Data Processing Agreement

Definitions

In this DPA, the following terms have the meanings set out below:

• "Applicable Data Protection Law" means all privacy and data protection laws applicable to the processing of Personal Data under this DPA, including the GDPR, CCPA, LGPD, and any successor or implementing legislation.
• "Controller" means the entity that determines the purposes and means of processing Personal Data. Under this DPA, you (the SimSense user) are the Controller.
• "Processor" means the entity that processes Personal Data on behalf of the Controller. Under this DPA, SimSense is the Processor.
• "Personal Data" means any information relating to an identified or identifiable natural person, as defined under Applicable Data Protection Law.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, transmission, or deletion.
• "Data Subject" means an identified or identifiable natural person to whom Personal Data relates.
• "Sub-Processor" means any third party engaged by SimSense to process Personal Data on behalf of the Controller.
• "Security Incident" means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
• "Standard Contractual Clauses" or "SCCs" means the standard data protection clauses adopted by the European Commission for the transfer of Personal Data to third countries.
• "Services" means the SimSense ambient display connector and associated platform made available to you under the Terms of Service.

Scope & Role of Parties

This DPA applies to all Personal Data processed by SimSense in connection with providing the Services to you. SimSense processes Personal Data solely:

• On your documented instructions as Controller;
• As necessary to perform the Services under the Terms of Service;
• As required by Applicable Data Protection Law (in which case SimSense will inform you, unless prohibited by law).

SimSense will not process Personal Data for its own purposes, sell Personal Data, or use Personal Data to build profiles about Data Subjects beyond what is strictly necessary to deliver the Services.

Processor Obligations

SimSense, as Data Processor, agrees to:

• Process Personal Data only on your documented instructions and not for any other purpose;
• Ensure that persons authorized to process Personal Data are bound by appropriate confidentiality obligations;
• Implement and maintain appropriate technical and organizational security measures as described in Section 7;
• Respect the conditions for engaging Sub-Processors as described in Section 5;
• Assist you in fulfilling your obligations to respond to Data Subject rights requests as described in Section 6;
• Assist you in ensuring compliance with security, breach notification, data protection impact assessment, and prior consultation obligations under Applicable Data Protection Law;
• Delete or return all Personal Data upon termination of Services, as described in Section 10;
• Provide all information reasonably necessary to demonstrate compliance with this DPA and cooperate with audits as described in Section 11;
• Promptly notify you if, in SimSense's opinion, an instruction infringes Applicable Data Protection Law.

Controller Obligations

You, as Data Controller, represent and agree that:

• You have a lawful basis for processing Personal Data through the Services under Applicable Data Protection Law;
• You have provided all required notices to and obtained all necessary consents from Data Subjects for the processing activities contemplated by this DPA;
• Your instructions to SimSense will comply with Applicable Data Protection Law;
• You are solely responsible for the accuracy, quality, and legality of the Personal Data you input into or transmit through the Services;
• You will not instruct SimSense to process Personal Data in a manner that would violate Applicable Data Protection Law or this DPA.

Sub-Processors

You provide general authorization for SimSense to engage Sub-Processors to assist in delivering the Services. SimSense will:

• Maintain an up-to-date list of approved Sub-Processors (see Schedule B);
• Notify you at least 30 days in advance before adding or replacing a Sub-Processor that processes Personal Data;
• Impose data protection obligations on Sub-Processors equivalent to those in this DPA;
• Remain liable to you for the acts and omissions of its Sub-Processors to the same extent as if SimSense had performed the processing directly.

If you object to a new Sub-Processor on reasonable data protection grounds, you may notify SimSense within 14 days of the change notice. If the parties cannot resolve the objection, you may terminate the Services on 30 days' written notice.

Data Subject Rights

If SimSense receives a request from a Data Subject seeking to exercise rights under Applicable Data Protection Law, SimSense will:

• Promptly notify you of the request;
• Not respond directly to the Data Subject (except to confirm receipt and direct them to you), unless you instruct otherwise or SimSense is required to do so by law;
• Provide reasonable assistance to help you fulfill the request within applicable timeframes.

You are responsible for responding to Data Subject requests for Personal Data that you control. SimSense will provide the technical means to assist where the relevant Personal Data is within SimSense's systems.

Note regarding Anthropic: Anthropic independently handles data subject requests relating to Claude. Please direct Claude-related data requests to privacy@anthropic.com.

Security Measures

SimSense shall implement and maintain appropriate technical and organizational security measures to protect Personal Data against Security Incidents. These measures include, at minimum:

• Encryption in transit: All Personal Data transmitted between users, devices, and SimSense servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: Personal Data stored in SimSense databases is encrypted at rest.
• Access controls: Access to Personal Data is restricted to authorized personnel on a least-privilege basis.
• Authentication: Multi-factor authentication is required for access to production systems containing Personal Data.
• Vulnerability management: SimSense maintains a process for receiving, assessing, and remediating security vulnerability reports.
• Logging and monitoring: Access to Personal Data in production systems is logged and monitored for anomalous activity.
• Personnel training: SimSense personnel with access to Personal Data receive regular data protection training.

Data Breach Notification

In the event SimSense becomes aware of a Security Incident involving Personal Data processed under this DPA, SimSense will:

• Notify you without undue delay, and in any event within 72 hours of becoming aware of the Security Incident (consistent with GDPR Article 33 timelines);
• Provide, to the extent then known: a description of the nature of the incident; the categories and approximate number of Data Subjects and records affected; likely consequences; and measures taken or proposed to address the incident;
• Cooperate with you and take reasonable steps to mitigate the effects of the Security Incident;
• Not make any public disclosure about the Security Incident relating to your Personal Data without your prior written consent, except as required by law.

Notification to you does not constitute an acknowledgment by SimSense of fault or liability in connection with the Security Incident.

International Data Transfers

SimSense's primary infrastructure is located in the United States. If you are based in the EEA, United Kingdom, or Switzerland, any transfer of Personal Data from those regions to SimSense's US-based infrastructure will be made pursuant to:

• The European Commission's Standard Contractual Clauses (Module 2: Controller to Processor), which are hereby incorporated by reference into this DPA; or
• Any other adequate transfer mechanism recognized under Applicable Data Protection Law.

By entering into this DPA, you and SimSense agree to be bound by the applicable SCCs for any such transfers. In the event of any conflict between this DPA and the SCCs, the SCCs shall prevail.

Retention & Deletion

SimSense retains Personal Data only for as long as necessary to perform the Services or as required by Applicable Data Protection Law.

• Push history: Retained for 90 days, then automatically deleted.
• Account and screen configuration data: Retained until your account is closed or you delete individual screens.
• Server logs: Retained for up to 90 days for security and debugging, then deleted.
• Backup data: Permanently deleted within 30 days of the primary data deletion.

Upon termination of Services, SimSense will delete or return all Personal Data within 30 days, and certify in writing that deletion has occurred, unless Applicable Data Protection Law requires further retention.

Audit Rights

SimSense will make available to you, upon reasonable request, all information necessary to demonstrate compliance with this DPA. SimSense may satisfy this obligation by providing:

• Responses to security questionnaires or compliance assessments;
• Third-party audit reports or certifications (e.g., SOC 2, ISO 27001) if and when obtained; or
• Access to relevant policies, procedures, and documentation.

You may request an on-site or remote audit no more than once per year, with at least 30 days' written notice, at your expense.

Liability

Each party's liability under this DPA is subject to the limitations set out in the SimSense Terms of Service.

As between the parties, you are responsible for your compliance with Applicable Data Protection Law in your capacity as Controller. SimSense is responsible for its compliance with this DPA in its capacity as Processor.

If a Data Subject or regulatory authority brings a claim against SimSense for processing Personal Data in violation of this DPA due to your instructions, you will indemnify and hold SimSense harmless from any resulting damages, costs, and penalties.

Term & Termination

This DPA is effective from the date you accept the SimSense Terms of Service and remains in effect for the duration of the Terms of Service.

This DPA automatically terminates upon termination of the Terms of Service. The obligations in Sections 3, 6, 7, 8, 10, 11, and 12 survive termination.

Any amendment to this DPA requires written agreement between the parties. SimSense may update this DPA to reflect changes in Applicable Data Protection Law by providing 30 days' advance notice.

Processing Details

This Schedule describes the processing of Personal Data by SimSense under this DPA.

Approved Sub-Processors

The following Sub-Processors are currently authorized to process Personal Data in connection with the SimSense Services.

By using the SimSense Services, you agree to this Data Processing Agreement. For enterprise customers requiring a separately executed DPA, please contact legal@simsense.ai.