Data Processing Addendum
This Data Processing Addendum (this “DPA”), including the Standard Contractual Clauses referenced herein, is entered into by and between Wind Stream, Inc. (“Wind Stream”) and the customer that has executed a Wind Stream Software Subscription Agreement or other written subscription agreement with Wind Stream (the “MSA”) that incorporates this DPA by reference (“Customer”). This DPA supplements and is incorporated into the MSA and applies to Wind Stream’s processing of Customer Personal Data in connection with the Services provided under the MSA. Capitalized terms used in this DPA and not defined herein have the meanings set forth in the MSA.
1. DEFINITIONS
1.1 “Applicable Data Protection Laws” means all data protection and privacy laws applicable to a Party’s processing of Personal Data under this DPA, including, as applicable:
(a) the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”); (b) the United Kingdom Data Protection Act 2018 and the UK GDPR (“UK GDPR”); (c) the Swiss Federal Act on Data Protection (as revised); (d) the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”); and (e) any other applicable state, federal, or foreign privacy or data protection law.
1.2 “Customer Personal Data” means Personal Data contained in Customer Materials (as defined in the MSA) that Wind Stream processes on Customer’s behalf in the course of providing the Services under the MSA.
1.3 “Data Subject Request” means a request from a data subject (or authorized representative) to exercise any of the rights granted by Applicable Data Protection Laws with respect to their Personal Data.
1.4 “EU SCCs” means the standard contractual clauses approved by the European Commission in Commission Decision 2021/914 dated 4 June 2021, as updated or replaced from time to time.
1.5 “Personal Data” has the meaning given in Applicable Data Protection Laws (or “Personal Information” under the CCPA and equivalent laws).
1.6 “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Customer Personal Data.
1.7 “Sub-processor” means any third party engaged by Wind Stream to process Customer Personal Data on Wind Stream’s behalf in connection with the Services.
1.8 “Sub-processor List” means the list of Sub-processors published at windstream.ai/subprocessors.
1.9 “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, as updated or replaced from time to time.
1.10 The terms “controller,” “processor,” “data subject,” and “processing” (and cognate terms) have the meanings given in the GDPR; and the terms “business,” “service provider,” “consumer,” and “sale” have the meanings given in the CCPA.
2. ROLES OF THE PARTIES
2.1 Processing on Customer’s behalf. With respect to Customer Personal Data, Customer is the controller (or “business,” where applicable) and Wind Stream is the processor (or “service provider,” where applicable). Customer represents and warrants that (a) it has complied and will comply with Applicable Data Protection Laws; (b) it has all necessary legal bases, permissions, and authorizations to make Customer Personal Data available to Wind Stream for processing under the MSA and this DPA; (c) Customer’s instructions to Wind Stream comply with Applicable Data Protection Laws; and (d) Wind Stream’s processing of Customer Personal Data in accordance with the MSA and this DPA will not violate Applicable Data Protection Laws or cause a breach of any agreement or obligations between Customer and any third party.
2.2 Wind Stream controller-role processing. Notwithstanding Section 2.1, Wind Stream acts as an independent controller (not a joint controller with Customer) with respect to (a) Wind Stream Account Data (data used to manage Wind Stream’s commercial relationship with Customer, such as billing and administrative contact information); (b) Wind Stream Usage Data (aggregate technical telemetry used to operate, secure, and improve the Services); and (c) Aggregate Data (as defined in the MSA). Wind Stream’s processing of the foregoing is governed by the Wind Stream Privacy Notice, not by this DPA.
3. PROCESSING OF CUSTOMER PERSONAL DATA
3.1 Scope and purpose. Wind Stream will process Customer Personal Data only (a) to provide the Services in accordance with the MSA; (b) as further documented in Customer’s use of the Services (which constitutes Customer’s instructions); (c) to comply with other reasonable documented instructions from Customer that are consistent with the MSA; and (d) as required by applicable law, in which case Wind Stream will (unless prohibited) inform Customer of the legal requirement before processing.
3.2 Details of processing. The subject matter, nature, purpose, duration, and categories of Customer Personal Data and data subjects are set forth in Exhibit A (Details of Processing).
3.3 Confidentiality. Wind Stream will ensure that Wind Stream personnel authorized to process Customer Personal Data are bound by written confidentiality obligations.
3.4 No training on Customer Personal Data. Wind Stream will not use Customer Personal Data (or any Customer Materials in which it is contained) to train foundation models, and will not use Customer Personal Data to train or fine-tune any Wind Stream-owned model, in each case without Customer’s express, opt-in written agreement pursuant to a separate arrangement. Under Wind Stream’s agreements with Sub-processors that provide AI model services, those Sub-processors do not use Customer Personal Data transmitted to them in connection with the Services to train or improve their models.
3.5 California-specific terms. To the extent that Wind Stream’s processing of Customer Personal Data is subject to the CCPA, this Section 3.5 also applies. Customer discloses or otherwise makes available Customer Personal Data to Wind Stream for the limited and specific purpose of enabling Wind Stream to provide the Services to Customer in accordance with the MSA and this DPA. Wind Stream will (a) comply with its applicable obligations under the CCPA; (b) provide the same level of protection as required under the CCPA; (c) notify Customer if it can no longer meet its obligations under the CCPA; (d) not “sell” or “share” (as such terms are defined by the CCPA) Customer Personal Data; (e) not retain, use, or disclose Customer Personal Data for any purpose (including any commercial purpose) other than to provide the Services under the MSA or as otherwise permitted under the CCPA; (f) not retain, use, or disclose Customer Personal Data outside of the direct business relationship between Customer and Wind Stream; and (g) unless otherwise permitted by the CCPA, not combine Customer Personal Data with Personal Data that Wind Stream (i) receives from, or on behalf of, another person, or (ii) collects from its own, independent consumer interaction. Wind Stream will permit Customer, upon reasonable request, to take reasonable and appropriate steps to ensure that Wind Stream processes Customer Personal Data that is subject to this Section 3.5 in a manner consistent with the obligations of a “business” under the CCPA by requesting that Wind Stream attest to its compliance with this Section 3.5. Following any such request, Wind Stream will promptly provide that attestation or an explanation of why it cannot provide it. If Customer reasonably believes that Wind Stream is engaged in unauthorized processing of Customer Personal Data that is subject to this Section 3.5, Customer will notify Wind Stream of such belief, and the parties will work together in good faith to remediate the allegedly violative processing activities, if necessary.
3.6 Service optimization and security. Where permitted by Applicable Data Protection Laws, Wind Stream may process Customer Personal Data (a) for its internal uses to build or
improve the quality of the Services; (b) to prevent, detect, or investigate Personal Data Breaches or other security incidents; or (c) to protect against malicious, deceptive, fraudulent, or illegal activity.
4. SUB-PROCESSORS
4.1 General authorization. Customer provides Wind Stream with general written authorization to engage Sub-processors to process Customer Personal Data as necessary to provide the Services. The Sub-processors currently engaged by Wind Stream are listed on the Sub-processor List at windstream.ai/subprocessors.
4.2 Notice of changes. Wind Stream will provide Customer with at least ten (10) days’ prior notice before engaging any new Sub-processor to process Customer Personal Data. Notice will be provided by updating the Sub-processor List and, where Customer has subscribed to sub-processor change notifications, by email to Customer’s designated contact.
4.3 Objection. If Customer reasonably objects to Wind Stream’s engagement of a new Sub- processor within ten (10) days after notice, the parties will work together in good faith to resolve the grounds for the objection. If the parties are unable to resolve the objection within a reasonable period, Customer’s sole and exclusive remedy is to terminate the affected portion of the MSA (or, if the objected-to Sub-processor is essential to the Services, the MSA in its entirety), effective upon written notice to Wind Stream. Termination under this Section 4.3 does not entitle Customer to any refund of pre-paid fees for the period prior to the effective date of termination.
4.4 Sub-processor obligations. Wind Stream will enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those imposed on Wind Stream under this DPA with respect to the protection of Customer Personal Data. Wind Stream remains liable to Customer for the acts and omissions of its Sub-processors to the same extent as Wind Stream would be liable if performing the services of each Sub-processor directly under this DPA.
4.5 Sub-sub-processors. Sub-processors engaged by Wind Stream may in turn engage their own sub-processors (“sub-sub-processors”). Sub-sub-processors are governed by the applicable Sub-processor’s own agreements and are disclosed via that Sub-processor’s public documentation. Wind Stream’s obligations under this DPA extend only to its direct Sub- processors.
5. SECURITY
5.1 Technical and organizational measures. Wind Stream will implement and maintain the technical and organizational measures described in Exhibit C (Technical and Organizational Measures) designed to protect Customer Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure, in each case appropriate to the nature and sensitivity of Customer Personal Data and the state of the art. Wind Stream may update the specific measures set forth in Exhibit C from time to time, provided that any such update will not materially reduce the overall level of protection.
5.2 Access controls. Wind Stream restricts access to Customer Personal Data to Wind Stream personnel who require such access to perform their duties in connection with the Services, subject to appropriate access controls and authentication mechanisms.
6. PERSONAL DATA BREACH NOTIFICATION
6.1 Notification. Upon becoming aware of a confirmed Personal Data Breach, Wind Stream will notify Customer without undue delay and within the time frame required under applicable Data Protection Laws. Notification will be delivered to Customer’s designated security or legal notices contact set forth in the applicable Order Form, or, if none is designated, to the primary contact on file.
6.2 Content of notification. To the extent known at the time of notification (with additional information provided as it becomes available), Wind Stream’s notification will include: (a) the nature of the Personal Data Breach, including the categories and approximate number of data subjects and records affected; (b) the likely consequences of the Personal Data Breach;
(c) the measures Wind Stream has taken or proposes to take to address the Personal Data Breach and, where appropriate, to mitigate its adverse effects; and (d) contact information for Wind Stream’s designated security representative.
6.3 Cooperation. Wind Stream will provide Customer with reasonable cooperation and assistance necessary for Customer to comply with its obligations to notify supervisory authorities and affected data subjects under Applicable Data Protection Laws.
6.4 No admission. Wind Stream’s notification of, or response to, a Personal Data Breach under this Section 6 is not an acknowledgment by Wind Stream of any fault or liability with respect to the Personal Data Breach.
7. DATA SUBJECT REQUESTS
7.1 Referral. If Wind Stream receives a Data Subject Request relating to Customer Personal Data, Wind Stream will, to the extent legally permitted, refer the data subject to Customer and will not respond to the request substantively except on Customer’s documented instructions or as required by applicable law.
7.2 Assistance. Taking into account the nature of the processing, Wind Stream will provide Customer with reasonable assistance — through appropriate technical and organizational measures and, insofar as possible, through the functionality of the Services — to enable customer to respond to Data Subject Requests. Customer is responsible for costs of assistance beyond that which is reasonably included in the Services.
7.4 Data protection assessments. Wind Stream will provide reasonable assistance and information to Customer as required by Applicable Data Protection Laws where, in Customer’s reasonable judgment, the type of processing performed by Wind Stream requires a data protection assessment, data protection impact assessment, or prior consultation with the relevant data protection authorities. Customer will reimburse Wind Stream for all non- negligible costs Wind Stream incurs in performing its obligations under this Section 7.4.
7.3 Requests to Wind Stream as controller. For Personal Data that Wind Stream processes as a controller (see Section 2.2), Wind Stream handles Data Subject Requests directly in accordance with the Wind Stream Privacy Notice.
8. INTERNATIONAL DATA TRANSFERS
8.1 U.S.-based processing. Wind Stream primarily processes Customer Personal Data in the United States. To the extent Customer Personal Data is transferred from a jurisdiction outside the United States, this Section 8 governs the transfer.
8.2 EU/EEA transfers. For transfers of Customer Personal Data from the European Economic Area to Wind Stream in the United States (or to any other jurisdiction not deemed adequate by the European Commission), the EU SCCs are incorporated into this DPA by reference and are deemed executed by the Parties as of the effective date of the MSA, with the following selections:
● Module Two (Controller-to-Processor) applies where Customer is a controller and Wind Stream is a processor;
● Module Three (Processor-to-Processor) applies where Customer is itself a processor and Wind Stream is a further processor acting on Customer’s behalf;
● In Clause 7 (Docking Clause), the optional docking clause is included;
● In Clause 9(a) (Sub-processors), Option 2 (general written authorization) is selected, with the notice period set forth in Section 4.2 of this DPA;
● In Clause 11(a) (Redress), the optional independent-dispute-resolution language is not included;
● In Clause 17 (Governing Law), the EU SCCs are governed by the law of Ireland;
● In Clause 18(b) (Choice of Forum and Jurisdiction), disputes will be resolved before the courts of Ireland;
● Annex I (Parties, Description of Transfer, Competent Supervisory Authority) is populated as set forth in Exhibit A to this DPA;
● Annex II (Technical and Organizational Measures) is populated as set forth in Exhibit C to this DPA;
● Annex III (Sub-processors) is populated by reference to the Sub-processor List.
8.3 UK transfers. For transfers of Customer Personal Data subject to the UK GDPR, the EU SCCs as modified by the UK Addendum are incorporated into this DPA by reference and are deemed executed by the Parties.
8.4 Swiss transfers. For transfers of Customer Personal Data subject to the Swiss Federal Act on Data Protection, the EU SCCs apply with the following modifications: references to the “GDPR” are read as references to the Swiss Federal Act on Data Protection; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; and the term “EU Member State” is not interpreted to exclude data subjects in Switzerland from exercising their rights in Switzerland.
8.5 Supplementary measures. Wind Stream implements supplementary measures designed to protect Customer Personal Data in the event of Government Access Requests (as defined below), as follows:
(a) Wind Stream will, to the extent legally permitted, notify Customer of any legally binding request received from a public authority for Customer Personal Data (“Government Access Request”), including requests for access, disclosure, or interception.
(b) If Wind Stream is prohibited from notifying Customer, Wind Stream will use commercially reasonable efforts to obtain a waiver of such prohibition where legally permissible.
(c) Wind Stream will not voluntarily disclose Customer Personal Data to any public authority absent a valid and binding legal requirement.
(d) Wind Stream will document Government Access Requests received and make such documentation available to Customer on request, subject to applicable law.
8.6 Clarifying terms for Standard Contractual Clauses. Where Standard Contractual Clauses are incorporated into this DPA, the parties agree that: (a) Customer will reimburse Wind Stream for all costs and expenses incurred by Wind Stream in connection with the performance of Wind Stream’s obligations under Clause 15.1(b) and Clause 15.2 of the EU SCCs, without regard to any limitation of liability set forth in the MSA; (b) the termination right contemplated by Clause 14(f) and Clause 16(c) of the EU SCCs will be limited to termination of the Standard Contractual Clauses and will not extend to the MSA or this DPA;
(c) unless otherwise agreed, Customer will be responsible for communicating with data
subjects pursuant to Clause 15.1(a) of the EU SCCs; and (d) the certification of deletion required by Clause 8.5 and Clause 16(d) of the EU SCCs will be provided upon Customer’s written request.
9. AUDITS
9.1 Audit reports. Wind Stream will make available to Customer, on written request no more than once per calendar year and subject to reasonable confidentiality controls, copies of Wind Stream’s then-current independent third-party audit reports (such as SOC 2 reports) or comparable certifications, as evidence of Wind Stream’s compliance with its obligations under this DPA.
9.2 On-site audits. Where the audit reports made available under Section 9.1 are insufficient to demonstrate compliance with Applicable Data Protection Laws, Customer may, on at least thirty (30) days’ prior written notice and no more than once per calendar year, request a written security assessment of Wind Stream’s policies, procedures, and records relevant to the processing of Customer Personal Data. Any such audit will (a) be conducted during Wind Stream’s regular business hours; (b) be subject to reasonable confidentiality obligations and coordination with Wind Stream to minimize disruption to Wind Stream’s business; (c) be restricted to information relevant to Customer’s use of the Services; and (d) be conducted at Customer’s sole cost and expense, including reimbursement of Wind Stream’s reasonable time and expense.
9.3 Standard Contractual Clauses. Where Standard Contractual Clauses apply, audits required under Clause 8.9 of the EU SCCs will be conducted in accordance with this Section 9.
10. RETURN AND DELETION OF CUSTOMER PERSONAL DATA
10.1 Return and deletion. Upon expiration or termination of the MSA, Wind Stream will make Customer Personal Data available for export by Customer during the Data Return Period set forth in the MSA, and will thereafter delete Customer Personal Data from Wind Stream’s production environment in accordance with the timelines set forth in Section 10(d) of the MSA, subject to (a) retention required by applicable law; and (b) retention of Customer Personal Data in encrypted backups until such backups are overwritten in the ordinary course of Wind Stream’s backup rotation.
10.2 Certification. Upon Customer’s written request, Wind Stream will certify in writing to Customer that Customer Personal Data has been deleted in accordance with this Section 10.
11. DURATION
This DPA takes effect on the effective date of the MSA and remains in force for the duration of the MSA. Provisions of this DPA that by their nature are intended to survive termination will survive, including provisions relating to confidentiality, audits, data return and deletion, and cross-border transfers of any Customer Personal Data that remains in Wind Stream’s possession after termination.
12. CONFLICT
In the event of any conflict or inconsistency between this DPA and the MSA with respect to the processing of Customer Personal Data, this DPA prevails. In the event of any conflict between this DPA and any incorporated Standard Contractual Clauses, the Standard Contractual Clauses prevail.
13. NO SEPARATE EXECUTION
This DPA is incorporated into the MSA by reference and does not require separate execution. Customer’s execution of the MSA and applicable Order Form constitutes Customer’s acceptance of this DPA. Where a data-exporting jurisdiction requires a separately signed instrument for cross-border transfers, the Parties will execute such instrument on request, and its terms will be consistent with this DPA.
EXHIBIT A — DETAILS OF PROCESSING
A.1 Categories of data subjects. The Personal Data processed by Wind Stream on Customer’s behalf may concern the following categories of data subjects: (a) Customer’s Authorized Users (typically employees or contractors); (b) individuals whose Personal Data is contained within Customer Materials submitted to the Wind Stream Platform; and (c) any other data subjects whose Personal Data Customer chooses to make available to the Wind Stream Platform.
A.2 Categories of Personal Data. Depending on Customer’s use of the Services, the Personal Data processed by Wind Stream on Customer’s behalf may include: (a) account and identity information (names, email addresses, usernames, roles, workspace memberships); (b) content Customer or its Authorized Users upload, input, or generate through the Services (session prompts, transcripts, outputs, uploaded files, memory entries, generated reports); (c) data ingested from Customer Elected Integrations; and (d) any other Personal Data included in Customer Materials.
A.3 Sensitive Personal Data. Customer is prohibited under the MSA from uploading data subject to specific regulatory compliance regimes (including Protected Health Information as defined by HIPAA, cardholder data as defined by PCI DSS, or government-classified information) without an executed corresponding compliance addendum. Customer bears responsibility for the categories of Personal Data it makes available to the Wind Stream Platform.
A.4 Nature and purpose of processing. Wind Stream processes Customer Personal Data for the purpose of providing, maintaining, securing, and supporting the Wind Stream Platform in accordance with the MSA. Processing operations include storage, retrieval, transmission, display, backup, indexing, transformation, and transmission to authorized Sub-processors (including AI model providers) for the purpose of generating outputs and operating the Services.
A.5 Duration. Wind Stream processes Customer Personal Data for the duration of the MSA and for the period following termination as set forth in Section 10 of this DPA and Section 10 of the MSA.
A.6 Frequency. Continuous, for the duration of the MSA.
A.7 Data exporter. Customer, as identified in the applicable Order Form.
A.8 Data importer. Wind Stream, Inc., San Francisco, California, United States. Contact: privacy@windstream.ai.
A.9 Competent supervisory authority. For transfers subject to the GDPR, the competent supervisory authority is the Data Protection Commission of Ireland, consistent with the
governing-law selection in Section 8.2 of this DPA and Clause 13 of the EU SCCs.
EXHIBIT B — SUB-PROCESSORS
The current list of Sub-processors engaged by Wind Stream to process Customer Personal Data is published at windstream.ai/subprocessors. That list constitutes Annex III of the EU SCCs where the EU SCCs are incorporated into this DPA. Customer may subscribe to sub-processor change notifications by contacting privacy@windstream.ai. Sub-sub-processors engaged by Wind Stream’s Sub-processors are subject to those Sub- processors’ respective agreements and are disclosed via those Sub-processors’ public documentation.
EXHIBIT C — TECHNICAL AND ORGANIZATIONAL MEASURES
Wind Stream implements administrative, technical, and organizational measures designed to protect Customer Personal Data appropriate to the risk of processing. These measures are described in Wind Stream’s Information Security Program and are aligned with recognized industry standards, including the Trust Services Criteria applicable to Wind Stream’s SOC 2 examination. Specific measures include the following areas, subject to update from time to time consistent with Section 5.1 of this DPA:
C.1 Access controls. Role-based access controls, unique user identification, multi-factor authentication for personnel access to production systems, and periodic access reviews.
C.2 Encryption. Encryption of Customer Personal Data in transit over public networks using industry-standard protocols (TLS), and encryption of Customer Personal Data at rest in Wind Stream’s in-scope datastores using industry-standard symmetric encryption (AES-256).
C.3 Network security. Network segmentation, firewalls with periodic rule review, and restriction of remote access to authorized personnel over encrypted connections.
C.4 Logical isolation. Logical isolation of Customer Personal Data by tenant, session membership, resource participation, and assigned permissions.
C.5 Personnel security. Background checks for personnel with access to Customer Personal Data (to the extent legally permitted), confidentiality obligations for all personnel, and security awareness training.
C.6 Vulnerability management. Regular vulnerability scanning of external-facing systems, patch management, and remediation tracking of critical and high-severity findings.
C.7 Monitoring and logging. Centralized logging, security event monitoring, and infrastructure monitoring with alerting on defined thresholds.
C.8 Incident response. Documented incident response procedures, tested at least annually, with defined escalation and notification pathways.
C.9 Business continuity. Backup and recovery procedures for Customer Personal Data, with backup and recovery capabilities tested periodically.
C.10 Vendor management. Assessment of Sub-processors’ data protection practices under Wind Stream’s Third-Party Management Program.
For current details of Wind Stream’s security posture, Customer may request Wind Stream’s most recent independent audit report (e.g., SOC 2) under the audit provisions of Section 9.