This Data Processing Addendum ("DPA") forms part of the agreement (the "Agreement") between Feanor Services LLC ("Feanor", "Processor") and the customer identified in the relevant order form or that has otherwise accepted the Agreement ("Customer", "Controller") for the provision of the Feanor service ("Service"). This DPA reflects the parties' agreement on the processing of Personal Data by Feanor on behalf of Customer in accordance with applicable Data Protection Laws.
This DPA applies to the processing of Personal Data by Feanor on Customer's behalf in connection with the Service. To the extent of any conflict between the Agreement and this DPA, this DPA controls with respect to the processing of Personal Data.
Capitalised terms used and not otherwise defined have the meanings given in the Agreement or applicable Data Protection Laws.
For Personal Data within Customer Data: Customer is the Controller (or, where Customer acts as a Processor for a third-party Controller, Customer warrants that it is authorised to instruct Feanor on the third-party Controller's behalf), and Feanor is the Processor. Feanor will process Personal Data only as a Processor on documented instructions from Customer, including with regard to international transfers, except where required to do otherwise by applicable law (in which case Feanor will inform Customer unless that law prohibits notification on important grounds of public interest).
Under CCPA/CPRA, Feanor is a Service Provider acting on behalf of Customer (the Business). Feanor will not (a) sell or share Personal Data, (b) retain, use or disclose Personal Data outside the direct business relationship between the parties or for a purpose other than providing the Service or as otherwise permitted by CCPA/CPRA, or (c) combine Personal Data with personal information received from other sources, except as expressly permitted by CCPA/CPRA. Feanor certifies that it understands and will comply with these restrictions.
Customer's complete and final instructions regarding processing are set out in this DPA, the Agreement and Customer's use of the Service. Customer instructs Feanor to process Personal Data as necessary to (i) provide and secure the Service, (ii) comply with reasonable instructions communicated through the Service or in writing, and (iii) comply with applicable law. Customer is responsible for ensuring that its instructions, and the data it submits, comply with applicable Data Protection Laws.
Feanor will ensure that personnel authorised to process Personal Data are bound by appropriate confidentiality obligations and have received adequate privacy and security training.
Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Feanor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk. The measures are described in Annex II. Customer acknowledges that these measures are subject to technical progress and development, and Feanor may update them provided the level of security is not materially decreased.
Customer provides general authorisation for Feanor to engage Sub-processors, subject to this section. Feanor:
Taking into account the nature of the processing, Feanor will assist Customer by appropriate technical and organisational measures, insofar as possible, to fulfil Customer's obligation to respond to requests from Data Subjects exercising their rights under Data Protection Laws (including access, rectification, erasure, restriction, portability, objection and rights regarding automated decision-making). If Feanor receives such a request directly from a Data Subject, it will, without responding on the substance, promptly forward the request to Customer.
Feanor will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer's Personal Data. The notification will include the information reasonably available to Feanor that Customer needs to comply with its own breach-notification obligations. Feanor will take reasonable steps to investigate and mitigate the breach and will keep Customer informed of material developments.
To the extent required by applicable Data Protection Laws, Feanor will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities, taking into account the information available to Feanor.
On termination of the Agreement, Feanor will, at Customer's choice, delete or return all Personal Data processed on Customer's behalf, and delete existing copies, unless retention is required by applicable law. Standard back-up retention applies and is subject to ongoing protection under this DPA until eventual deletion in the ordinary course.
Feanor will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, including summaries of independent third-party audit reports (where available). On reasonable prior written notice, no more than once per year (and more frequently if required by Data Protection Laws or following a confirmed Personal Data Breach), Customer or its independent auditor (subject to confidentiality undertakings and excluding competitors of Feanor) may conduct an audit limited to the information necessary to verify compliance with this DPA, during business hours, in a manner that does not unreasonably disrupt Feanor's operations. The parties will discuss in good faith the scope, timing and reasonable costs of any such audit.
Where Customer's transfer of Personal Data to Feanor (or Feanor's onward transfer to a Sub-processor) is a "restricted transfer" under Data Protection Laws, the parties agree that:
Feanor will implement supplementary measures, where necessary, to ensure that the level of protection guaranteed by Data Protection Laws is not undermined.
If a court or supervisory authority finds any provision of this DPA to be invalid or unenforceable, the remaining provisions remain in effect. The provisions of the Agreement on liability, governing law and disputes apply to this DPA. Where the SCCs apply and conflict with this DPA, the SCCs prevail.
Data exporter (Controller): Customer, as identified in the Agreement.
Data importer (Processor): Feanor Services LLC, New Mexico, United States. Contact: [email protected].
| Categories of data subjects | Customer's authorised users; individuals whose Personal Data appears in Customer's connected sources, such as employees, contractors, customers, prospects and counterparties. |
|---|---|
| Categories of personal data | Identifiers (name, work email, role, employer); communications content where authorised by Customer (messages, tickets, documents, calendar metadata); usage and log data; account credentials. Customer controls which sources are connected and which fields are ingested. |
| Sensitive data | Not requested by Feanor. If sensitive categories appear in Customer-connected sources, Customer is responsible for applying redaction or exclusion controls provided by the Service. |
| Frequency of transfer | Continuous, on a near-real-time basis. |
| Nature of processing | Ingestion, normalisation, structuring, storage, indexing, generation of skill files and audit metadata, and provision of the Service to Customer. |
| Purpose of processing | To enable Customer to operate the Service and produce executable skill files for use by Customer's authorised AI systems. |
| Retention period | For the term of the Agreement, plus the periods described in section 11 of this DPA. Specific retention may be configured by Customer. |
| Sub-processor transfers | For each Sub-processor in Annex III: the same subject matter, nature, purpose, categories of data subjects and personal data, frequency and retention as set out above, limited to what is necessary for the Sub-processor's role. |
For EU SCCs Module Two/Three: where Customer is established in an EU Member State, the supervisory authority of that Member State; where Customer is not established in the EU but has appointed an Article 27 representative, the supervisory authority of the Member State where the representative is established; otherwise, the Irish Data Protection Commission.
Feanor implements measures appropriate to the risk, including:
The current list of measures is maintained internally and updated as the Service evolves. A summary is available on request from [email protected].
The current list of authorised Sub-processors used to provide the Service is available on request from [email protected]. Each Sub-processor is engaged for a defined purpose (such as cloud hosting, error monitoring, customer support, communications, or analytics), is bound by written contract, and is subject to the obligations of section 7 of this DPA. Feanor will provide notice of changes to this list as set out in section 7.