Data Processing Agreement

Legal basis: GDPR Article 28; EU Commission Standard Contractual Clauses (Decision 2021/914) and UK transfer mechanisms where applicable

1. Parties

1.1 Supplier

This Agreement is made between NeoSpline ApS, a company incorporated and registered in Denmark with CVR 46494008 (the "Supplier", "Data Processor") and

1.2 Customer

The legal entity that entered into an agreement with NeoSpline ApS (the "Customer"), acting as Data Controller or, where Customer processes Personal Data on behalf of its own controllers, as Data Processor. Where Customer acts as Data Processor, the Supplier acts as its Sub-Processor and references to "Data Controller" in this Agreement shall be construed accordingly.

2. Background

2.1 Customer's Use of the Services

Customer uses the Supplier's products to receive AI-assisted design and associated cloud services, including CAD plugins, the web platform, APIs, server-side AI processing, account administration, and related service interfaces.

2.2 The Services

The Supplier provides an AI-assisted design platform and associated cloud services, including CAD plugins, the web platform, APIs, server-side AI processing, account administration, and related service interfaces, and has agreed to provide those services to Customer.

2.3 Relationship to the Service Terms

This Agreement is an appendix to the terms governing Customer's use of the Services.

2.4 Business Use Only

This Agreement applies where Customer uses the Services in the course of business and the Supplier processes Personal Data on Customer's behalf. It does not apply to individuals who use the Services primarily for purposes outside their trade, business, craft, or profession (Consumers); the Supplier processes their Personal Data as an independent Data Controller as described in the Privacy Policy.

2.5 Scope of this Agreement

This Agreement governs only the Processing of Personal Data by the Supplier as Data Processor on behalf of Customer. For NeoSpline's contractual commitments regarding Customer Content, Processing Data, Product Account Data, Voice Input, Service Data, AI model-provider data handling, no-training, retention, and data residency whether or not such data contains Personal Data, see the Data Handling Terms.

Terms defined in the Terms of Service (for self-serve subscriptions) or Subscription Agreement (for sales-assisted subscriptions), and in the Data Handling Terms, have the same meaning in this Agreement unless otherwise defined here.

3. Interpretation

3.1 Defined Terms

Where this Agreement uses terms defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

3.2 Reading in Light of the GDPR

This Agreement shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

3.3 Rights of Data Subjects

This Agreement shall not be interpreted in a way that runs counter to the rights and obligations provided for in Regulation (EU) 2016/679 or in a way that prejudices the fundamental rights or freedoms of Data Subjects.

4. Hierarchy

4.1 Precedence

In the event of a contradiction between this Agreement and other agreements between the parties, this Agreement shall prevail only in relation to the Processing of Personal Data by the Supplier as Data Processor on behalf of Customer.

5. Definitions and Application

5.1 Definitions

In this Agreement the following terms have the meaning set out below:

"Data Protection Legislation" means all laws relating to data protection, the Processing of Personal Data and privacy, in each case as applicable to a party in respect of the Processing of Personal Data under this Agreement, including the Danish Data Protection Act, Regulation (EU) 2016/679, the UK GDPR and Data Protection Act 2018 where applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act where applicable, and any other such applicable legislation and regulations in any country, and any modification or reenactment of such legislation or regulations from time to time.

"Data Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.

"Data Subject" means an identified or identifiable natural person to whom Personal Data relates.

"NeoSpline Controller Data" means Personal Data that NeoSpline processes as an independent Data Controller for its own business, legal, security, billing, analytics, marketing, authentication administration, service administration, account and customer relationship management, support, product feedback, internal business operations, and compliance purposes, as described in the Privacy Policy. NeoSpline Controller Data includes the business contact details (name, email address, organization name, and role) of Customer's authorized users where processed for those purposes. NeoSpline Controller Data is not Personal Data processed on behalf of Customer under this Agreement.

"Personal Data" means any information relating to an identified or identifiable natural person that is passed from Customer to the Data Processor or otherwise processed by the Data Processor on behalf of Customer through the Services, including the information listed in Appendix 1. Customer Content, Processing Data, Product Account Data, Voice Input, and specific Service Data are Personal Data only to the extent they contain or relate to an identified or identifiable natural person and are processed on Customer's behalf.

"Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

"Sub-Processor" means any processor engaged by the Data Processor to carry out specific Processing activities on behalf of Customer.

5.2 Application

This Agreement shall apply to all Personal Data processed by the Data Processor on behalf of Customer from the date of this Agreement until the Agreement terminates pursuant to Section 10.

6. Purpose of Processing

6.1 Purpose

The Data Processor shall process Personal Data solely for the Processing operations set out in Appendix 1 and for no other purpose except with Customer's express written consent or as required by applicable law. The purpose of Processing Personal Data is to provide, secure, monitor, and support the Services, including web platform and API access, AI-assisted design features, Product Account Data management, API client and credential administration, account access, conversation history management, file attachment handling, Voice Input transcription, service quality monitoring, and detection and prevention of misuse.

6.2 Documented Instructions

The Data Processor will Process Personal Data only on behalf of Customer and in compliance with Customer's documented instructions, this Agreement, the Agreement governing the Services, and the Data Handling Terms. If the Data Processor cannot comply with those instructions, the Data Processor will inform Customer promptly of its inability to comply.

7. Security and Confidentiality of Personal Data

7.1 Compliance with Data Protection Legislation

The Data Processor shall carry out the Processing in compliance with the Data Protection Legislation.

7.2 Technical and Organizational Measures

The Data Processor shall implement appropriate technical and organizational measures to safeguard Personal Data from unauthorized or unlawful Processing or accidental loss, destruction, damage, or disclosure. The current measures are described in Appendix 2 and in the Data Handling Terms.

7.3 Personnel

The Data Processor shall ensure that each of its employees, agents, and subcontractors authorized to Process Personal Data:

a) is subject to an appropriate obligation of confidentiality;

b) Processes Personal Data solely on Customer's documented instructions; and

c) is appropriately reliable, qualified, and trained in relation to the Processing of Personal Data.

7.4 Disclosure

The Data Processor shall not disclose Personal Data to any person, firm, or company except to employees, agents, or subcontractors engaged in the Processing of Personal Data and subject to the obligations referred to in Section 7.3, or as otherwise authorized by Customer or required by applicable law.

7.5 Sub-Processor Contracts

If the Data Processor engages a Sub-Processor, the Data Processor shall ensure that a written contract imposing data protection obligations equivalent to those in this Agreement is entered into by the Sub-Processor. The Data Processor will remain responsible for all acts and omissions of any Sub-Processor as if they were its own.

7.6 Authorization of Sub-Processors

Customer grants the Data Processor general written authorization to engage the Sub-Processors listed in the Sub-Processor List. The list will be updated on an ongoing basis via the Supplier's website, and Customer will be notified at least 30 days before any new Sub-Processor begins to process Personal Data on Customer's behalf. Customer may object to a new Sub-Processor within 30 days of notification. If the parties cannot resolve the objection, Customer may terminate the affected Services in accordance with the Agreement. Where a Sub-Processor must be replaced urgently to maintain the security, availability, or continuity of the Services, the Data Processor may engage a replacement Sub-Processor immediately and will notify Customer without undue delay; Customer's objection right applies from the date of that notice.

7.7 Processing Locations

Personal Data are processed in the locations described in the Data Handling Terms and Sub-Processor List. Where Customer Content, Processing Data, Product Account Data, Voice Input, or specific Service Data contains Personal Data processed on Customer's behalf, the safeguards in this Agreement apply to that Personal Data.

7.8 International Transfers

For transfers of Personal Data outside the EEA, the United Kingdom, or another jurisdiction recognized as providing an adequate level of protection, the Data Processor shall ensure that an appropriate transfer mechanism is in place, including, as applicable:

a) an adequacy decision;

b) the EU-U.S. Data Privacy Framework, including the UK Extension where applicable;

c) the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), including Module 2 and Module 3 where applicable; and

d) the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or another UK-approved transfer mechanism where UK GDPR applies.

7.9 Data Security Incident Notification

The Data Processor shall notify Customer without undue delay after becoming aware of a Data Security Incident affecting Personal Data processed on Customer's behalf. Where it is not possible to provide all relevant information at the same time, the Data Processor may provide the information in phases as it becomes available without undue further delay.

7.10 Notification and Assistance

The Data Processor shall, taking into account the nature of the Processing and the information available to it, promptly notify Customer of and assist Customer in relation to:

a) any legally binding request for disclosure of Personal Data by a law enforcement authority unless otherwise prohibited from so notifying;

b) documenting, reporting, or taking measures to address or mitigate any Data Security Incident;

c) any request received seeking to exercise a Data Subject's rights under the Data Protection Legislation; and

d) conducting data protection impact assessments of any Processing operations and consulting with any applicable supervisory authority.

7.11 Enquiries

The Supplier will respond via privacy@neospline.ai to enquiries from either a Data Subject or Customer relating to the Processing of Personal Data and will deal promptly and properly with any such enquiries and within the time frames stipulated by the Data Protection Legislation.

7.12 Information and Audits

The Data Processor will make available to Customer all information necessary to demonstrate compliance with the obligations set out in this Agreement and allow for and contribute to audits, including inspections, conducted by Customer or another auditor mandated by Customer. Audits shall be limited to once per year unless required by a competent supervisory authority or following a Data Security Incident, shall be subject to at least 30 days' advance notice, shall first rely on third-party audit reports, certifications, and written responses where available, and shall be conducted at Customer's expense.

7.13 Customer Instructions

The Data Processor will comply with all reasonable written instructions from Customer to rectify, delete, update, return, or restrict Personal Data and will confirm to Customer within a reasonable time that this has been done.

7.14 Data Subject Requests

The Data Processor will assist Customer in responding to Data Subject rights requests, including access, correction, deletion, restriction, objection, and portability requests, as reasonably requested in writing by Customer.

7.15 Public Announcements

The Data Processor will not make or permit any public announcement that identifies Customer in connection with a Data Security Incident without Customer's prior written consent, except where required by applicable law.

8. Liability

8.1 Limitation of Liability

Each party's liability under this Agreement is subject to the limitations and exclusions of liability set out in the Agreement governing the Services, except to the extent prohibited by Data Protection Legislation.

9. Surviving Obligations

9.1 Deletion or Return at Termination

At termination of the Services, the Data Processor shall, at Customer's choice, securely delete or return Personal Data processed on behalf of Customer and certify to Customer that this has been done, subject to Section 10.4.

9.2 Retention Required by Law

If applicable law prevents the Data Processor from deleting or returning all or part of the Personal Data, the Data Processor warrants that it shall guarantee the confidentiality and security of that Personal Data and shall hold it only for the purposes mandated by applicable law and in accordance with this Agreement.

10. Termination

10.1 Term

Subject to Section 10.5, this Agreement will terminate when Customer's agreement with the Supplier terminates.

10.2 Termination by Customer

Customer shall be entitled to terminate this Agreement and the contract to which this Agreement is appended insofar as it concerns Processing of Personal Data if:

a) the Data Processor is in substantial or persistent breach of this Agreement or its obligations under Regulation (EU) 2016/679; or

b) the Data Processor fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations pursuant to this Agreement or to Regulation (EU) 2016/679.

10.3 Termination by the Data Processor

The Data Processor shall be entitled to terminate this Agreement and the contract to which this Agreement is appended insofar as it concerns Processing of Personal Data where, after having informed Customer that its instructions infringe applicable legal requirements, Customer insists on compliance with the instructions.

10.4 Deletion or Return after Termination

Following termination of this Agreement, the Data Processor shall, at Customer's choice, delete all Personal Data processed on behalf of Customer and certify to Customer that it has done so, or return all Personal Data to Customer and delete existing copies unless Union or Member State law requires storage of the Personal Data. Personal Data residing in encrypted backup systems is deleted in accordance with the backup rotation cycle described in the Data Handling Terms and remains subject to this Agreement until overwritten. Until the Personal Data is deleted or returned, the Data Processor shall continue to ensure compliance with this Agreement.

10.5 Survival

Notwithstanding termination, the provisions of Section 7 shall survive termination and shall continue in full force and effect until the Data Processor has complied in full with Sections 9.1 and 9.2.

Appendix 1 — Data Processing Terms

1. Background:

a) These Data Processing Terms set out contractual provisions to ensure the protection and security of Personal Data processed by the Data Processor on behalf of Customer.

b) The Data Protection Legislation places certain obligations upon a Data Controller to ensure that any Data Processor it engages provides sufficient guarantees to ensure that Processing of Personal Data carried out on its behalf is secure and lawful.

c) These Data Processing Terms exist to ensure that sufficient security guarantees are in place and that Processing complies with the Data Protection Legislation.

2. The Personal Data relates to Customer's authorized users and any individuals whose Personal Data is included in Customer Content, Processing Data, Product Account Data, Voice Input, or other data processed through the Services on behalf of Customer.

3. Categories of Personal Data processed by the Data Processor may include, to the extent included or made available by Customer through the Services:

a) Personal Data contained in Customer Content;

b) Personal Data contained in Processing Data, to the extent derived from or linkable to Personal Data contained in Customer Content;

c) Voice Input where an authorized user uses the speech-to-text feature. Voice Input is processed for transcription only and is not used for speaker identification, voiceprinting, biometric identification, or authentication;

d) Product Account Data and authorized-user identifiers necessary to provide the Services, such as name, email address, organization, role or membership, invitation status, activation status, account settings, organization administrative Audit Records, API client/application identifiers, permission and scope metadata, and authentication/session identifiers, to the extent processed on behalf of Customer for access to the Services;

e) technical information necessary to secure and operate the Services, such as IP addresses, device or browser metadata, API request metadata, permission and authorization events, event timestamps, and security events, to the extent processed on behalf of Customer; and

f) Personal Data contained in support requests and related support communications concerning the Services submitted by Customer's authorized users, to the extent processed on behalf of Customer.

4. NeoSpline Controller Data is outside the scope of this Agreement and is described in the Privacy Policy.

5. Personal Data will be processed in connection with the Processing operations during the term of this Agreement or such shorter period where the Processing is no longer authorized, and in respect of any post-termination Processing activities permitted by Customer from time to time.

6. The Data Processor does not intentionally collect or store special categories of Personal Data under Article 9 of Regulation (EU) 2016/679 or Personal Data relating to criminal convictions and offences under Article 10 of Regulation (EU) 2016/679. Customer shall not submit such Personal Data to the Services unless expressly agreed in writing and supported by a valid legal basis.

Appendix 2 — Technical and Organizational Measures

Full security posture details are available on request through the security documents form (opens in a new tab).

Appendix 3 — International Transfers

1. Customer acknowledges that providing the Services may involve international transfers of Personal Data to the Sub-Processors and locations described in the Sub-Processor List and Data Handling Terms.

2. For transfers of Personal Data outside the EEA, the United Kingdom, or another jurisdiction recognized as providing an adequate level of protection, the Supplier shall rely on one or more lawful transfer mechanisms, including:

a) an adequacy decision;

b) the EU-U.S. Data Privacy Framework, including the UK Extension where applicable;

c) the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), including Module 2 and Module 3 where applicable; and

d) the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or another UK-approved transfer mechanism where UK GDPR applies.