Teams Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Teams Customer Agreement between Activated Human LLC ("we," "our," or "us") and the organization that buys seats on Teams by Activated Human (the "Customer," or "you"). It applies whenever we process personal data for you in running the service. Words defined in the agreement mean the same thing here.

"Personal data," "controller," "processor," "data subject," and "processing" have the meanings given in the data protection law that applies to you, including the GDPR, the UK GDPR, and the Swiss Federal Act on Data Protection where those apply.

Teams has an unusual shape, and the roles follow it. There are two kinds of personal data in the service, and they have different controllers.

• We process your personal data only on your documented instructions. The agreement, each Order, and this DPA are those instructions. If the law requires us to process it some other way, we will tell you first unless the law forbids that.
• We do not sell your personal data, and we do not share it with anyone for their own purposes.
• We do not combine your personal data with data from other customers, from our other products, or from any outside source.
• We do not use your personal data to train models.
• Everyone who works with your personal data on our side is bound by a confidentiality obligation.
• If we think an instruction breaks data protection law, we will tell you.

You authorize us to use the subprocessors below. Each one receives only the data it needs to do its job, and each is bound by a written contract with data protection terms at least as protective as this DPA. We stay responsible to you for their work.

Everything else runs on infrastructure we operate. Requests are logged on that infrastructure, not sent to a third party.

We protect your personal data with measures that fit the risk. They include encryption in transit and at rest, secrets held in a secrets manager rather than in code or configuration files, and role-based access so that people and systems can reach only what their job requires. The private reads described in Section 2.2 are enforced in how the product reads and writes data, not left to policy. Our Security page has more detail and is updated as our practices change.

If we confirm a security incident that affects your personal data, we will notify the email address on your Order within 72 hours of confirming it. The notice will say what we know at the time: what happened, what data is affected, what we have done, and what we recommend you do. We will keep you updated as we learn more, and we will give you the information you need to meet your own notification duties. Notifying you of an incident is not an admission that we were at fault.

People have rights over their personal data: to see it, correct it, delete it, and so on. How we handle a request depends on who controls the data.

• Data you control. If a member or a Customer admin sends us a request about names, work emails, seat assignments, or the organization profile, we forward it to you within a reasonable time and help you respond. We do not answer on your behalf unless you ask us to.
• Data members control. Requests about a member's conversations with Teal, their work profile, or the outputs Teal produced for them go to us directly, and we handle them under the Privacy Policy. We will not forward those to you, because you have no right to that data.

Once in any 12-month period, you may send us a written security questionnaire and we will answer it, at your cost for any time beyond what a reasonable questionnaire takes. If a data protection authority requires more, or you have a specific reason to believe we are not meeting this DPA, we will agree with you on the scope, timing, and cost of an on-site audit by you or an independent auditor bound by confidentiality. Audits happen during business hours, with reasonable notice, and without disrupting the service.

We process personal data in the United States. Where your personal data is subject to the GDPR, the UK GDPR, or Swiss data protection law, the following applies to its transfer to us and to our subprocessors:

• The EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor), are incorporated into this DPA by reference. You are the data exporter and we are the data importer. Clause 9 uses Option 2, general authorization, with the notice period in Section 4.3. Annexes I and II are filled from Section 4, Section 5, and Section 12 of this DPA. For Clause 17 and Clause 18, the law and courts of Ireland govern. The optional Clause 7 docking clause applies; the optional language in Clause 11(a) does not.
• For UK data, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (version B1.0) applies with the same information, and its Part 1 tables are completed from the same sections.
• For Swiss data, the Standard Contractual Clauses apply with the adjustments the Swiss Federal Data Protection and Information Commissioner requires.
• Where a subprocessor is certified under the EU-US Data Privacy Framework, the UK Extension to it, or the Swiss-US Data Privacy Framework, we may rely on that certification for the transfer to that subprocessor.

Deletion at the end of term follows Section 8.3 of the agreement. When your term ends, member seats end with it. Members have 30 days to export their own conversations and work profile. After those 30 days, we delete those member accounts and their data. The Team Mirror and the organization profile, including the member names and work emails you gave us, are deleted at the same time, unless you ask us in writing for an export within the 30 days. Records we are required by law to keep are the exception, and we keep those only as long as the law requires and protect them under this DPA while we do.

If this DPA conflicts with the agreement on how personal data is handled, this DPA wins. If it conflicts with the Standard Contractual Clauses, the Clauses win. We update this DPA the way we update the agreement: by email to the address on your Order, at least 60 days before the change takes effect, except that we may update the subprocessor list under Section 4.3.