in Data Protection Impact Assessments, and with prior consultations with supervisory authorities. Controller and Processor shall work together in good faith to determine a reasonable fee for Processor’s assistance prior to the initiation of this assistance.

• Personal Data Br/each

  • Processor shall notify Controller without undue delay upon Processor or Subprocessor becoming aware of a Personal Data Br/each affecting Personal Data.

• Audits

  At the reasonable request of the Controller, the Processor shall demonstrate the technical and organizational measures it has taken pursuant to this Agreement and shall allow the Controller to audit and test such measures.

  • Controller undertaking an audit shall give Processor or the relevant Processor Affiliate reasonable notice of any audit or inspection to be conducted under this section and shall make (and ensure that each of its mandated auditors makes) reasonable endeavors to avoid causing any damage, injury or disruption to the Contracted Processors' premises, equipment, personnel and business while its personnel are on those premises in the course of such an audit or inspection.

  • A Contracted Processor need not give access to its premises for the purposes of such an audit or inspection:

    • to any individual unless he or she produces reasonable evidence of identity and authority;
    • outside normal business hours at those premises, unless the audit or inspection needs to be conducted on an emergency basis and the Controller undertaking an audit has given notice to Processor or the relevant Processor Affiliate that this is the case before attendance outside those hours begins; or
    • for the purposes of more than once audit or inspection in any calendar year, except for any additional audits or inspections which the controller is required or requested to carry out by Applicable Laws or a regulatory authority of competent jurisdiction, where the Controller has identified the relevant requirement or request in its notice to Processor or the relevant Processor Affiliate of the audit or inspection.

  • Unless otherwise required by Applicable Laws or a regulatory authority of competent jurisdiction, Contracted Processor shall fulfill the audit requirement in this Section by providing Controller with a copy of its most recent Soc 2 audit report or its equivalent, pursuant to a non-disclosure agreement, applicable to its processes, systems and networks involved in performance of the Agreement.

• Deletion or Return of Personal Data

  • Within 30 days of the termination date, Controller may by written notice require Processor and each Processor Affiliate to (a) return a complete copy of all Personal Data to Controller and/or (b) delete and procure the deletion of all other copies of Personal Data Processed by any Contracted Processor. Processor and each Processor Affiliate shall comply with any such written request within 90 days of the written request.

  • Each Contracted Processor may retain Personal Data to the extent required by Applicable Laws and shall ensure that such Personal Data is only Processed as necessary for the purpose(s) specified in the Applicable Laws.

• Governing Law and Jurisdiction

  • the parties to this Agreement hereby submit to the choice of jurisdiction stipulated in the Principal Agreement; and

  • this Agreement and all non-contractual or other obligations arising out of or in connection with it are governed by the laws of the country or territory stipulated for this purpose in the Principal Agreement.

SCHEDULE A

Standard Contractual Clauses (controllers to processors)

Name of the data exporting organisation:

Address:

Tel.:

Other information needed to identify the organisation:

(the data exporter)

And Name of the data importing organisation:Vast.ai Inc.

Address: 6600 Sunset Blvd, STE 256 Los Angeles, CA 90028

Tel.: (323) 483-5256

Other information needed to identify the organisation:

(the data importer)

each a “party”; together “the parties”, HAVE AGREED on the following Contractual Clauses (the Clauses) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Annex 1

STANDARD CONTRACTUAL CLAUSES

SECTION I

Clause 1 Purpose and scope

8.2   Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex 1, unless on further instructions from the data exporter.

8.3   Transparency

On request, the data exporter shall make a copy of these Clauses, including the Annex 1 as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex I and II and personal data, the data exporter may redact part of the text of the Annexes to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.

8.4   Accuracy

If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.

8.5   Duration of processing and erasure or return of data

Processing by the data importer shall only take place for the duration specified in Annex 1. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).

8.6   Security of processing

8.7 Sensitive data

Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards described in Appendices 1 and 2.

8.8 Onward transfers

The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:

8.9 Documentation and compliance

SECTION IV – FINAL PROVISIONS

Annex 1

Data processing information

This Annex forms part of the Clauses and must be completed and signed by the parties.

The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Annex.

Data exporter

The data exporter is:

• Customer

Data importer

The data importer is:

• Vast.ai Inc.

Data subjects The personal data transferred concern the following categories of data subjects (please specify):

• Customers

Categories of data

The personal data transferred concern the following categories of data:

• Ordinary contact information (including, but not limited to telephone number, e-mail)
• Tracking technologies and persistent identifiers such as Google pixel

Processing operations

The personal data transferred will be subject to the following basic processing activities:

• For the provision of the Services as specified in the Principal Agreement.
• The data will be transferred on a continuous basis.
• The personal data will be retained for so long as is necessary to maintain the business relationship and perform services.

Supervisory Authority: Data Protection Commission of Ireland

ANNEX II TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

The data importer will implement and maintain security standards at least as protective as those set out in Appendix 2 to the Data Processing and Security Terms.

The technical and organisational measures to be taken by Subprocessors are described in the "Subprocessor Security" section of that Appendix.

The technical and organisational measures taken by the data importer to assist the data exporter in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679 are set out in Sections 8 (Impact Assessments and Consultations) and 9 (Access etc.; Data Subject Rights; Data Export) of the Data Processing and Security Terms.

ANNEX III

The controller has authorized the use of the following sub-processors: - Stripe - Google - Meta - Twitter - Microsoft

ANNEX IV SUPPLEMENTARY TERMS FOR UK GDPR TRANSFERS ONLY

The following United Kingdom International Data Transfer Addendum to the European Commission Standard Contractual Clauses supplements the Clauses only if and to the extent the Clauses apply with respect to transfers of personal data subject to the UK GDPR.

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

VERSION B1.0, in force 21 March 2022

This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.

Part 1: Tables

Table 1: Parties

Start date (a) 21 September 2022, where the Terms Effective Date is before 21 September 2022; or (b) otherwise, on the Terms Effective Date.

The Parties Exporter (who sends the Restricted Transfer) Importer (who receives the Restricted Transfer) Parties’ details Full legal name: Vast.ai Inc. Trading name (if different): As specified in the Agreement.

Main address (if a company registered address): As specified in the Agreement.

Official registration number (if any) (company number or similar identifier): As specified in the Agreement.

Full legal name: Trading name (if different): As specified in the Agreement.

Main address (if a company registered address): As specified in the Agreement.

Official registration number (if any) (company number or similar identifier): As specified in the Agreement.

Key Contact Contact details for the data exporter are specified in the Agreement. Details about the data exporter’s data protection officer are available to the data importer in the Admin Console (where such details have been provided by the data exporter). Contact details for the data importer are specified in the Agreement. The data importer can be contacted as described in the Data Processing and Security Terms.

Signature (if required for the purposes of Section ‎2) The parties agree that execution of the Agreement by the data importer and the data exporter shall constitute execution of this Addendum by both parties. The parties agree that execution of the Agreement by the data importer and the data exporter shall constitute execution of this Addendum by both parties. Table 2: Selected SCCs, Modules and Selected Clauses

Addendum EU SCCs The version of the Approved EU SCCs which this Addendum is appended to, detailed below, including the Appendix Information: Date: 4 June 2021

Reference (if any): Module 2: Controller-to-Processor

Other identifier (if any): N/A

Table 3: Appendix Information

"Appendix Information" means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:

Annex 1A: List of Parties: Annex I(A) Annex 1B: Description of Transfer: Annex I(B) Annex II: Technical and organisational measures including technical and organisational measures to ensure the security of the data: Annex II Annex III: List of Sub processors (Modules 2 and 3 only): Annex III Table 4: Ending this Addendum when the Approved Addendum Changes

Ending this Addendum when the Approved Addendum changes Which Parties may end this Addendum as set out in Section ‎19: ✔ Importer

✔ Exporter

☐ neither Party

Part 2: Mandatory Clauses

Mandatory Clauses Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 Febr/uary 2022, as it is revised under Section ‎‎18 of those Mandatory Clauses. Part 3: Supplementary Clauses

Supplementary Clauses Part 3: Supplementary Clauses of the Approved Addendum, being the following: The data importer may not end this Addendum as set out in Section 19 of the Mandatory Clauses unless the data importer has adopted an Alternative Transfer Solution for the Restricted Transfers by the end date. An "Alternative Transfer Solution" for this purpose means a solution, other than Standard Contractual Clauses, that enables the lawful transfer of personal data to a third country in accordance with Chapter V of the UK GDPR.

Any written notice provided by the data exporter pursuant to Section 19 of the Mandatory Clauses in order to end this Addendum will be deemed to terminate the Agreement for convenience.

Appendix 2 Security Measures - Access control to systems

Measures are taken to prevent unauthorized access to IT systems. These must include the following technical and organizational measures for user identification and authentication:

• Password procedures (incl. special characters, minimum length, forced change of password)

• No access for guest users or anonymous accounts

• Access control to data

Measures are taken to prevent authorized users from accessing data beyond their authorized access rights and prevent the unauthorized input, reading, copying, removal modification or disclosure of data.

• Encryption

Encryption at rest (AES 256) and in transit (BoringSSL) is implemented across the cloud infrastructure.

The Customer remains responsible for the following security measures: - Protection of Customer’s user credentials - Appropriate technical and organizational measures to protect the confidentiality, integrity, and availability of Customer’s networks, endpoints and br/owsers used to access the Services