Contents
Scope and incorporation
This Data Processing Agreement, or DPA, applies whenever SynchrotronAI Inc. processes personal data on behalf of a business customer under an order, statement of work, marketplace purchase, product subscription, pilot, managed services agreement, the Service Terms, or other contract (the Agreement). It is incorporated into the Agreement automatically, and no separate signature is needed. A customer that needs a countersigned copy can request one through the contact form.
This DPA does not cover personal data that SynchrotronAI processes as an independent controller, such as website visitors, account and billing records, and individual consumer ScamFreeLife subscriptions, which are described in the Privacy Policy.
If a signed agreement includes different data processing terms, those signed terms control for the covered engagement. If there is a conflict between this DPA and an order, the order controls for project-specific processing details, provided the order does not reduce legally required data protection obligations.
Definitions
Customer Personal Data means personal data, personal information, or similar regulated information that SynchrotronAI processes on behalf of a customer under an applicable agreement. Processing means any operation performed on Customer Personal Data, including collection, use, storage, transmission, analysis, hosting, support, deletion, or disclosure.
Customer means the entity that signs an applicable agreement with SynchrotronAI. SynchrotronAI means SynchrotronAI Inc. Applicable Data Protection Laws means privacy, data protection, cybersecurity, breach notification, and similar laws that apply to the processing under the agreement.
Subprocessor means a third-party provider engaged by SynchrotronAI to process Customer Personal Data to provide the contracted services. Security Incident means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by SynchrotronAI.
Roles
For Customer Personal Data processed under customer instructions, the customer is the controller, business, or equivalent decision-making party, and SynchrotronAI is the processor, service provider, contractor, or equivalent service party. If SynchrotronAI independently determines the purposes and means of processing for its own business operations, it acts as an independent controller for that limited processing.
Each party is responsible for complying with laws that apply to its role. Customer is responsible for having a lawful basis, notices, consents, rights processes, data minimization decisions, and authorization to provide Customer Personal Data to SynchrotronAI.
Customer instructions
SynchrotronAI will process Customer Personal Data only to provide the contracted products, services, hosting, support, managed services, security, billing, and related operations; to comply with customer instructions; to comply with applicable law; or as otherwise permitted by the agreement.
Customer instructions are documented in the signed agreement, order, statement of work, support request, product configuration, administrator action, approved integration, and reasonable written instructions consistent with the engagement. SynchrotronAI will promptly inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws, and may suspend the affected processing until the instruction is confirmed or changed. If the law requires SynchrotronAI to process Customer Personal Data other than on Customer's instructions, SynchrotronAI will inform Customer of that legal requirement before processing, unless the law prohibits that notice on important grounds of public interest.
Customer obligations
Customer is responsible for the accuracy, quality, legality, and relevance of Customer Personal Data and for providing notices, obtaining consents, selecting lawful bases, responding to individuals, honoring opt-out signals, and ensuring that Customer's use of SynchrotronAI services complies with Applicable Data Protection Laws.
Customer must not provide sensitive or regulated data unless the applicable agreement authorizes that data and defines appropriate safeguards.
Confidentiality
SynchrotronAI will require personnel who access Customer Personal Data to be bound by confidentiality obligations or comparable professional duties. Access will be limited to personnel and providers who need access for the contracted purpose.
Security measures
SynchrotronAI will maintain administrative, technical, and organizational safeguards designed to protect Customer Personal Data from unauthorized access, destruction, loss, alteration, or disclosure. Measures may include access controls, least-privilege practices, cloud security controls, encryption where appropriate, logging, monitoring, secure development practices, vendor review, incident response, and backup or recovery controls appropriate to the engagement.
Security responsibilities may be shared with the customer depending on the deployment model. Customer remains responsible for customer-managed environments, identity providers, endpoint security, permissions, source data, instructions, administrator actions, and third-party systems not controlled by SynchrotronAI.
Personnel access
SynchrotronAI will limit personnel access to Customer Personal Data to individuals who need access to provide the services, support the engagement, secure systems, comply with law, or perform related business operations. Personnel with access must be subject to confidentiality obligations or comparable professional duties.
Subprocessors
Customer authorizes SynchrotronAI to use subprocessors to provide products, services, hosting, security, payments, CRM, support, cloud infrastructure, development, deployment, monitoring, and operations. The current core subprocessor list is available at Subprocessors.
SynchrotronAI will impose on each subprocessor, by written contract, data protection obligations that provide at least the same level of protection as this DPA, and remains fully liable to Customer for each subprocessor's performance of those obligations.
Subprocessor changes and objections
SynchrotronAI will give at least 15 days' notice before a new subprocessor begins processing Customer Personal Data by updating the Subprocessors page. Customers may ask to receive these notices directly through the contact form. Where a new or replacement subprocessor is needed urgently to restore or maintain the services or to address a security risk, SynchrotronAI may engage it before the notice period ends and will give notice as soon as practicable, and the objection period below runs from that notice. Customer may object on reasonable data protection grounds within 15 days after notice. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected service by written notice and receive a refund of prepaid fees for the unused part of the term of that service, which is Customer's sole remedy for the objection. Marketplace purchases are refunded through the marketplace where the purchase was made.
Assistance
Taking into account the nature of processing and information available to SynchrotronAI, SynchrotronAI will provide reasonable assistance for data subject requests, security assessments, data protection impact assessments, regulatory inquiries, and customer compliance obligations when required by applicable law and the agreement.
SynchrotronAI may charge reasonable fees for assistance that is outside standard support, not caused by SynchrotronAI, or not required by the applicable agreement.
Data subject requests
If SynchrotronAI receives a request directly from an individual about Customer Personal Data, SynchrotronAI may redirect the request to Customer unless legally prohibited. Customer is responsible for responding to individuals when Customer acts as controller, business, or equivalent decision-maker.
Security incidents
SynchrotronAI will notify Customer without undue delay after becoming aware of a Security Incident. The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Where information is not yet available, SynchrotronAI will provide it in phases as it becomes available.
SynchrotronAI will take reasonable steps to contain, investigate, and mitigate the incident and will reasonably cooperate with Customer. Notice of a Security Incident is not an acknowledgment of fault or liability. Unless the law requires otherwise, Customer is responsible for notifying supervisory authorities and data subjects.
Return and deletion
When the Agreement ends, SynchrotronAI will, at Customer's choice, delete or return Customer Personal Data. Customer may export available data through product features or by written request made within 30 days after the end of the Agreement. After that period, SynchrotronAI will delete Customer Personal Data, unless Applicable Data Protection Laws or other law require storage.
Copies in backups and logs will be deleted as they expire under SynchrotronAI's normal retention cycles. Until then, they remain protected under this DPA and will not be actively processed.
International transfers
SynchrotronAI is located in the United States and processes Customer Personal Data in the United States and in the other locations listed on the Subprocessors page. Where Customer Personal Data protected by the GDPR, UK GDPR, or Swiss data protection law is transferred to a country without an adequacy decision, and no other transfer mechanism applies, the parties agree:
- EU transfers: the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 (SCCs) are incorporated by reference, with Module Two (controller to processor) applying where Customer is a controller and Module Three (processor to processor) where Customer is a processor. Clause 7 (docking clause) applies. Under Clause 9, Option 2 (general written authorization) applies with the notice period set out in this DPA. The optional language in Clause 11 does not apply. Under Clauses 17 and 18, the governing law and courts are those of Ireland. Annexes I and II of the SCCs are completed by Annexes A and B of this DPA, and Annex III by the Subprocessors page.
- UK transfers: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (UK Addendum) is incorporated by reference. Its Tables 1 to 3 are completed with the information in this DPA and the SCCs as described above, and either party may end the UK Addendum as permitted by its Section 19.
- Swiss transfers: the SCCs apply with the changes required for the Swiss Federal Act on Data Protection, with the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority for transfers governed by that Act, and references to member states read to include Switzerland so that data subjects there can enforce their rights.
If a transfer mechanism is invalidated or replaced, the parties will cooperate to put an appropriate replacement in place.
Competent authority
The competent supervisory authority for EU transfers is determined under Clause 13 of the SCCs. For UK transfers it is the UK Information Commissioner, and for Swiss transfers it is the Swiss Federal Data Protection and Information Commissioner.
U.S. state privacy commitments
Where SynchrotronAI processes Customer Personal Data as a service provider, contractor, or processor under the CCPA or other U.S. state privacy laws, SynchrotronAI:
- will process Customer Personal Data only for the limited and specified business purposes set out in the Agreement and Annex A;
- will not sell or share Customer Personal Data, as those terms are defined in the CCPA;
- will not retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer, or for any purpose other than the business purposes specified in the Agreement, except as the law permits;
- will not combine Customer Personal Data with personal information it receives from or on behalf of others or collects from its own interactions with consumers, except as the law permits;
- will comply with applicable obligations under the CCPA and provide the same level of privacy protection the CCPA requires of businesses;
- will notify Customer if it determines it can no longer meet its obligations under the CCPA; and
- grants Customer the right, on notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data, and to take reasonable and appropriate steps to ensure that SynchrotronAI uses Customer Personal Data consistently with Customer's obligations.
SynchrotronAI certifies that it understands and will comply with these restrictions.
Audits and information
SynchrotronAI will make available to Customer all information necessary to demonstrate compliance with Article 28 GDPR and will allow for and contribute to audits, including inspections, conducted by Customer or an independent auditor mandated by Customer, as follows:
- SynchrotronAI will first answer reasonable written security and privacy questionnaires and provide available summaries, policies, and third-party reports, which Customer agrees to review before requesting an audit.
- If that information is not reasonably sufficient to demonstrate compliance, or a supervisory authority requires it, Customer may conduct an audit no more than once in any 12-month period (or more often after a Security Incident or where required by a supervisory authority), with at least 30 days' written notice, during business hours, under confidentiality obligations, and in a way that does not compromise the security of the services or the data of other customers.
- Each party bears its own audit costs, unless the audit reveals a material breach of this DPA by SynchrotronAI.
AI processing and model training
SynchrotronAI will not use Customer Personal Data to train, fine-tune, or improve artificial intelligence models, whether its own or a third party's, unless Customer expressly agrees in writing. SynchrotronAI configures the AI service providers listed on the Subprocessors page so that they do not use Customer Personal Data to train their models.
Liability and order of precedence
The liability limits, exclusions, remedies, and dispute terms in the Agreement apply to this DPA unless Applicable Data Protection Laws do not permit them, including as between either party and data subjects. If this DPA conflicts with the Agreement, this DPA controls for the processing of Customer Personal Data. If the SCCs or UK Addendum conflict with this DPA, the SCCs or UK Addendum control.
Annex A: processing details
Subject matter: SynchrotronAI processing of Customer Personal Data to provide products, professional services, managed services, cloud engineering, integrations, automation, hosting, support, security, billing, and related operations.
Duration: The term of the applicable agreement plus any period required for deletion, backup retention, legal compliance, dispute resolution, security, or recordkeeping.
Nature and purpose: collection, organization, storage, hosting, transmission, analysis, transformation, enrichment, retrieval, consultation, support, troubleshooting, deletion, and other processing needed to provide the contracted engagement.
Data subjects: customer employees, contractors, administrators, users, prospects, customers, vendors, business contacts, and other people whose data is provided by Customer or processed through the engagement.
Data categories: contact details, business identifiers, account data, authentication metadata, workflow records, system metadata, documents, support communications, logs, usage data, integration records, trade, customs, supplier, and financial records for Tariff Agent and Capital Agent, and, for ScamFreeLife business plans, phone numbers, caller ID, message and email content and metadata, call transcripts, links, and risk assessments, and other data described in the applicable order.
Frequency of transfer: continuous for the term of the Agreement. Parties: Customer as data exporter and controller (or processor), and SynchrotronAI Inc. as data importer and processor, with the contact details in the Agreement.
Sensitive data: SynchrotronAI does not request sensitive data through public intake. Sensitive or regulated data should be processed only when the signed agreement and architecture specifically authorize it and define appropriate controls.
Annex B: technical and organizational measures
SynchrotronAI's measures may include least-privilege access, authentication controls, access reviews, encryption in transit, encryption at rest where supported by the platform, network and cloud security controls, monitoring, logging, backup practices, secure software development, dependency review, change management, incident response, confidentiality obligations, vendor management, and employee or contractor security expectations.
Specific measures may vary by product, project, cloud provider, customer environment, and written scope. Customer-specific security commitments should be documented in the applicable agreement.
Access control: role-based access where practical, limited administrative access, credential protection, access removal when no longer needed, and separation between customer environments when supported by the architecture.
Application security: code review, dependency review, testing, change tracking, secrets handling, input validation, authorization checks, and deployment review appropriate to the project.
Infrastructure security: provider-native controls, network configuration, logging, monitoring, backups, recovery planning, and configuration management appropriate to the selected cloud model.
Operational security: incident response, vendor review, support procedures, confidentiality expectations, recordkeeping, and customer escalation paths.
Annex C: subprocessors
The current core subprocessor list is published at Subprocessors. The exact provider set may vary by product, project, managed services scope, customer-selected cloud, integration, support model, and deployment architecture.
Contact
Questions about this DPA may be submitted through the contact form.