Data Processing Addendum

2.1 Roles

For Customer Personal Data, Customer is the Controller (or a Processor acting on behalf of its own clients) and Halo AI is a Processor (or Sub-processor). Where the CCPA applies, Customer is a Business and Halo AI is a Service Provider. Annex 1 describes the processing.

2.2 Customer as a processor

If Customer is itself a Processor of Customer Personal Data, Customer warrants that its instructions to Halo AI, including the appointment of Halo AI as a Sub-processor, have been authorized by the relevant Controller, and Customer will be Halo AI’s sole point of contact for that Controller.

2.3 Halo AI as a controller

Halo AI is an independent Controller of the account, billing, support and Usage Data it collects for its own purposes, as described in its Privacy Policy. That processing is not covered by this DPA.

2.4 Instructions

Customer’s complete and final instructions to Halo AI are: (a) the Agreement; (b) this DPA; (c) the settings and configuration Customer applies in the Services, including the Integrations it connects, the Agents it deploys and the instructions it gives them; (d) actions Customer and its Authorized Users take through the dashboard, the API and the MCP server, including through AI Clients; and (e) any further written instructions agreed by the parties.

Halo AI will process Customer Personal Data only on these documented instructions, including with regard to transfers, unless required to do otherwise by law, in which case Halo AI will inform Customer of that requirement before processing unless the law prohibits it. Halo AI will promptly inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. Halo AI is not obliged to perform a legal review on Customer’s behalf.

4.1 Confidentiality of personnel

Halo AI ensures that personnel authorized to process Customer Personal Data are bound by written confidentiality obligations, receive appropriate training, and access Customer Personal Data only to the extent needed to provide, support and secure the Services.

4.2 Security

Halo AI implements and maintains the Security Measures, which are designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to Data Subjects. Halo AI may update the Security Measures from time to time, provided that an update does not materially reduce the overall protection of Customer Personal Data.

4.3 Personal Data Breach

Halo AI will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed to address it, and a contact point. Halo AI will provide further information as it becomes available and will cooperate reasonably with Customer’s investigation, notifications and remediation. Notification of a Personal Data Breach is not an acknowledgement of fault or liability. Notices are sent to the email addresses of Customer’s workspace owners and to any security contact Customer has registered with Halo AI.

4.4 Data Subject requests

The Services let Customer access, export, correct and delete Customer Personal Data about individual contacts and companies, including knowledge derived from it. Halo AI will provide reasonable additional assistance, at Customer’s reasonable expense where a request requires material effort, so that Customer can respond to Data Subject requests. If Halo AI receives a request directly from a Data Subject about Customer Personal Data, it will direct the Data Subject to Customer and will not respond substantively except as required by law.

4.5 Impact assessments and consultations

Taking into account the nature of the processing and the information available to it, Halo AI will provide reasonable assistance with data protection impact assessments and with prior consultations of Supervisory Authorities that Customer is required to carry out in relation to the Services.

4.6 Return and deletion

During the Agreement, Customer can export Customer Personal Data through the dashboard, the API and the MCP server, and can delete it through the Services. After the Agreement ends, Halo AI will keep Customer Personal Data available for export for 30 days and will then delete it from active systems within 90 days, unless retention is required by law. Copies held in backups are overwritten in the ordinary course of Halo AI’s backup cycle and remain subject to this DPA until deleted. On written request, Halo AI will confirm deletion in writing.

4.7 Audits and information

Halo AI will make available the information reasonably necessary to demonstrate compliance with this DPA, including this DPA, Annex 2, its published security documentation and, where available, summaries of third-party assessments. Not more than once in any 12-month period, Customer may submit a written security questionnaire, which Halo AI will answer within 30 days.

Where Customer is required by a Supervisory Authority to conduct an audit, or following a Personal Data Breach affecting Customer Personal Data, Customer (or an independent auditor bound by confidentiality and reasonably acceptable to Halo AI) may audit Halo AI’s compliance with this DPA on at least 30 days’ written notice, during business hours, no more than once in any 12-month period, in a manner that does not disrupt Halo AI’s operations or compromise other customers’ data, and at Customer’s expense. Where the EU SCCs apply, this Section is read consistently with Clause 8.9 of the EU SCCs.

4.8 Records and cooperation

Halo AI maintains records of its processing activities as required by law and will cooperate with Supervisory Authorities in the performance of their tasks as required by Applicable Data Protection Law.

5.1 General authorization

Customer gives Halo AI general written authorization to engage Sub-processors to provide the Services, including the Sub-processors listed at haloagents.ai/subprocessors on the date Customer accepts this DPA, and Halo AI’s Affiliates.

5.2 Flow-down and liability

Halo AI will enter into a written agreement with each Sub-processor that imposes data protection obligations providing at least the same level of protection as this DPA, to the extent applicable to the services the Sub-processor provides. Halo AI remains liable for the performance of its Sub-processors’ obligations.

5.3 Notice of changes

Halo AI will update the Sub-processors page and notify Customer’s workspace owners by email at least 30 days before a new Sub-processor begins processing Customer Personal Data, except where a replacement is required urgently to maintain the security or availability of the Services, in which case Halo AI will notify Customer as soon as practicable. Customer can register an additional notification address by emailing support@haloagents.ai.

5.4 Objection

Customer may object to a new Sub-processor on reasonable data protection grounds by emailing support@haloagents.ai within 30 days of the notice. The parties will discuss the objection in good faith. If Halo AI cannot reasonably accommodate the objection (for example by not using the Sub-processor for Customer’s data), either party may terminate the affected Services on written notice, and Halo AI will refund any prepaid fees for the period after termination. Continued use of the Services after the 30-day period is deemed acceptance of the new Sub-processor.

6.1 Location of processing

Halo AI is established in the United States and hosts the Services in the United States. Customer authorizes Halo AI to transfer, store and process Customer Personal Data in the United States and in the other locations shown on the Sub-processors page, subject to this Section 6.

6.2 EU Standard Contractual Clauses

To the extent Customer’s use of the Services involves a Restricted Transfer to Halo AI, the parties agree that the transfer is governed by the EU SCCs, which are incorporated into this DPA by reference and completed as follows:

1. Module Two (controller to processor) applies where Customer is a Controller, and Module Three (processor to processor) applies where Customer is a Processor;
2. Clause 7 (the optional docking clause) does not apply;
3. in Clause 9, Option 2 (general written authorization) applies, with the 30-day notice period set out in Section 5;
4. in Clause 11, the optional language does not apply;
5. in Clause 13, the Supervisory Authority identified in Annex 1, Part C is the competent authority;
6. in Clause 17, Option 1 applies and the EU SCCs are governed by the law of Ireland;
7. in Clause 18, disputes are resolved by the courts of Ireland;
8. Annex I.A and I.B of the EU SCCs are completed by Annex 1, Parts A and B of this DPA, Annex I.C by Annex 1, Part C, Annex II by Annex 2, and Annex III by the Sub-processors page referenced in Annex 3; and
9. Customer is the “data exporter” and Halo AI is the “data importer”.

6.3 United Kingdom

For Restricted Transfers subject to the UK GDPR, the EU SCCs as completed above apply as modified by the UK Addendum, which is incorporated by reference. The UK Addendum is completed as follows: Table 1 with the parties in Annex 1, Part A; Table 2 with the EU SCCs as completed in Section 6.2; Table 3 with Annexes 1, 2 and 3 of this DPA; and, for Table 4, either party may end the UK Addendum as set out in its Section 19.

6.4 Switzerland

For Restricted Transfers subject to the FADP, the EU SCCs as completed above apply with these adaptations: references to the GDPR are read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent Supervisory Authority; references to “Member State” are read so that Data Subjects in Switzerland may enforce their rights in Switzerland; and the EU SCCs protect the data of legal entities to the extent the FADP requires.

6.5 Alternative transfer mechanisms

If Halo AI adopts an alternative lawful transfer mechanism recognized under Applicable Data Protection Law, such as certification under the EU-U.S. Data Privacy Framework, that mechanism may apply in place of or alongside the EU SCCs, and Halo AI will tell Customer which mechanism applies. If a mechanism the parties rely on is invalidated, they will cooperate in good faith to implement a replacement promptly.

6.6 Onward transfers

Halo AI ensures that onward transfers of Customer Personal Data to Sub-processors outside the European Economic Area, the United Kingdom or Switzerland are protected by the EU SCCs (Module Three), the UK Addendum, an adequacy decision or another valid transfer mechanism.

6.7 Government access requests

If a public authority requests access to Customer Personal Data, Halo AI will review the legality of the request, challenge a request it reasonably believes to be unlawful, disclose only the minimum amount of data required, and notify Customer of the request unless the law prohibits notification.

7.1 Service Provider role

Where the CCPA or another US state privacy law applies, Halo AI acts as a Service Provider (or the equivalent processor or contractor role), and Customer discloses Customer Personal Data to Halo AI only for the limited and specified business purpose of providing the Services as described in the Agreement and Annex 1.

7.2 Restrictions

Halo AI will not:

• Sell or Share Customer Personal Data;
• retain, use or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement, including for any commercial purpose other than providing the Services, or outside the direct business relationship between Halo AI and Customer; or
• combine Customer Personal Data with Personal Data it receives from other sources, except as the CCPA permits a Service Provider to do (for example to detect security incidents or protect against fraud).

7.3 Compliance commitments

Halo AI will comply with the CCPA and provide the same level of privacy protection as the CCPA requires of Businesses. Halo AI will notify Customer within 5 business days if it determines that it can no longer meet its obligations under this Section. Customer has the right, on reasonable notice, to take reasonable and appropriate steps to ensure that Halo AI uses Customer Personal Data consistently with Customer’s obligations, and to stop and remediate any unauthorized use. Halo AI certifies that it understands and will comply with the restrictions in this Section.

7.4 De-identified data

If Halo AI receives or creates de-identified data derived from Customer Personal Data, it will take reasonable measures to ensure the data cannot be associated with an individual, will not attempt to re-identify it, and will contractually obligate any recipient to do the same.

7.5 Sub-processors

Sub-processors engaged under Section 5 are bound by written contracts that impose the obligations in this Section on them.

10.1 Order of precedence

If there is a conflict, the following order applies: (1) the EU SCCs and the UK Addendum, where they apply; (2) this DPA; and (3) the Agreement.

10.2 Updates

Halo AI may update this DPA to reflect changes in Applicable Data Protection Law, regulatory guidance, approved transfer mechanisms or the Services. Material changes will be notified at least 30 days in advance by email or in the dashboard. No update will materially reduce the protection of Customer Personal Data without Customer’s consent, unless the change is required by law.

10.3 Governing law and severability

This DPA is governed by the law that governs the Agreement, except where the EU SCCs or the UK Addendum require otherwise. If any provision of this DPA is held invalid or unenforceable, the remaining provisions continue in full force, and the invalid provision is replaced by a valid one that achieves the same purpose as closely as possible.

Part A. List of parties

Part B. Description of the processing

• Subject matter: the provision of the Services to Customer under the Agreement.
• Duration: the Subscription Term, plus the export and deletion periods in Section 4.6.
• Nature and purpose: hosting and storage; indexing and retrieval, including the creation of embeddings; generation of Output by AI models; classification, summarization and analysis; routing and escalation; synchronization with Integrations Customer connects; sending and receiving email and in-app messages; speech synthesis where enabled; and support, security, backup and billing-related processing. All processing is carried out to provide and support the Services as Customer configures them.
• Categories of Data Subjects: Customer’s Authorized Users; End Users and prospective customers of Customer, including visitors to Customer’s websites and users of Customer’s products; contacts, employees and representatives of Customer’s customers and prospects; participants in calls and meetings Customer connects to the Services; recipients of communications Customer sends through the Services; and other individuals whose Personal Data is included in Customer Data.
• Categories of Personal Data: identifiers and contact details (name, email address, phone number, user IDs, company, job title); account and profile attributes Customer chooses to pass through the SDK, imports or Integrations (plan, lifecycle stage, usage attributes, custom fields); communications content (chat, email, in-app and voice messages, support tickets, call and meeting transcripts and recordings, notes); behavioral and technical data (page views, product events, device and browser information, IP address, approximate location, session identifiers); commercial data (deal, subscription and invoice information synced from Customer’s systems; payment card numbers are not processed by Halo AI); content Customer publishes (help center articles and knowledge base entries); and any other Personal Data contained in Customer Data.
• Sensitive data: the Services are not designed to process special categories of Personal Data, and Customer must not configure them to request it. Sensitive data that Data Subjects volunteer in conversations is protected by the Security Measures, including tenant isolation, access controls, encryption and the removal of personal details from knowledge derived from conversations.
• Frequency: continuous, for the duration of the Agreement.
• Retention: as set out in Section 4.6 and the Agreement. Raw behavioral event records are purged after 90 days.
• Transfers to Sub-processors: as described on the Sub-processors page, for the purposes and in the locations listed there, for the duration of the processing.

Part C. Competent Supervisory Authority

Where Customer is established in an EU Member State, the Supervisory Authority of that Member State. Where Customer is not established in the EU but has appointed a representative under Article 27 GDPR, the Supervisory Authority of the Member State in which the representative is established. Otherwise, the Supervisory Authority of the Member State in which the Data Subjects whose Personal Data is transferred are located. For the United Kingdom, the Information Commissioner’s Office. For Switzerland, the Federal Data Protection and Information Commissioner.