Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service available at https://askpom.com/legal/terms (the "Agreement") between the entity identified as the customer in the Agreement ("Customer") and Pom Labs, Inc., a Delaware corporation ("POM," "we," "us," or "our"), collectively referred to as the "Parties" and each individually as a "Party."

This DPA is automatically incorporated into and forms an integral part of the Agreement. No separate execution is required. By using the Service, Customer agrees to the terms of this DPA.

1. DEFINITIONS

1.1. "Applicable Data Protection Law" means all laws and regulations relating to the processing of Personal Data that apply to the Processing of Personal Data under this DPA, including but not limited to: (a) the General Data Protection Regulation (EU) 2016/679 ("GDPR"); (b) the United Kingdom General Data Protection Regulation as incorporated into UK law by the Data Protection Act 2018 ("UK GDPR"); (c) the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 ("CCPA/CPRA"); (d) the Swiss Federal Act on Data Protection ("Swiss DPA"); and (e) any other applicable data protection or privacy laws of any jurisdiction in which Customer operates or to which Customer is subject.

1.2. "Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. For the purposes of this DPA, Customer is the Controller.

1.3. "Customer Data" has the meaning given in the Agreement.

1.4. "Data Subject" means an identified or identifiable natural person to whom Personal Data relates.

1.5. "EEA" means the European Economic Area.

1.6. "Personal Data" means any information relating to an identified or identifiable natural person that is Processed by POM on behalf of Customer in connection with the Service. Where Applicable Data Protection Law uses an alternative term (such as "Personal Information" under CCPA/CPRA), Personal Data shall be interpreted to include such term.

1.7. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise Processed.

1.8. "Processing" (and its cognates "Process," "Processed," "Processes") means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

1.9. "Processor" means a natural or legal person, public authority, agency, or other body which Processes Personal Data on behalf of the Controller. For the purposes of this DPA, POM is the Processor.

1.10. "Service" has the meaning given in the Agreement.

1.11. "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to processors established in third countries, as approved by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021, as may be amended or replaced from time to time.

1.12. "Security Incident" means any confirmed or reasonably suspected event that results in the unauthorized access, disclosure, alteration, loss, or destruction of Customer Data (including Personal Data) Processed by POM under this DPA, whether or not such event constitutes a Personal Data Breach.

1.13. "Sub-processor" means any third party engaged by POM to Process Personal Data on behalf of Customer in connection with the Service.

1.14. "Supervisory Authority" means an independent public authority established by an EU or EEA Member State, the United Kingdom, or Switzerland pursuant to Applicable Data Protection Law.

1.15. "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under Section 119A(1) of the Data Protection Act 2018, as may be amended or replaced from time to time.

1.16. Capitalized terms not defined in this DPA shall have the meanings given to them in the Agreement.

2. SCOPE AND APPLICABILITY

2.1. Scope. This DPA applies to POM's Processing of Personal Data on behalf of Customer in connection with the provision of the Service under the Agreement.

2.2. Roles. With respect to the Processing of Personal Data under this DPA, Customer is the Controller and POM is the Processor. Each Party shall comply with the obligations applicable to it in its respective role under Applicable Data Protection Law.

2.3. Conflict. In the event of any conflict or inconsistency between this DPA and any other terms of the Agreement (including the Terms of Service or any Master Service Agreement), the terms of this DPA shall prevail with respect to the Processing of Personal Data.

2.4. Incorporation. This DPA is automatically incorporated into the Agreement and applies to all Customer accounts. No separate signature or execution is required for this DPA to take effect.

2.5. Agentic AI Processing. Customer acknowledges that the Service involves AI agent orchestration in which data flows through multiple AI model providers. POM acts as Processor regardless of the number or identity of AI model providers used to deliver the Service. POM does not independently determine the purposes or means of Processing. Where EDPB guidance (including Opinion 28/2024) requires role assessment before Processing, POM maintains documentation of its role as Processor for all Processing activities performed in connection with the Service.

3. ROLES AND RESPONSIBILITIES

3.1. Customer Responsibilities (Controller)

3.1.1. Customer shall determine the purposes and means of Processing Personal Data and shall ensure that it has a lawful basis for Processing under Applicable Data Protection Law, including for the transfer of Personal Data to POM and, through POM, to Sub-processors.

3.1.2. Customer is responsible for ensuring the accuracy, quality, and legality of Personal Data provided to POM and the means by which Customer acquired such Personal Data.

3.1.3. Customer shall provide all required notices to, and obtain all required consents or authorizations from, Data Subjects as required under Applicable Data Protection Law in connection with the Processing contemplated by this DPA.

3.1.4. Customer shall ensure that its use of the Service, including all instructions to POM regarding the Processing of Personal Data, complies with Applicable Data Protection Law.

3.1.5. Customer acknowledges that, as Controller, it bears primary responsibility for compliance with GDPR Articles 13 and 14 (transparency obligations) and Article 22 (automated decision-making) with respect to any use of the Service that involves automated decision-making affecting Data Subjects.

3.2. POM Responsibilities (Processor)

3.2.1. POM shall Process Personal Data only on documented instructions from Customer, including with respect to transfers of Personal Data to a third country or international organization, unless required to do so by European Union or Member State law to which POM is subject. In such case, POM shall inform Customer of that legal requirement before Processing, unless that law prohibits such notice on important grounds of public interest.

3.2.2. POM shall not independently determine the purposes or means of Processing Personal Data. POM's Processing of Personal Data shall be limited to what is necessary to provide the Service in accordance with the Agreement and Customer's documented instructions.

3.2.3. POM shall ensure that persons authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.2.4. POM shall implement and maintain the technical and organizational security measures described in Annex 2 of this DPA.

3.2.5. POM shall inform Customer without undue delay if, in POM's opinion, an instruction from Customer infringes Applicable Data Protection Law. POM shall not be required to independently assess the legality of Customer's instructions, but shall raise concerns where apparent non-compliance is identified.

3.2.6. POM shall delete or return Personal Data upon termination of the Agreement as set forth in Section 12.

4. PROCESSING DETAILS

The details of the Processing carried out under this DPA are set forth in Annex 1. A summary is provided below:

4.1. Subject Matter. The provision of AI agent orchestration services, including routing Customer Data through AI model providers to deliver the Service.

4.2. Duration. The Processing shall continue for the duration of the Agreement and for such additional period as is necessary for POM to complete any outstanding Processing obligations, including data return or deletion as described in Section 12.

4.3. Nature and Purpose. POM Processes Personal Data to provide the Service, which includes: (a) receiving Customer prompts and context data; (b) routing such data through AI model providers; (c) returning AI model outputs to Customer; (d) maintaining session history, usage metrics, and audit trails; and (e) enforcing governance controls including permissions, budgets, and security policies.

4.4. Types of Personal Data. Names, email addresses, usernames, professional titles, IP addresses, device identifiers, and any other Personal Data that Customer includes in prompts, source code, configuration, context data, or other Customer Data submitted to the Service.

4.5. Categories of Data Subjects. Customer's employees and authorized users; Customer's end users; and any other individuals whose Personal Data is contained within Customer Data submitted to the Service.

4.6. Special Categories of Data. POM does not intentionally Process special categories of Personal Data (as defined in GDPR Article 9) or data relating to criminal convictions and offenses (as defined in GDPR Article 10). Customer shall not submit special categories of Personal Data to the Service without POM's prior written consent and the establishment of appropriate supplementary safeguards.

5. CUSTOMER INSTRUCTIONS

5.1. Documented Instructions. POM shall Process Personal Data only in accordance with Customer's documented instructions. The Agreement (including the Terms of Service and this DPA) constitutes Customer's complete and final documented instructions to POM for the Processing of Personal Data as of the Effective Date. Any additional or alternative instructions must be agreed upon separately in writing by the Parties.

5.2. Additional Instructions. Customer may provide additional Processing instructions to POM, provided that such instructions are: (a) consistent with the terms of the Agreement; (b) reasonable and within the scope of the Service; and (c) in writing. POM may charge reasonable additional fees for compliance with instructions that fall outside the standard scope of the Service.

5.3. Notification of Infringing Instructions. If POM reasonably believes that a Customer instruction infringes Applicable Data Protection Law, POM shall notify Customer promptly. POM may suspend compliance with the relevant instruction until Customer confirms or modifies the instruction. POM shall not be liable for any delay in performance resulting from such suspension.

6. SUB-PROCESSORS

6.1. General Authorization

6.1.1. Customer provides general written authorization for POM to engage Sub-processors to Process Personal Data on behalf of Customer in connection with the Service, subject to the requirements of this Section 6.

6.1.2. POM's current Sub-processors as of the Effective Date are listed in Annex 3 and published at https://askpom.com/legal/sub-processors (the "Sub-processor List"). Customer's entry into the Agreement constitutes prior written consent to the engagement of each Sub-processor on the Sub-processor List as of the Effective Date.

6.2. Sub-processor Obligations

6.2.1. POM shall impose on each Sub-processor, by way of a written contract, data protection obligations that are substantively no less protective of Personal Data than those set forth in this DPA, taking into account the nature of the Processing performed by the Sub-processor.

6.2.2. POM shall remain fully liable to Customer for the acts and omissions of its Sub-processors to the same extent POM would be liable if performing the Processing directly, subject to the limitations of liability set forth in the Agreement.

6.3. Notification of New Sub-processors

6.3.1. POM shall notify Customer at least thirty (30) days before authorizing any new Sub-processor to Process Personal Data ("Notification Period"). Notification shall be provided by email to the address designated by Customer for DPA-related notifications, and by updating the Sub-processor List at https://askpom.com/legal/sub-processors.

6.3.2. Customers may subscribe to Sub-processor change notifications by sending an email to [email protected].

6.4. Objection to New Sub-processors

6.4.1. Customer may object to POM's use of a new Sub-processor by notifying POM in writing within thirty (30) days of receiving the notification described in Section 6.3.1. The objection must state reasonable grounds related to data protection.

6.4.2. Upon receipt of a timely objection, POM shall use commercially reasonable efforts to make available to Customer a change in the Service or recommend a commercially reasonable alternative to avoid Processing of Personal Data by the objected-to Sub-processor.

6.4.3. If POM is unable to provide such an alternative within thirty (30) days of receiving the objection, either Party may terminate the affected portion of the Service by providing written notice to the other Party. POM shall refund Customer any prepaid and unused fees covering the remainder of the term following the effective date of termination with respect to the terminated portion of the Service.

6.4.4. If Customer does not object within the Notification Period, Customer shall be deemed to have accepted the new Sub-processor.

6.5. AI Model Provider Sub-processors

6.5.1. Customer acknowledges that the Service requires the routing of Customer Data to third-party AI model provider Sub-processors ("POM-Managed Providers") for AI inference processing. POM uses only commercial or paid API tiers of AI model providers that contractually commit to not using Customer Data for model training. The current list of POM-Managed Providers is maintained at https://askpom.com/legal/sub-processors.

6.5.2. Provider-specific data handling terms, including data retention periods, no-training commitments, and any applicable caveats (such as de-identification or aggregation provisions), are detailed on the Sub-processor List at https://askpom.com/legal/sub-processors.

6.6. Customer-Configured Providers

6.6.1. The Service may allow Customer to configure connections to third-party AI model providers or model routing services that are not managed by POM ("Customer-Configured Providers"), including by supplying Customer's own API keys, configuring third-party routing services, or connecting self-hosted models.

6.6.2. Customer-Configured Providers are not Sub-processors of POM within the meaning of this DPA. POM does not select, vet, contract with, or maintain data processing agreements with Customer-Configured Providers. POM's obligations under this DPA, including Sections 6.1 through 6.5, do not apply to Customer-Configured Providers.

6.6.3. When Customer Data is routed to a Customer-Configured Provider, POM acts solely as a technical pass-through. Customer is solely responsible for: (a) establishing an appropriate legal basis for the transfer of Personal Data to the Customer-Configured Provider; (b) ensuring that the Customer-Configured Provider provides sufficient guarantees regarding technical and organizational measures; and (c) entering into any data processing agreement required by Applicable Data Protection Law with the Customer-Configured Provider.

6.6.4. POM shall not be liable for any acts or omissions of a Customer-Configured Provider, including any unauthorized Processing, data breach, or failure to comply with Applicable Data Protection Law by such provider.

7. SECURITY MEASURES

7.1. Technical and Organizational Measures. POM shall implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, damage, theft, or disclosure, as described in Annex 2 of this DPA.

7.2. Adequacy. POM shall take reasonable steps to ensure that the security measures are appropriate to the risks presented by the Processing, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.

7.3. Updates. POM may update the security measures from time to time, provided that any update does not materially decrease the overall level of protection afforded to Personal Data.

7.4. Employee Obligations. POM shall ensure that all POM personnel who have access to Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their data protection responsibilities, and are subject to enforceable confidentiality obligations.

8. PERSONAL DATA BREACH NOTIFICATION

8.1. Notification. POM shall notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a confirmed Personal Data Breach affecting Personal Data Processed by POM under this DPA.

8.2. Content of Notification. The notification shall include, to the extent reasonably available:

(a) a description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned;

(b) the name and contact details of POM's contact point from whom more information can be obtained;

(d) a description of the measures taken or proposed to be taken by POM to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

8.3. Cooperation. POM shall cooperate with Customer and take such reasonable commercial steps as Customer may request to assist in the investigation, mitigation, and remediation of the Personal Data Breach, and in Customer's compliance with its own breach notification obligations under Applicable Data Protection Law.

8.4. No Acknowledgment. POM's notification of or response to a Personal Data Breach under this Section 8 shall not be construed as an acknowledgment by POM of any fault or liability with respect to the Personal Data Breach.

8.5. Contact. Customer shall provide POM with current security contact information for Personal Data Breach notifications. POM may deliver breach notifications to the email address associated with Customer's account if no alternative contact is designated.

9. DATA SUBJECT RIGHTS

9.1. Assistance. Taking into account the nature of the Processing, POM shall assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of Customer's obligations to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law, including rights of access, rectification, erasure, data portability, restriction of Processing, and objection to Processing.

9.2. Redirect. If POM receives a request directly from a Data Subject regarding Personal Data Processed on behalf of Customer, POM shall promptly redirect the Data Subject to Customer and shall notify Customer of the request. POM shall not respond to the Data Subject directly unless authorized to do so by Customer or required by Applicable Data Protection Law.

9.3. Costs. POM shall provide the assistance described in this Section 9 at Customer's reasonable expense, unless the need for such assistance arises from POM's breach of this DPA or Applicable Data Protection Law, in which case POM shall bear the cost.

10. DATA TRANSFERS

10.1. Transfer Mechanisms

10.1.1. POM shall not transfer Personal Data to a country or territory outside the EEA, the United Kingdom, or Switzerland unless appropriate safeguards are in place as required by Applicable Data Protection Law.

10.1.2. To the extent that the Processing of Personal Data under this DPA involves the transfer of Personal Data from the EEA, the United Kingdom, or Switzerland to a jurisdiction that has not been deemed to provide an adequate level of data protection, the Parties agree to the following transfer mechanisms, in order of precedence:

(a) EU-US Data Privacy Framework ("DPF"): Where the data importer (POM or a Sub-processor) is certified under the EU-US Data Privacy Framework, transfers may rely on such certification as a valid transfer mechanism.

(b) Standard Contractual Clauses: The Parties agree to the EU Standard Contractual Clauses as published in Commission Implementing Decision (EU) 2021/914, Module Two (Controller to Processor), which are incorporated by reference into this DPA and attached as Annex 4. For the purposes of the SCCs:

The "data exporter" is Customer (Controller);
The "data importer" is POM (Processor);
The details of the transfer are as set forth in Annex 1;
The competent supervisory authority is the supervisory authority of the EU Member State in which Customer is established, or where Customer is not established in the EEA, the supervisory authority of the EU Member State in which Customer's EU representative is established;
The governing law of the SCCs shall be the law of the EU Member State in which the data exporter is established, or where the data exporter is not established in the EU, the laws of Ireland;
Disputes shall be resolved before the courts of the EU Member State in which the data exporter is established, or where the data exporter is not established in the EU, the courts of Ireland.

10.2. UK International Data Transfer Addendum

10.2.1. To the extent that the Processing involves transfers of Personal Data from the United Kingdom, the UK Addendum (as defined in Section 1.14) is incorporated into this DPA and shall apply in addition to the SCCs, with the modifications and interpretations required by the UK Addendum.

10.2.2. For the purposes of the UK Addendum, the relevant information is as set forth in Annex 1 and the Tables of the UK Addendum shall be completed accordingly.

10.3. Swiss Addendum

10.3.1. To the extent that the Processing involves transfers of Personal Data from Switzerland, the SCCs shall apply with the following modifications: (a) references to the GDPR shall be interpreted as references to the Swiss DPA; (b) references to EU Member State law shall be interpreted as references to Swiss law; (c) the competent supervisory authority shall be the Swiss Federal Data Protection and Information Commissioner; and (d) references to "Member State" shall not be interpreted in a way that excludes Swiss Data Subjects from the possibility of suing for their rights in their place of habitual residence in Switzerland.

10.4. Transfer Impact Assessment

10.4.1. POM maintains a transfer impact assessment evaluating the legal framework of destination countries for data transfers. POM shall make a summary of such assessment available to Customer upon reasonable request.

10.4.2. POM shall notify Customer if POM becomes aware of any change in the laws of a destination country that is likely to have a substantial adverse effect on the protections provided by the transfer mechanisms relied upon under this Section 10.

11. AUDIT RIGHTS

11.1. Audit Right. Customer may audit POM's compliance with this DPA, subject to the conditions of this Section 11.

11.2. Audit Request. Customer shall provide POM with at least thirty (30) days' prior written notice of any audit request, specifying the proposed scope, duration, and start date of the audit.

11.3. Frequency. Customer may exercise its audit rights no more than once in any twelve (12) month period, unless: (a) an audit is specifically requested or required by a Supervisory Authority; or (b) POM has suffered a confirmed Personal Data Breach affecting Customer's Personal Data.

11.4. Conduct. Audits shall be conducted during POM's normal business hours and shall be carried out in a manner that minimizes disruption to POM's operations. Customer (or its appointed third-party auditor, who shall be subject to confidentiality obligations acceptable to POM) shall comply with POM's reasonable security and access policies.

11.5. Alternative Audit Mechanisms. POM may satisfy Customer's audit requests by providing one or more of the following: (a) a SOC 2 Type II report or equivalent third-party audit report, not more than twelve (12) months old; (b) relevant certifications (such as ISO 27001) or attestations; (c) responses to a reasonable security or data protection questionnaire; or (d) results of third-party penetration tests. If such documentation reasonably addresses Customer's audit concerns, Customer shall accept it in lieu of an on-site audit.

11.6. Costs. Customer shall bear the costs of any audit, including POM's reasonable internal costs associated with facilitating the audit. If an audit reveals material non-compliance by POM with this DPA, POM shall bear its own costs and shall promptly remediate the non-compliance at its own expense.

11.7. Enterprise Tier. Customers on POM's Enterprise tier may negotiate enhanced audit rights under a separate Master Service Agreement, including more frequent audits, expanded scope, or on-site inspection rights.

11.8. Confidentiality. All information obtained or generated in connection with an audit under this Section 11 shall be treated as POM's Confidential Information under the Agreement, except to the extent disclosure is required by Applicable Data Protection Law or a Supervisory Authority.

12. DATA DELETION AND RETURN

12.1. Customer Election. Upon termination or expiration of the Agreement, Customer may elect, by written notice to POM within thirty (30) days of termination or expiration, to have POM either: (a) return all Personal Data to Customer in a commonly used, machine-readable format; or (b) delete all Personal Data in POM's possession or control.

12.2. Deletion Timeline. If Customer elects deletion, or if Customer does not make an election within the thirty (30) day period described in Section 12.1, POM shall delete all Personal Data within thirty (30) days following the end of the election period, except as provided in Section 12.3.

12.3. Retention Exception. POM may retain Personal Data to the extent required by Applicable Data Protection Law, and only for the period and purposes required by such law. POM shall implement appropriate technical and organizational measures to ensure the confidentiality and security of any retained Personal Data and shall Process such data only for the purposes required by law.

12.4. Confirmation. POM shall provide written confirmation of the deletion of Personal Data upon Customer's request.

12.5. Enterprise Tier. Customers on POM's Enterprise tier may request certified deletion, including a formal certificate of destruction.

12.6. Sub-processor Data. POM shall ensure that each POM-Managed Provider deletes Personal Data in accordance with such provider's published data retention schedule, and shall use commercially reasonable efforts to cause POM-Managed Providers to delete Personal Data promptly following termination. Current retention periods for each POM-Managed Provider are detailed on the Sub-processor List at https://askpom.com/legal/sub-processors. POM's deletion obligations under this Section 12 do not extend to Customer-Configured Providers; Customer is responsible for managing data deletion with any Customer-Configured Provider.

13. COOPERATION AND ASSISTANCE

13.1. Data Protection Impact Assessments. POM shall provide reasonable assistance to Customer, at Customer's expense, in conducting data protection impact assessments ("DPIAs") to the extent required under GDPR Article 35, taking into account the nature of the Processing and the information available to POM.

13.2. Prior Consultation. POM shall provide reasonable cooperation to Customer in connection with any prior consultation with a Supervisory Authority pursuant to GDPR Article 36, to the extent such consultation relates to Processing carried out by POM under this DPA.

13.3. Records of Processing. POM shall maintain records of Processing activities carried out on behalf of Customer in accordance with GDPR Article 30(2), including: (a) the name and contact details of POM and, where applicable, POM's representative and data protection officer; (b) the categories of Processing carried out on behalf of Customer; (c) transfers of Personal Data to third countries, including identification of the transfer mechanism relied upon; and (d) a general description of the technical and organizational security measures referred to in Section 7 and Annex 2.

13.4. Data Protection Officer. POM has assessed the requirements of GDPR Article 37 and has determined that the appointment of a Data Protection Officer is not currently required based on the nature and scale of POM's Processing activities. POM shall appoint a Data Protection Officer if and when required by Applicable Data Protection Law, and shall notify Customer of such appointment. In the interim, all data protection inquiries may be directed to [email protected].

13.5. Regulatory Inquiries. POM shall promptly inform Customer if POM receives an inquiry or request from a Supervisory Authority relating to Personal Data Processed on behalf of Customer, unless prohibited from doing so by Applicable Data Protection Law.

14. CCPA/CPRA SPECIFIC PROVISIONS

14.1. Applicability. This Section 14 applies only to the extent that POM Processes Personal Data that constitutes "Personal Information" as defined under the CCPA/CPRA on behalf of a Customer that is subject to the CCPA/CPRA. For the purposes of this Section 14, "Personal Information," "Business," "Service Provider," "Sale," "Share," and "Business Purpose" have the meanings given to them under the CCPA/CPRA.

14.2. Service Provider Status. POM is a "Service Provider" as defined under the CCPA/CPRA. POM Processes Personal Information received from Customer, or on behalf of Customer, solely for the Business Purposes specified in the Agreement and this DPA.

14.3. No Sale. POM does not sell Personal Information and shall not sell Personal Information received from or on behalf of Customer.

14.4. No Sharing. POM does not share Personal Information for cross-context behavioral advertising and shall not share Personal Information received from or on behalf of Customer for such purpose.

14.5. Use Restrictions. POM shall not retain, use, or disclose Personal Information received from or on behalf of Customer for any purpose other than: (a) the Business Purposes specified in the Agreement and this DPA; (b) POM's internal use to build or improve the quality of the Service, provided such use does not include using Personal Information to perform services on behalf of a third party; (c) detecting data security incidents; (d) protecting against fraudulent or illegal activity; and (e) as otherwise permitted by the CCPA/CPRA for Service Providers.

14.6. No Combination. POM shall not combine Personal Information received from or on behalf of Customer with Personal Information that POM receives from or on behalf of another person or entity, or that POM collects from its own interaction with Data Subjects, except as permitted by the CCPA/CPRA for Service Providers.

14.7. Certification. POM certifies that it understands the restrictions in this Section 14 and will comply with them. POM further certifies that it will not attempt to re-identify any de-identified data that Customer provides to POM under the Agreement without Customer's prior written consent.

14.8. Consumer Rights. POM shall assist Customer in responding to verifiable consumer requests made under the CCPA/CPRA, including requests to know, delete, correct, and opt out of the sale or sharing of Personal Information.

15. LIABILITY

15.1. Agreement Limitations Apply. Each Party's liability arising out of or related to this DPA is subject to the limitations of liability set forth in the Agreement, and any reference in the Agreement to the liability of a Party means the aggregate liability of that Party under both the Agreement and this DPA together.

15.2. Own Compliance. Each Party shall be liable for its own compliance with its obligations under Applicable Data Protection Law. Customer, as Controller, shall be responsible for ensuring the lawfulness of its Processing instructions. POM, as Processor, shall be responsible for Processing Personal Data in accordance with Customer's documented instructions and this DPA.

15.3. Regulatory Fines. Nothing in this DPA limits either Party's liability to Data Subjects or Supervisory Authorities under Applicable Data Protection Law. For the avoidance of doubt, regulatory fines, penalties, or sanctions imposed directly on a Party by a Supervisory Authority shall be borne by the Party on which they are imposed.

16. TERM

16.1. Effective Period. This DPA shall become effective on the date Customer first accepts the Agreement (or, if earlier, on the date Customer first submits Personal Data to the Service) and shall remain in effect for the duration of the Agreement.

16.2. Survival. The obligations of POM under this DPA shall survive the termination or expiration of the Agreement to the extent, and for so long as, POM continues to Process Personal Data on behalf of Customer (including during the data return or deletion period described in Section 12).

16.3. Amendments. POM may update this DPA from time to time to reflect changes in Applicable Data Protection Law or POM's Processing practices. POM shall provide Customer with at least thirty (30) days' notice before any material changes take effect. Customer's continued use of the Service after the effective date of any amendment constitutes acceptance of the amended DPA. If Customer does not agree with a material amendment, Customer may terminate the Agreement in accordance with its terms.

ANNEX 1: PROCESSING DETAILS

Element	Description
Subject matter of Processing	Provision of AI agent orchestration services via the POM platform, including routing Customer Data through AI model providers to deliver the Service
Duration of Processing	For the term of the Agreement plus the data return/deletion period specified in Section 12
Nature and purpose of Processing	Receiving Customer prompts and context data; routing data through POM-Managed AI model providers; returning AI model outputs to Customer; maintaining session history, usage metrics, and audit trails; enforcing governance controls (permissions, budgets, security policies)
Types of Personal Data	Names, email addresses, usernames, professional titles and roles, IP addresses, device identifiers, authentication tokens, and any other Personal Data contained in Customer prompts, source code, configuration data, or context submitted to the Service
Categories of Data Subjects	Customer's employees and authorized users; Customer's end users and clients; individuals whose Personal Data appears in Customer Data (e.g., data referenced in source code, prompts, or documents processed through the Service)
Special categories of data	None intentionally Processed. Customer must not submit special categories of Personal Data without POM's prior written consent and the establishment of supplementary safeguards
Frequency of Processing	Continuous, on each use of the Service by Customer
Retention period	Personal Data is retained for the duration of the Agreement. POM-Managed Provider retention periods are detailed on the Sub-processor List at https://askpom.com/legal/sub-processors. Upon termination, data is deleted within 30 days per Section 12

ANNEX 2: TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

POM implements and maintains the following technical and organizational measures to protect Personal Data:

A. Encryption

Encryption in Transit: All data transmitted between Customer and POM, and between POM and Sub-processors, is encrypted using Transport Layer Security (TLS 1.2 or higher).
Encryption at Rest: Where POM stores Personal Data at rest — whether in POM Cloud infrastructure or local storage — such data is encrypted using AES-256 or equivalent encryption standards. For local deployments, POM recommends customers enable full-disk encryption on their devices.
End-to-End Encryption (Relay): Communication between POM Desktop and POM Mobile clients via the POM Relay is end-to-end encrypted. POM infrastructure cannot decrypt relay traffic content.

B. Access Controls and Authentication

Authentication: Authentication tokens are required on every daemon message. No anonymous access is permitted to any daemon functionality.
API Key Management: AI provider API keys and authentication credentials are stored in the operating system keychain or equivalent secure storage, not in plaintext configuration files.
Role-Based Access Control: Enterprise deployments support granular role-based access control (RBAC) for managing permissions across teams and projects.
Mobile Device Pairing: Mobile client pairing uses encrypted key exchange protocols.

C. Agent Permission Controls

Tool-Level Permissions: AI agents must request permission before executing tools. Tool calls are classified by risk level (Low, Medium, High, Critical).
Budget Governance: Per-pilot spending limits with approval queues. Budget exceeded events are propagated to all connected clients.
Human-in-the-Loop: The Service supports configurable human approval workflows for agent actions, enabling Customers to enforce human oversight for high-risk operations.

D. Network Security

Local Communication: In local deployments, internal communication is restricted to the local machine and is not exposed to the network.
Provider Communication: All communication with AI model providers occurs over HTTPS.
Network Isolation: In local deployments, the POM daemon does not listen on public network interfaces. In POM Cloud deployments, customer workloads run in isolated environments with controlled network access and appropriate security controls.

E. Audit and Logging

Session History: All agent sessions are logged, providing a complete audit trail. In local deployments, session history is stored on the customer's device. In POM Cloud deployments, session history is stored within POM's managed infrastructure, encrypted at rest.
Usage Tracking: Token usage and cost tracking per session and per pilot.
Event Logging: Security-relevant events (budget warnings, permission escalations, authentication events) are logged for audit purposes.

F. Incident Response

Incident Response Plan: POM maintains a documented incident response plan covering identification, containment, eradication, recovery, and post-incident review.
Breach Notification: Personal Data Breaches are escalated to Customer within the timeframes specified in Section 8 of this DPA.

G. Personnel Security

Confidentiality Obligations: All POM personnel with access to Personal Data are subject to enforceable confidentiality obligations.
Training: Personnel receive training on data protection responsibilities and secure handling of Personal Data.
Access Limitation: Access to Personal Data is limited to personnel who require it for the performance of their duties.

H. Business Continuity

Data Backup: In local deployments, session data and configuration are stored on the customer's device; customers are responsible for backing up local data. In POM Cloud deployments, POM manages data backup through its cloud infrastructure, including database replication and point-in-time recovery.
Service Resilience: The Service is designed to continue operating when individual AI model providers experience outages, by routing to available alternative providers where possible.

ANNEX 3: SUB-PROCESSOR LIST

The current list of Sub-processors is maintained at https://askpom.com/legal/sub-processors and is also published separately as the POM Sub-processor List.

As of March 11, 2026:

POM-Managed AI Model Providers

Sub-processor	Purpose	Data Processed	Location	Data Retention	No-Training Commitment
Anthropic, PBC	AI model inference	Customer prompts, context, agent outputs	United States	7 days (API logs)	Yes — API/commercial data not used for training
OpenAI, LLC	AI model inference	Customer prompts, context, agent outputs	United States	30 days (API logs)	Yes — API/business data not used for training. Note: OpenAI may process de-identified/anonymized/aggregated data
Google LLC	AI model inference	Customer prompts, context, agent outputs	United States	55 days (abuse monitoring only)	Yes — paid tier only. POM exclusively uses paid API tier

Customer-Configured Providers

Customer-Configured Providers are not Sub-processors of POM. See Section 6.6 of this DPA. POM does not maintain data processing agreements with Customer-Configured Providers and is not responsible for their data handling practices.

Infrastructure Sub-processors

Sub-processor	Purpose	Data Processed	Location	Data Retention	No-Training Commitment
Amazon Web Services, Inc.	Cloud hosting, compute, and storage for POM platform infrastructure	Customer Data processed within POM execution environments	United States	Per AWS data retention policies	N/A — no AI model training
Cloudflare, Inc.	CDN, DDoS protection, and edge networking	Request metadata, IP addresses, cached content	United States / Global edge	Per Cloudflare data retention policies	N/A — no AI model training
Stripe, Inc.	Payment processing, subscription billing, card handling	Payment card data, billing information, transaction records	United States	Per Stripe's data retention policy	N/A — no AI model training

Additional infrastructure Sub-processors may be added to this list and announced with 30 days' advance notice per Section 6.3 before they begin Processing Personal Data.

Customers may subscribe to Sub-processor change notifications at: [email protected]

ANNEX 4: STANDARD CONTRACTUAL CLAUSES

The Parties agree to the EU Standard Contractual Clauses as published in Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (Controller to Processor), which are incorporated by reference into this DPA.

For the purposes of the SCCs:

Clause 7 (Docking clause): The optional docking clause is included.
Clause 9(a) (Sub-processor authorization): OPTION 2 (General written authorization) is selected. The time period for prior notice of Sub-processor changes is thirty (30) days.
Clause 11 (Redress): The optional clause regarding independent dispute resolution is not included.
Clause 13(a) (Supervision): The competent supervisory authority is as described in Section 10.1.2(b) of this DPA.
Clause 17 (Governing law): OPTION 1 is selected. The governing law is as described in Section 10.1.2(b) of this DPA.
Clause 18(b) (Forum): Disputes shall be resolved before the courts as described in Section 10.1.2(b) of this DPA.

Annex I.A (List of Parties):

Data exporter: Customer (Controller), as identified in the Agreement.
Data importer: POM (Processor), as identified in the Agreement.

Annex I.B (Description of transfer): As set forth in Annex 1 of this DPA.

Annex I.C (Competent supervisory authority): As described in Section 10.1.2(b) of this DPA.

Annex II (Technical and organizational measures): As set forth in Annex 2 of this DPA.

Annex III (List of sub-processors): As set forth in Annex 3 of this DPA and the Sub-processor List published at https://askpom.com/legal/sub-processors.

The full text of the SCCs is available at: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj

This Data Processing Agreement was last updated on March 11, 2026. Date].*