Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Cogaid Solutions Private Limited ("Processor", "MakersClaw", "we") and the customer using the Service to process personal data of third parties ("Controller", "you"). It applies whenever you use the Service, and in particular the MakersClaw agent and websites or applications you deploy through the Service, to process personal data for which you act as controller under the EU General Data Protection Regulation ("GDPR"), the UK GDPR, or equivalent data protection laws.

1. Definitions

Terms used in this DPA have the meanings given in the GDPR, including "personal data", "processing", "controller", "processor", "data subject", and "supervisory authority". "Customer Personal Data" means personal data that MakersClaw processes on your behalf under the Terms of Service.

2. Roles and scope

You are the Controller of the Customer Personal Data. MakersClaw is the Processor. MakersClaw will process Customer Personal Data only:

• on your documented instructions;
• for the purpose of providing the Service as described in the Terms of Service;
• for the duration of your use of the Service; and
• in accordance with applicable data protection law, including the GDPR and the UK GDPR.

MakersClaw will notify you if, in its opinion, an instruction infringes applicable data protection law.

3. Nature of processing

Subject matter: operation of the MakersClaw agent workspace, including agent sessions, automations, and websites and applications deployed through the Service.

Duration: for as long as you use the Service, plus any retention periods required by law.

Nature and purpose of processing: hosting, transmitting, routing, storing, and displaying Customer Personal Data; forwarding messages and content to upstream AI model providers to generate responses; delivering responses back to you and, where applicable, to end users of connected services or deployed applications; maintaining audit logs.

Categories of data subjects: your customers, end users, employees, or other individuals who interact with the workspace, agent, or applications you operate.

Categories of personal data: identifiers (username, handle, email where provided), message content, file attachments, channel metadata, and any other data you choose to submit to the Service.

4. Confidentiality

MakersClaw ensures that personnel authorized to process Customer Personal Data are bound by written confidentiality obligations and have received appropriate training on their obligations.

5. Security

MakersClaw implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including: encryption of data in transit (TLS) and at rest for databases and storage; access controls and least-privilege administration; isolated per-workspace execution sandboxes; regular backups; logging and monitoring; incident response procedures; and vendor security reviews. Details of our security posture are summarized in the Privacy Policy and available on request.

6. Subprocessors

6.1 General authorization. You authorize MakersClaw to engage the subprocessors on the list in section 5 of the Privacy Policy (the "Subprocessor List"), for the purposes and in the locations shown there. The Subprocessor List is also Annex III. An entry that the list marks as acting for itself or for you is not a subprocessor of MakersClaw under this DPA.

6.2 Written agreements. MakersClaw enters into written agreements with each subprocessor that impose data-protection obligations substantially equivalent to those in this DPA. MakersClaw remains responsible to you for each subprocessor's performance.

6.3 Notice of changes. We will give you reasonable prior notice before we add a subprocessor or replace one.

6.4 How we notify. We notify the owner of each workspace by email at the address on the account, or by a notice in the Service. On the same day we update the Subprocessor List and the "Last updated" date of the Privacy Policy. You may ask us at hello@makersclaw.com to send notices to another address.

6.5 Objection. You may object, in writing and on reasonable data-protection grounds, before the change takes effect. We will talk with you in good faith about a way to avoid the problem, such as not using the affected feature. If we cannot agree, you may terminate the affected Service before the change takes effect and receive a pro-rata refund for any prepaid, unused portion. If you do not object in time, the change takes effect.

6.6 Urgent changes. If we must replace a subprocessor at once to protect the Service or Customer Personal Data (for example, it stops operating or has a security incident), we will tell you as soon as we can. Section 6.5 applies from the date of that notice.

6.7 SCCs. For Clause 9(a) of the SCCs, Option 2 (general written authorisation) applies, with the notice period in section 6.3.

7. Data subject requests

Taking into account the nature of the processing, MakersClaw will assist you by appropriate technical and organizational measures, insofar as possible, to respond to requests from data subjects exercising their rights under the GDPR (including access, rectification, erasure, restriction, objection, and portability). If a data subject contacts MakersClaw directly regarding personal data that you control, we will forward the request to you and cooperate reasonably.

8. Personal data breach notification

MakersClaw will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects. You remain responsible for any notifications to supervisory authorities and affected data subjects that are required of you as Controller.

9. Data protection impact assessments

MakersClaw will provide reasonable assistance, at your cost, in connection with data protection impact assessments and prior consultations with supervisory authorities that you are required to carry out under Articles 35 and 36 of the GDPR, taking into account the nature of the processing and information available to MakersClaw.

10. International data transfers

10.1 Where data is processed. Customer Personal Data is processed primarily in the United States: in Amazon Web Services us-east-1 (N. Virginia), through Supabase and Vercel, and in Neon databases in the United States. MakersClaw operates from India. A few subprocessors process data elsewhere; Annex III gives the location of each.

10.2 Safeguards. Where Customer Personal Data is transferred from the EEA, the United Kingdom, or Switzerland to a country without an adequacy decision, the transfer is carried out under the European Commission's Standard Contractual Clauses (SCCs) of 4 June 2021:

• Module Two (controller to processor) between you and MakersClaw; and
• Module Three (processor to processor), or an equivalent safeguard, between MakersClaw and each subprocessor outside those regions. If you are yourself a processor for your own customer, Module Three applies between you and MakersClaw.

The UK International Data Transfer Addendum applies to transfers from the United Kingdom, and the Swiss amendments in Annex I.D apply to transfers from Switzerland. By entering into this DPA, you and MakersClaw are deemed to have entered into the SCCs and the UK Addendum, completed by Annexes I to III.

10.3 Options chosen. Clause 7 (docking clause): does not apply. Clause 9(a): Option 2, general written authorisation, with the notice period in section 6.3. Clause 11(a), optional wording: does not apply. Clause 17: Option 1, the law of the Republic of Ireland. Clause 18(b): the courts of the Republic of Ireland. Clause 13: see Annex I.C. Mandatory law prevails where it provides otherwise.

11. Deletion or return of data

Customer Personal Data is deleted on termination as follows:

• User-initiated termination: when you delete a workspace or your account, all associated Customer Personal Data is deleted immediately. No grace period applies.
• Payment failure: on payment failure or an empty credit balance, paid features are suspended but Customer Personal Data is retained until you delete the workspace or your account is closed.
• Return of data: on written request received before termination takes effect, MakersClaw will provide a machine-readable export of Customer Personal Data in a commonly used format prior to deletion.

Standard backup rotation will overwrite Customer Personal Data according to our normal backup cycle after deletion. Records that MakersClaw is required by law to retain (for example, billing records under tax law) are retained only for the statutory period and used solely for those legal purposes.

12. Audits

On your reasonable written request, and no more than once every twelve months (or more frequently if required by a supervisory authority or in the event of a material breach), MakersClaw will make available information necessary to demonstrate compliance with this DPA, including third-party certifications, penetration test summaries, and responses to reasonable security questionnaires. Audits beyond that require mutual agreement on scope, timing, and cost.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

14. Order of precedence

In the event of a conflict between this DPA and the Terms of Service, this DPA prevails with respect to the processing of Customer Personal Data. In the event of a conflict between this DPA and the SCCs, the SCCs prevail.

15. Contact

Data protection questions, requests, and breach notifications should be sent to hello@makersclaw.com. EU/EEA data subjects and supervisory authorities may also contact our EU Representative, listed in the Privacy Policy.

Annex I: Parties and description of the transfer

The Annexes complete the SCCs and the UK Addendum referred to in section 10.

I.A Parties

Data exporter: you. Name, address, and contact: as in your account and billing details. Role: controller (Module Two) or, if you act as a processor for your own customer, processor (Module Three). Activity relevant to the transfer: your use of the Service. Signature and date: deemed given when you accept the Terms of Service (section 8a) and this DPA.

Data importer: Cogaid Solutions Private Limited, 8/1/1 Hardutt Rai Chamaria Road, Howrah, West Bengal 711101, India. Contact: hello@makersclaw.com. EU representative: Shreyans Kumar Bhansali, Liselotte Herrmann Strasse 38, 10407 Berlin, Germany, bhansali@cogaid.tech (see section 1.1 of the Privacy Policy). Role: processor. Activity relevant to the transfer: providing the Service. Signature and date: deemed given when MakersClaw makes this DPA available and you accept it.

I.B Description of the transfer

• Data subjects: your customers, end users, employees, or other individuals who interact with the workspace, agent, or applications you operate.
• Personal data: identifiers (username, handle, email where provided), message content, file attachments, channel metadata, and any other data you choose to submit to the Service.
• Sensitive data: none is intended. The Service does not require special categories of personal data (Article 9 GDPR) or data about criminal convictions. If you choose to submit any, you decide that and are responsible for having a legal basis for it. The measures in Annex II apply to it as to all other Customer Personal Data.
• Frequency: continuous.
• Nature and purpose: hosting, transmitting, routing, storing, and displaying Customer Personal Data; forwarding messages and content to AI model providers to generate responses; delivering responses; keeping audit logs.
• Retention: as set out in section 11. Customer Personal Data is deleted immediately when you delete a workspace or your account; backups are overwritten on our normal rotation; records that the law requires us to keep are kept for the statutory period.
• Transfers to subprocessors: the subject matter, nature, and duration are those above. Annex III gives the location and role of each subprocessor.

I.C Competent supervisory authority (Clause 13)

The supervisory authority of the Member State where you, as exporter, are established. If you are not established in the European Union but are subject to the GDPR under Article 3(2) and have appointed a representative, the supervisory authority of the Member State where that representative is established. For MakersClaw's own role, the representative named in the Privacy Policy is in Berlin, so the competent authority is the Berlin data-protection authority (the Berliner Beauftragte für Datenschutz und Informationsfreiheit).

I.D Swiss and UK terms

Switzerland. For transfers subject to the Swiss Federal Act on Data Protection (FADP): the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; "Member State" in the SCCs includes Switzerland, so data subjects in Switzerland may bring claims in Switzerland; and references to the GDPR read as references to the FADP.

United Kingdom. The UK Addendum is completed as follows. Table 1 (parties): as in Annex I.A. Table 2 (selected SCCs and modules): as in section 10. Table 3 (appendix information): Annexes I to III. Table 4 (ending the Addendum when the Approved Addendum changes): neither party.

Annex II: Technical and organizational measures

MakersClaw applies these measures to Customer Personal Data. They are the measures described in section 5 of this DPA and in the Privacy Policy, listed in one place.

• Encryption of data in transit (TLS).
• Encryption at rest for databases and storage.
• Access controls and least-privilege administration; role-based access controls; row-level security policies.
• Isolated per-workspace execution sandboxes.
• Regular backups.
• Logging, monitoring, and access logging.
• Incident response procedures, including notice of a personal data breach to you within 48 hours (section 8).
• Vendor security reviews.
• Personnel who are authorized to process Customer Personal Data are bound by written confidentiality obligations and trained (section 4).
• Deletion and return of data (section 11).

For transfers to subprocessors, the measures each subprocessor applies are described in that subprocessor's own published security documents and data-processing terms.

Annex III: Subprocessors

The subprocessors are those on the list in section 5 of the Privacy Policy, as it stands from time to time. For each, that list gives its name, what it does for us and what data it sees, its location, and whether it acts on our instructions or for itself or for you. The date of the latest change is the "Last updated" date of the Privacy Policy. This list is the agreed list for Clause 9(a) of the SCCs.

Transfer mechanism: MakersClaw's agreement with each subprocessor that is outside the EEA, the United Kingdom, and Switzerland carries Module Three of the SCCs or an equivalent safeguard, as set out in section 10.2.