Data Processing Agreement (DPA)

1. Roles and General Commitments

Customer is the "Controller" (or "Business," as applicable) of Personal Data included in Customer Content submitted to the Service. DON Systems is the "Processor" (or "Service Provider/Processor," as applicable) that processes such Personal Data on Customer's behalf.

Each party will comply with applicable data protection laws to the extent they apply to that party's role.

2. Definitions

Capitalized terms not defined in this DPA have the meanings given in the Terms of Service. "Personal Data," "Processing," "Controller," "Processor," and related terms have the meanings given in applicable data protection law, including the GDPR where relevant.

"Customer Content" includes embeddings, compressed or collapsed representations, metadata, and graph relationships submitted to or generated by the Service in the course of providing memory compression and retrieval.

3. Scope, Purpose, and Instructions

DON Systems will process Personal Data only to provide, maintain, secure, and support the Service, including:

• Storing, compressing, retrieving, and maintaining memory representations
• Enforcing tenant isolation
• Generating operational telemetry reasonably necessary for reliability and security

DON Systems will process Personal Data only on Customer's documented instructions. Customer's documented instructions include Customer's use of the Service, configurations and settings selected by Customer, and written instructions communicated through support channels that are consistent with the Terms and this DPA.

If DON Systems believes that an instruction violates applicable law, DON Systems will inform Customer unless prohibited by law.

4. Confidentiality

DON Systems will ensure that personnel authorized to process Personal Data are subject to confidentiality obligations and receive appropriate training regarding confidentiality and security.

5. Security Measures

DON Systems will implement and maintain appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access. Those measures include:

• Encryption in transit
• Access controls based on least privilege
• Secure handling of authentication materials
• Monitoring for suspicious activity
• Backup and restoration procedures consistent with the hosted architecture described in DON Systems' Privacy Policy

Customer acknowledges that security is a shared responsibility. Customer remains responsible for security of systems under its control, including embedding generation practices, metadata hygiene, credential management, access controls, and client-side key storage.

6. No Model Training on Customer Content Without Consent

DON Systems will not use Customer Content, including Personal Data contained within Customer Content, to train, fine-tune, or improve machine learning models or foundation models for general use without Customer's express consent. If DON Systems seeks to use Customer Content for any model training purpose, it will do so only pursuant to a separate written agreement or an explicit consent mechanism that clearly describes the scope, duration, and purpose of such use.

This section does not restrict DON Systems from using de-identified or aggregated operational telemetry to maintain and improve the Service's reliability, security, and performance, provided such telemetry is not used to reconstruct Customer Content.

7. Subprocessors

Customer authorizes DON Systems to engage subprocessors to process Personal Data as necessary to provide the Service. DON Systems will impose data protection obligations on subprocessors consistent with this DPA and remains responsible for their performance with respect to processing under this DPA.

As of the effective date, DON Systems' subprocessors for the hosted Service are described in Annex 3.

If DON Systems adds or replaces a subprocessor, it will provide notice consistent with the Terms and/or Privacy Policy. If Customer reasonably objects to a new subprocessor on data protection grounds, the parties will work in good faith to resolve the objection. If the objection cannot be resolved, Customer may terminate the affected portion of the Service without penalty for the remaining prepaid term, if any, as Customer's sole and exclusive remedy for that objection (unless otherwise agreed in writing).

8. Data Subject Requests and Assistance

Taking into account the nature of processing, DON Systems will provide reasonable assistance to Customer to enable Customer to respond to data subject requests where Customer cannot fulfill such requests independently through the Service.

If DON Systems receives a request directly from a data subject relating to Customer's Personal Data, DON Systems will, where legally permitted, direct the request to Customer and will not respond except as required by law.

9. Personal Data Breach Notification

DON Systems will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA. DON Systems will provide information reasonably necessary for Customer to meet breach notification obligations, to the extent such information is available.

Customer acknowledges that an incident affecting service availability is not necessarily a Personal Data Breach unless it results in unauthorized access, disclosure, or loss of confidentiality or integrity.

10. International Transfers

To the extent Personal Data is transferred from the EEA/UK/Switzerland to a country not recognized as providing adequate protection, the parties will implement an appropriate transfer mechanism, such as Standard Contractual Clauses and/or the UK Addendum, as applicable. If Customer requires execution of SCCs, Customer may request them through support@donsystems.com.

11. Audits

Upon reasonable written notice and not more than once per year (unless required by law or following a material security incident), Customer may request information reasonably necessary to confirm DON Systems' compliance with this DPA. DON Systems may satisfy such requests by providing security summaries, written responses, or relevant third-party assessments where available, rather than permitting on-site audits.

Any on-site audit must be mutually agreed, conducted during normal business hours, subject to confidentiality, and must not unreasonably interfere with DON Systems operations or compromise security or confidentiality of other customers.

12. Return or Deletion of Personal Data

Upon termination of the Service, DON Systems will, at Customer's option and subject to the Service's capabilities and applicable law, return or delete Personal Data processed under this DPA. Unless otherwise specified in a signed agreement, DON Systems will delete Customer Content from active systems within a commercially reasonable period following termination, typically after a short post-termination window that allows export and recovery. Residual copies may remain in backups until overwritten pursuant to backup retention schedules.

13. Liability

Liability under this DPA is subject to the limitations of liability set forth in the Terms of Service or applicable master agreement, unless prohibited by applicable law.

14. Order of Precedence

If there is a conflict between this DPA and the Terms of Service, this DPA controls with respect to processing of Personal Data. If there is a conflict between this DPA and an order form or signed master agreement that explicitly governs data processing, the signed agreement controls.