Data Processing Addendum v1.0
This DPA forms part of the agreement between Northbyte Inc. ("GoNovus") and Customer made up of an Order Form and the GoNovus Master Services Agreement at https://gonovus.ai/legal/msa (together, the "Agreement"). It applies when GoNovus processes Personal Data on Customer's behalf. Capitalized terms not defined here have the meanings in the Agreement. The version of this DPA that applies is set by Section 1.3 of the MSA.
1. Definitions
"Data Protection Laws" means all laws applicable to the processing of Personal Data under the Agreement, including, as applicable, the California Consumer Privacy Act as amended (CCPA), other U.S. state privacy laws, the EU General Data Protection Regulation (GDPR), the UK GDPR, and the data protection laws of any other jurisdiction where Personal Data is collected through the Service. "Personal Data" means information in Customer Data relating to an identified or identifiable individual, or as defined in Data Protection Laws. "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data processed by GoNovus. "Subprocessor" means a third party engaged by GoNovus to process Personal Data. "Controller," "processor," "data subject," "business," "service provider," and "processing" have the meanings in Data Protection Laws.
2. Roles and Instructions
Customer is the controller (or business) and GoNovus is the processor (or service provider). Where Customer acts as a processor for another controller, GoNovus acts as Customer's subprocessor and Customer must have that controller's authorization for the processing and transfers. GoNovus will process Personal Data only to provide the Service and on Customer's documented instructions, which are the Agreement, the Order Form, applicable Scope Confirmations within Section 1.6 of the MSA, and Customer's configuration of the Service. GoNovus will inform Customer if it believes an instruction violates Data Protection Laws. Customer is responsible for the lawfulness of its instructions and for having a legal basis, notices, and consents for the processing.
3. Details of Processing
| Item | Description |
|---|---|
| Subject matter | Provision of the Service under the Agreement and applicable Scope Confirmations |
| Duration | For the period necessary to provide the Service, subject to the fixed retention limits and deletion triggers in the Security Annex and Section 7.5 of the MSA; an export request does not extend those limits. |
| Nature and purpose | Hosting, storage, retrieval, generating text and voice responses, deployment-specific agent configuration and evaluation, support and security within the agreed Service scope. No model-parameter training or fine-tuning. |
| Data subjects | End Users; Customer's Authorized Users |
| Categories of Personal Data | Chat messages; voice audio and transcripts; name, email, phone (if provided by an End User); order, cart, registration, or participation details; photos (only if a Service feature collects them); device, IP, and session data; Authorized User account details |
| Sensitive data | None intended. Customer will not instruct collection of sensitive data or images of identity documents. |
| Location | The hosting region stated in the Order Form; if none is stated, United States only (Microsoft Azure US regions), as stated in Section 9.3 of the MSA |
4. CCPA Service Provider Terms
GoNovus will not: (a) sell or share (for cross-context behavioral advertising) Personal Data; (b) retain, use, or disclose Personal Data for any purpose other than the business purposes in the Agreement, or outside the direct business relationship with Customer; or (c) combine Personal Data with personal information from other sources except as permitted by the CCPA. GoNovus will notify Customer if it can no longer meet its CCPA obligations, and Customer may take reasonable steps to stop unauthorized use. GoNovus will provide the level of privacy protection required by the CCPA. Customer may take reasonable and appropriate steps to monitor compliance and, on notice, stop and remediate unauthorized use. GoNovus will reasonably cooperate with those steps and certify its understanding of and compliance with these restrictions.
5. No Model Training
GoNovus will not use Personal Data or other Customer Data to train, fine-tune, or improve any AI or machine learning model, and will contractually require its AI model Subprocessors not to use it for training or retain it beyond what is needed to provide their service (including abuse monitoring, where applicable), under the applicable provider terms.
For Customer's deployment and documented instructions, GoNovus may organize knowledge, configure and evaluate prompts, tools, guardrails, retrieval and agent workflows, and improve those deployment-specific configurations. This agent optimization does not train or fine-tune model parameters and does not authorize use of Customer Data to train a shared or third-party model. All such processing remains subject to the DPA, access controls and retention limits.
6. Personnel
GoNovus will ensure that employees and contractors who process Personal Data are bound by confidentiality obligations, have received security training, and access Personal Data only as needed to perform the Service.
7. Subprocessors
Customer authorizes GoNovus to use the Subprocessors identified in the current Subprocessor List made available to Customer on request. Customer may obtain the list, including the providers, purposes, data processed, and processing locations relevant to the Service, by emailing support@gonovus.ai. Information on requesting the list and subscribing to updates is available at https://gonovus.ai/legal/subprocessors. GoNovus will: (a) enter into written agreements with each Subprocessor with data protection obligations no less protective than this DPA; (b) assess each Subprocessor's security before engagement; and (c) remain responsible for Subprocessors' performance. GoNovus will give at least 30 days' notice before adding or replacing a Subprocessor, by email to Customer's notice contact and to anyone subscribed to Subprocessor updates. Customer may object on reasonable data protection grounds within that period; the Parties will discuss in good faith, and if they cannot resolve the objection, Customer may terminate the affected Service and receive a refund of prepaid Fees for the unused period. Where a replacement is urgently needed for security or continuity, GoNovus will give notice as soon as possible, and the same objection right applies.
8. Security
GoNovus will implement and maintain the technical and organizational measures in the Security Annex at https://gonovus.ai/legal/security, designed to protect Personal Data against Security Incidents. GoNovus may update these measures provided they do not materially reduce overall security.
9. Security Incident Notification
GoNovus will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident. The notice will describe, to the extent known: the nature of the incident, categories and approximate number of data subjects and records affected, likely consequences, and measures taken or proposed. GoNovus will provide updates as information becomes available, take reasonable steps to contain and remediate the incident, and reasonably cooperate with Customer's legally required notifications. Notice is not an admission of fault. Unless required by law, GoNovus will not notify Customer's End Users or regulators about an incident affecting Customer Data without Customer's consent.
10. Assistance and Data Subject Requests
GoNovus will promptly forward to Customer any data subject request it receives relating to Customer Data and will not respond except to direct the requester to Customer. Taking into account the nature of processing, GoNovus will provide reasonable assistance (including through Service features) to help Customer respond to requests and to complete data protection impact assessments and regulator consultations. GoNovus may charge reasonable fees for assistance beyond standard Service features.
11. Audits
GoNovus will make available information reasonably necessary to demonstrate compliance with this DPA. Routine review may use the most recent SOC 2 report (when available), other third-party audit summary and reasonable security questionnaire responses, under confidentiality. Until a report is available, GoNovus will provide current security documentation and audit status; no certification is implied. Routine independent audits are at Customer's cost, during business hours, normally limited to once per year and on 30 days' notice. Those frequency and notice limits do not restrict audits required by Data Protection Laws, a competent regulator, the applicable transfer terms, or reasonably necessary following a Security Incident; notice will be as reasonably practicable in those circumstances. Audits must protect other customers' data and use reasonable confidentiality and operational safeguards. These arrangements do not replace any mandatory audit or information right.
12. Data Location and International Transfers
12.1 Location. Personal Data is stored and hosted only in the region stated in the Order Form or, if none is stated, in Microsoft Azure US regions, as provided in Section 9.3 of the MSA. Hosting location does not by itself remove requirements applicable to access or onward transfers.
12.2 EU transfers. Where a transfer is subject to the GDPR and requires an Article 46 safeguard, the standard contractual clauses in the Annex to European Commission Implementing Decision (EU) 2021/914 (EU SCCs) are incorporated without modification to their mandatory text. Module 2 applies when Customer is a controller; Module 3 applies when Customer is a processor. Customer is the data exporter and Northbyte Inc. (GoNovus) is the data importer. The selections and Appendix information below form part of the EU SCCs. The Parties will document the assessment and any supplementary measures required by Clause 14 before relying on these clauses for a transfer.
| EU SCC selection | Agreed position |
|---|---|
| Clause 7 | Optional docking clause included; accession requires the consent and Appendix completion required by that clause. |
| Clause 9(a) | Option 2, general authorization; at least 30 days' advance notice of an intended addition or replacement. Any urgent-change provision in DPA Section 7 is subject to this mandatory notice requirement for transfers relying on the SCCs. |
| Clause 11 | Optional independent dispute-resolution language is not selected. |
| Clause 17 | For Module 2, Option 1; for Modules 2 and 3, the laws of Ireland. |
| Clause 18 | Courts of Ireland, without restricting the data subject's rights under the SCCs. |
| SCC Appendix | Information |
|---|---|
| Annex I.A - exporter | Customer's full legal name, address and contact are those in its signed Order Form. Its role is controller or processor, as applicable to the transfer. Its relevant activity is using the Service for its business and authorized End Users. |
| Annex I.A - importer | Northbyte Inc., 2880 Zanker Rd., Suite 203, San Jose, CA 95134, United States. Contact: Privacy / Legal, support@gonovus.ai. Role: processor under Module 2 or subprocessor under Module 3. Relevant activity: providing the contracted AI agent Service. The Parties' signatures and dates on the Order Form also execute the incorporated SCCs. |
| Annex I.B - transfers | Data subjects, data categories, processing operations and purposes are in DPA Section 3. Transfers occur on a continuous basis as Customer uses the Service. Retention is governed by the Security Annex and MSA Section 7.5, including shorter data-specific limits. Sensitive data is not intended; Customer must not enable intentional sensitive-data processing without documented lawful instructions and appropriate safeguards. If such data is identified unexpectedly, GoNovus will restrict unnecessary access and cooperate on lawful deletion or handling rather than treat it as authorized model-training data. |
| Annex I.B - subprocessors | Subject matter, nature and duration are limited to the contracted Service, DPA Section 3 and the relevant provider's task and processing period in the supplied register. |
| Annex I.C - supervisory authority | The authority determined under SCC Clause 13: the authority responsible for an EU-established exporter; otherwise the authority of its Article 27 representative's Member State; or, where no representative is required, an authority in a Member State where relevant data subjects are located. The specific authority must be identified in the Customer's signed transfer details before the relevant transfer. Irish law/forum does not by itself select the Irish supervisory authority. |
| Annex II - security measures | The incorporated Security Annex describes the applicable technical and organizational measures. DPA Sections 8-11 describe incident handling, assistance and verification. |
| Subprocessor information | The dated register supplied to Customer identifies authorized providers, contact information, tasks, data and locations. General authorization is selected; the register supports the information requirements of Clauses 8.8 and 9 and is not a substitute for required notice. |
12.3 UK transfers. For a restricted transfer subject to the UK GDPR requiring these safeguards, the ICO International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B.1.0, including its Mandatory Clauses as revised under its own terms (UK Addendum), is incorporated. The following information completes its Tables. The UK Addendum's mandatory adaptations apply to the EU SCCs for UK transfers.
| UK Addendum table | Completion |
|---|---|
| Table 1 - parties | Start date: date the applicable Order Form is signed by the last Party. Exporter, importer, main addresses and key contacts: Annex I.A above and the Order Form. Signing that Order Form binds the Parties to this Addendum. |
| Table 2 - selected SCCs | EU SCCs under Decision 2021/914, Modules 2 and/or 3 as applicable, with the Clause 7, 9 and 11 selections in Section 12.2 and the completed Appendix information. |
| Table 3 - Appendix information | Annex I.A and I.B: Section 12.2, the Order Form and DPA Section 3. Annex II: the Security Annex. Subprocessor information: the dated register supplied to Customer. |
| Table 4 - changes to Approved Addendum | Both importer and exporter may end the Addendum only on the conditions specified in Section 19 of its Mandatory Clauses. |
12.4 Priority and customer-specific completion. The mandatory EU SCCs and UK Addendum prevail over inconsistent terms of this Agreement, including Order Form precedence, liability limits, audit restrictions and third-party-beneficiary exclusions. Before the relevant transfer, the Parties must complete the customer-specific exporter details, role, competent supervisory authority where applicable, authorized supplier-register reference and any required transfer assessment. No blank template or public webpage substitutes for that completion.
13. Return and Deletion
On termination or another applicable deletion trigger, GoNovus will return and delete Personal Data under Section 7.5 of the MSA and the fixed schedule in the Security Annex. Shorter data-specific limits prevail; a return or export request does not extend them. Mandatory return and deletion rights under applicable transfer terms remain unaffected.
14. Liability
Each Party's liability under this DPA is subject to Section 14 of the MSA, except to the extent a limitation would restrict liability or data subject rights under mandatory EU SCCs, the UK Addendum or applicable Data Protection Laws.