Snapshot 222405
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Agreement Last Updated: 8 July 2026 Introduction This Data Processing Agreement (“DPA”) is entered into by and between: Ethos Artificial Intelligence Limited (“Ethos” or the “Processor”), a company incorporated in England and Wales with its registered office at Office 3.01, MYO, 42–50 York Way, Kings Cross, London N1 9AB, United Kingdom; and the customer entity identified as “you” under the Ethos Terms of Use, as “you” or “Expert” under the Expert Terms and Conditions, and/or as “Client” on an Order Form executed under a master services agreement or other customer agreement entered into with Ethos, or any other entity that determines the purposes and means of Processing Personal Data for which Ethos acts as Processor or service provider/contractor (“User” or the “Data Controller”). This DPA is entered into in connection with the Ethos Terms of Use, the Expert Terms and Conditions and/or the master services agreement or other customer agreement (as applicable) between User and Ethos, which govern User’s use of the platform made available by Ethos (the “Agreement”) but only to the extent such Agreement relates to Processing of Personal Data for which Ethos acts as Processor or service provider/contractor on behalf of User. Roles and Scope User as Data Controller: The User is the Data Controller under applicable Data Protection Laws, determining the purposes and means of Processing the Personal Data covered by this DPA. Ethos as Processor: Ethos will Process Personal Data on behalf of the Data Controller under this DPA, as required to fulfill the obligations set forth in the Agreement. Purpose of this DPA This DPA sets forth the terms under which the Processor will process personal data on behalf of the Data Controller, ensuring compliance with: The UK General Data Protection Regulation (UK GDPR); The General Data Protection Regulation (EU GDPR), where applicable; Other applicable data protection or privacy legislation. The Processor will process Personal Data exclusively: In accordance with the written instructions of the Data Controller, as detailed in this DPA and the Agreement. For the purposes necessary to fulfill the services defined in the Agreement and any related agreements. Relationship to Privacy Policy and Expert Terms Ethos and User are together the “Parties”, and each a “Party”. This DPA applies only to the extent Ethos Processes Personal Data as a Processor or service provider/contractor on behalf of a User that determines the purposes and means of such Processing. For clarity, this DPA does not apply to Ethos’s Processing of Personal Data for which Ethos acts as a controller or business, including Personal Data collected from or about Experts in connection with account creation, profile management, payments and payout administration, platform operation, matching, screening, ranking, AI Tools, marketing, support, security, analytics, service improvement, or other purposes described in the Ethos Privacy Policy. To the extent the Expert Terms and Conditions refer to this DPA, that reference applies only to Personal Data, if any, that Ethos Processes on behalf of a User as Processor, and does not limit Ethos’s rights or obligations as a controller or business under the Ethos Privacy Policy. The Parties agree to comply with this DPA with respect to the Processing of Personal Data by Ethos as Processor on behalf of User. Definitions “Adequate Country” means: for Personal Data processed subject to the EU GDPR: the European Economic Area, or a country or territory recognised as ensuring adequate protection under the EU GDPR; for Personal Data processed subject to the UK GDPR: the UK, or a country or territory recognised as ensuring adequate protection under the UK GDPR and the Data Protection Act 2018; or for Personal Data processed subject to the Swiss FADP: Switzerland, or a country or territory that is: (i) included in the list of the states whose legislation ensures adequate protection as published by the Swiss Federal Data Protection and Information Commissioner, if applicable; or (ii) recognised as ensuring adequate protection by the Swiss Federal Council under the Swiss FADP; in each case, other than on the basis of an optional data protection framework. “Authorised Persons” means Ethos employees, contractors, agents, auditors, and other personnel acting under Ethos’s authority who have a need-to-know or otherwise require access to Personal Data to enable Ethos to perform its obligations under the Agreement and this DPA. “Data Protection Laws” means the European Union General Data Protection Regulation (EU) 2016/679 (“EU GDPR”); the UK General Data Protection Regulation and the UK Data Protection Act 2018 (together, the “UK GDPR”); the Swiss Federal Act on Data Protection (“Swiss FADP”); the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, the “CCPA/CPRA”); and the other data protection laws and regulations of the European Union, the European Economic Area and their member states, the United Kingdom, Switzerland, and the United States, in each case as applicable to the Processing of Personal Data under this DPA. “Data Subject Request” means a request made by a Data Subject, consumer, or other individual conferred rights under Data Protection Laws. “Personal Data” means any personal data or personal information, as defined by Data Protection Laws, that Ethos processes on behalf of User in connection with the Agreement. “Platform” has the same meaning as in the Agreement. “Regulatory Authority” means any local, state, national, or multinational agency, department, official, parliament, public or statutory person, government or professional body, regulatory authority or supervisory authority, or board or other body responsible for administering Data Protection Laws. “Security Incident” means any data breach as defined by applicable Data Protection Laws, or any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data on systems managed or otherwise controlled by the Processor or its Sub-processors. “User” (also referred to in this DPA as the “Data Controller”) means the legal entity or other person that determines the purposes and means of Processing Personal Data for which Ethos acts as Processor or service provider/contractor under this DPA. References in this DPA to ‘User’ and ‘Data Controller’ mean the same entity or person in that capacity. “Business Purpose”, “Controller”, “Processor”, “Processing”, “Data Subject”, “Sensitive Data”, and “Sub-processor” if appearing in this DPA shall have the same meaning as in the Data Protection Laws. 1. Roles of the Parties Ethos is a Processor under this DPA and will Process Personal Data in accordance with Attachment A. User is a Controller under this DPA. 2. Responsibility and Term Ethos will Process Personal Data only as set forth in the documented written instructions of User (which include this DPA and the Agreement) for the term set forth in the Agreement. Ethos will not collect, use, retain, disclose, share, sell, or otherwise make Personal Data available for any purpose other than for the specific business purposes set forth in the Agreement and this DPA. Ethos will maintain the confidentiality of the Personal Data and will not disclose the Personal Data to third parties unless the User, the Agreement, or this DPA specifically authorises the disclosure, or as required by domestic law, court, or Regulatory Authority. Ethos will reasonably assist User with meeting compliance obligations under Data Protection Laws. If Ethos becomes aware that any instruction from User would, in its reasonable opinion, infringe Data Protection Laws, Ethos will promptly inform User in writing. To the extent that Ethos uses AI Tools to provide the Platform and related services as Processor under this DPA, such use constitutes Processing performed by Ethos on behalf of User in accordance with User’s documented instructions, the Agreement, and this DPA. User is responsible for ensuring that it has a lawful basis for the Processing, has provided appropriate notices to Data Subjects, and conducts human review of AI-generated outputs where required by applicable Data Protection Laws. Ethos will not use Personal Data Processed as Processor under this DPA to train generalised AI models except as expressly authorised by User in the Agreement or other written instructions. 3. Representations, Warranties, and Certifications User represents and warrants that: User has complied, and will continue to comply, with all applicable laws, including Data Protection Laws, in respect of its processing of Personal Data and any processing instructions it issues to Ethos; User has provided, and will continue to provide, all notice and has obtained, and will continue to obtain, all consents and rights necessary under Data Protection Laws for Ethos to process Personal Data for the purposes described in the Agreement; User has the sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which User acquired Personal Data; User has ensured that Ethos’s processing of the Personal Data in accordance with User’s instructions will not cause Ethos to violate any applicable law, regulation, or rule, including, without limitation, Data Protection Laws; User will only give Ethos the minimum necessary amount of Personal Data necessary to achieve the purposes of the Agreement and this DPA; User will only give Ethos Personal Data in compliance with this DPA; and Any Personal Data User provides to or processes via Ethos-provided products or services does not and will not contain any U.S. Social Security numbers or other government-issued identification numbers; protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA), other information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional, or other health-related data subject to protection under applicable laws and regulations; health insurance information; biometric information; passwords for online accounts other than Ethos; credentials to any financial accounts; tax return data; any payment card information subject to the Payment Card Industry Data Security Standard; Personal Data of children under 18 years of age; or any other information that falls within any special categories of data or is considered Sensitive Data (as defined in Data Protection Laws), unless expressly approved in writing by Ethos and subject to additional safeguards agreed by the Parties. Ethos certifies that it: Shall not “sell” or “share” Personal Data as those terms are defined under the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA). Shall not retain, use, or disclose Personal Data for any purpose other than the Business Purpose specified in this DPA and the Agreement, or as otherwise permitted by the CCPA/CPRA. Shall not retain, use, or disclose Personal Data for any commercial purpose other than the Business Purpose specified in this DPA and the Agreement, or as otherwise permitted by the CCPA/CPRA. Shall not retain, use, or disclose Personal Data outside the direct business relationship between Ethos and User, except as permitted by the CCPA/CPRA. Shall not “share” Personal Data for cross-context behavioral advertising, as that term is defined under the CCPA/CPRA. Shall not combine Personal Data received from or on behalf of User with personal information received from or on behalf of any other person, or collected from Ethos’s own interactions with consumers, except as permitted by the CCPA/CPRA and its implementing regulations. Shall cooperate with User to fulfill consumer rights requests, including requests to access, correct, delete, or opt out of sale or sharing, to the extent required by the CCPA/CPRA and applicable to Ethos’s Processing of Personal Data. Shall promptly notify User if Ethos determines that it can no longer meet its obligations under the CCPA/CPRA or this DPA. Shall permit User to take reasonable and appropriate steps to help ensure that Ethos uses Personal Data in a manner consistent with User’s obligations under the CCPA/CPRA and to stop and remediate any unauthorised use of Personal Data, in each case as required by and subject to the CCPA/CPRA. Shall require any Sub-processor to which it discloses Personal Data to comply with obligations equivalent to those set forth in this Section 3.2. Nothing in this DPA shall be construed to require Ethos to comply with the CCPA/CPRA beyond its obligations as a service provider or contractor as defined under the CCPA/CPRA. 4. Authorized Persons Ethos will take reasonable steps to ensure the reliability, integrity, and trustworthiness of all Authorised Persons with access to the Personal Data. Ethos shall ensure that Authorised Persons shall be under an appropriate obligation of confidentiality (whether a contractual or statutory duty). 5. Security Ethos will at all times implement appropriate technical and organisational measures to protect Personal Data, including, at a minimum, the measures described in Attachment B and such other measures as are appropriate to the risks presented by the Processing, in accordance with Article 32 of the UK GDPR and the EU GDPR. 6. Security Incidents Upon becoming aware of a Security Incident, Ethos shall: Notify User without undue delay or as otherwise required by Data Protection Laws, providing User with at least the information required for User to comply with its own notification obligations under Articles 33 and 34 of the UK GDPR and the EU GDPR (including the nature of the Security Incident, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it); Promptly take reasonable steps to contain and investigate any Security Incident; and Reasonably cooperate with User in connection with User’s notifications to Regulatory Authorities and affected Data Subjects, including by providing such further information as User reasonably requires for that purpose. Ethos’s notification of or response to a Security Incident under this Section shall not be construed as an acknowledgment by Ethos of any fault or liability with respect to the Security Incident. 7. Sub-processors User agrees that Ethos may engage Sub-processors to process Personal Data. A list of all of Sub-processors can be found on the Ethos website at https://agent.askethos.com/ethos-subprocessors (the “Sub-processor Site”). Ethos shall list each Sub-processor, including any affiliated Sub-processor that Processes Personal Data, on the Sub-processor Site before such Sub-processor Processes Personal Data. When Ethos engages any new Sub-processor after the effective date of the Agreement, Ethos will notify User of such engagement, including the name, location, and processing activities of the relevant Sub-processor, by updating the Sub-processor Site or by other written means. If User objects to such engagement, User may, within fifteen (15) days of receipt of notice from Ethos, as its sole and exclusive remedy, either (i) require Ethos not to use that Sub-processor for the Processing of User’s Personal Data, in which case Ethos may suspend the affected portion of the Platform in respect of User, or (ii) terminate the affected portion of the Agreement and cease use of the Platform by providing written notice to Ethos and paying Ethos for all amounts due and owing under the Agreement as of the date of such termination. Ethos will enter into a written contract with each Sub-processor that imposes data protection obligations no less protective than those set out in this DPA, including obligations required by Article 28(4) of the UK GDPR and the EU GDPR and analogous provisions of other Data Protection Laws, as applicable. Where an affiliated Sub-processor located outside the United Kingdom, EEA, Switzerland, or another Adequate Country Processes Personal Data, Ethos shall maintain an intra-group written agreement or other legally binding instrument with such affiliated Sub-processor imposing obligations no less protective than those set out in this DPA and incorporating appropriate transfer mechanisms as required by Data Protection Laws. Ethos shall remain fully liable to User for the acts and omissions of its Sub-processors in respect of their obligations relating to the Processing of Personal Data, as required by Article 28(4) of the UK GDPR and the EU GDPR. 8. Inquiries by Data Subjects Ethos shall promptly inform User of all Data Subject Requests involving Personal Data that Ethos receives directly (and in any event within five (5) business days of receipt), and shall not respond to such requests except on the documented instructions of User or as required by Data Protection Laws, and take reasonable measures (including by providing appropriate technical and organisational measures, where feasible) to enable User to comply with the rights of Data Subjects under Data Protection Laws. 9. Records and Audit Ethos shall make available to User all information reasonably necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, subject to the following conditions: (a) Audits shall be limited in scope to the systems, facilities, records, and processing operations that are owned or controlled by Ethos and used to Process User’s Personal Data, and shall exclude the systems, facilities, premises, or data of any other customer, third party, or Sub-processor. (b) User shall provide at least thirty (30) days’ prior written notice; audits may be conducted no more than once annually, except following a confirmed Security Incident affecting User’s Personal Data or where required by a Regulatory Authority. (c) Audits shall be at User’s expense (including reimbursement of Ethos’s reasonable costs at Ethos’s then-current professional services rates), subject to reasonable confidentiality and security obligations, during business hours, and in a manner that does not unreasonably disrupt Ethos’s operations or the rights of other customers. (d) In lieu of an on-site audit, User will accept Ethos’s then-current third-party audit reports (e.g., SOC 2 Type II or ISO 27001 certifications) where these reasonably address the matters User wishes to assess. 10. Return or Destroy Data Upon Termination Upon termination or expiration of the Agreement, Ethos shall (at User’s election, exercised within 30 days of termination or expiration) delete or return to User all Personal Data in its possession or control, within 60 days of receipt of User’s election (or, if no election is made, delete the Personal Data within 60 days of termination or expiration), except that this requirement shall not apply to the extent Ethos is required by applicable law to retain some or all of the Personal Data, or as otherwise specified by the Agreement. Personal Data retained in routine back-ups or pursuant to a legitimate legal hold may be retained for the remainder of the relevant back-up cycle or hold period, provided that such Personal Data remains subject to the confidentiality and security obligations of this DPA and is not actively Processed for any other purpose. For the avoidance of doubt, data that has been aggregated and de-identified such that it no longer constitutes Personal Data under applicable Data Protection Laws is not subject to the deletion or return obligations of this Section; Ethos shall maintain such data in de-identified form and shall not attempt to re-identify it except as permitted by applicable law. This Section applies only to Personal Data Processed by Ethos as Processor or service provider/contractor under this DPA and does not apply to Personal Data Processed by Ethos as a controller or business under the Ethos Privacy Policy. 11. Data Transfers The Parties acknowledge that the provision of the products and/or services under the Agreement may require the transfer or Processing of Personal Data in countries outside the United Kingdom from time to time. In such event, the Parties shall rely on the transfer mechanisms set out in Attachment C (as applicable): (a) for transfers subject to the EU GDPR, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller-to-processor); (b) for transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the EU SCCs issued by the ICO; and (c) for transfers subject to the Swiss FADP, the EU SCCs as amended in accordance with the FDPIC’s guidance. Each of the foregoing is incorporated into this DPA by reference as set out in Attachment C and deemed completed with the information set out in Attachment A (including the docking-clause and Annex information set out therein). Where Ethos engages a Sub-processor located outside the United Kingdom, EEA, Switzerland, or another Adequate Country, Ethos will ensure the relevant onward transfer is subject to an appropriate transfer mechanism under applicable Data Protection Laws (including, where applicable, the EU Standard Contractual Clauses, the UK Addendum or IDTA, and Swiss amendments). Ethos-to-Sub-processor onward transfers are governed by such mechanisms and are distinct from the Module Two controller-to-processor SCCs incorporated under §11.2. The Parties acknowledge that the Data Protection Laws do not require the Standard Contractual Clauses or an Alternative Transfer Solution in order for Personal Data to be processed in or transferred to an Adequate Country. Should a change in Data Protection Laws occur, or a decision of a competent authority be made which might affect the validity of an international transfer or adequacy of an international transfer method, the Parties agree to promptly address any agreements necessary to restore the validity, adequacy, or compliance of such international transfers under Data Protection Laws. If any transfer mechanisms must be changed for compliance with Data Protection Laws, the Parties shall enter into a separate, written agreement detailing the new transfer methods. Where required by Data Protection Laws, the Parties shall conduct a transfer impact assessment in respect of transfers of Personal Data to third countries, taking into account the matters set forth in Recital 14 of the EU SCCs and the EDPB Recommendations 01/2020 (as updated). Ethos shall provide such assistance and information as User reasonably requires to conduct such assessment. 12. Cooperation with Regulatory Authorities Ethos shall notify User within a reasonable time of all inquiries from a Regulatory Authority that Ethos receives which relate to the Processing of Personal Data, the Agreement, or either Party’s obligations under this DPA, unless prohibited from doing so by Data Protection Laws or by a Regulatory Authority. Ethos shall provide User with such assistance and information as User may reasonably request in order for User to comply with any obligation to carry out a data protection impact assessment (DPIA) or consult with a Regulatory Authority pursuant to Articles 35 and 36 of GDPR, respectively. 13. Limitation of Liability & Indemnification The limitations of liability and indemnification provisions set forth in the Agreement shall apply to this DPA. Notwithstanding the foregoing: (a) the limitations of liability set forth in the Agreement shall not apply with respect to any breach by User of its obligations under this DPA, including User’s representations and warranties in Section 3.1; (b) in no event shall Ethos be liable under or in connection with this DPA for any indirect, incidental, consequential, special, or exemplary damages, or for any loss of profits, revenue, data, or business opportunity, even if advised of the possibility of such damages; (c) subject to the Standard Contractual Clauses and applicable mandatory law, Ethos’s total aggregate liability under or in connection with this DPA (whether in contract, tort, or otherwise) shall not exceed the amounts paid by User to Ethos under the Agreement in the twelve (12) months immediately preceding the event giving rise to such liability; and (d) User shall indemnify, defend, and hold harmless Ethos and its affiliates, officers, directors, employees, and agents from and against any and all claims, losses, damages, liabilities, costs, and expenses (including reasonable attorneys’ fees) arising out of or relating to: (i) User’s breach of this DPA or the Agreement; (ii) User’s violation of Data Protection Laws; or (iii) any processing of Personal Data that was carried out in accordance with User’s instructions. For clarity, this Section applies only to claims arising from Ethos’s Processing of Personal Data as Processor or service provider/contractor under this DPA, and does not apply to Ethos’s Processing of Personal Data as a controller or business under the Ethos Privacy Policy. 14. Miscellaneous Ethos may update or modify the terms of this DPA from time to time by providing notice to User via email, through the Platform, or by posting the revised terms at https://agent.askethos.com/ethos-dpa. (a) Ethos may make changes that are administrative, operational, or required to comply with Data Protection Laws or the requirements of a Regulatory Authority, and such changes will become effective upon posting or as stated in the notice. (b) Any other changes will become effective upon posting or as stated in the notice, provided that changes that materially and adversely affect User’s rights or obligations will not become effective earlier than fifteen (15) days after posting or the date of the notice. User’s continued use of the Platform following the effective date of any modification constitutes User’s acceptance of such changes. If User does not agree to any modification, User may terminate this Agreement and cease using the Platform prior to the effective date of such modification; provided, however, that User shall remain liable for all amounts due and owing under the Agreement as of the date of such termination. User is responsible for regularly reviewing this Agreement for updates. The then-current terms of this DPA are available at https://agent.askethos.com/ethos-dpa. Order of Precedence. In the event of any conflict or inconsistency between this DPA and the Agreement in respect of the Processing of Personal Data by Ethos as Processor or service provider/contractor on behalf of User, this DPA shall prevail. For clarity, this DPA does not supersede the Ethos Privacy Policy with respect to Processing for which Ethos acts as a controller or business. Notwithstanding the foregoing, to the extent of any conflict or inconsistency between the Standard Contractual Clauses or other cross-border transfer mechanisms incorporated under §11 and Attachment C and any other term of this DPA or the Agreement, the Standard Contractual Clauses (or such other transfer mechanism) shall prevail in respect of the relevant transfer of Personal Data. Governing Law. This DPA shall be governed by the laws specified in the Agreement; provided that, where Personal Data is subject to the UK GDPR or the EU GDPR, the Parties’ obligations under Clauses 17 and 18 of the EU SCCs (and the equivalent provisions of the UK Addendum/IDTA) shall apply in respect of governing law and forum for disputes brought by Data Subjects. Attachment A A. Role of Parties Ethos Role: Processor User Role: Controller B. Description of Transfer Data Subjects: Individuals whose Personal Data is uploaded to, or generated through, the Platform by or on behalf of User, which may include: User’s personnel and contractors; User’s end-users, customers, prospects, and other contacts; Experts (as defined in the Ethos Expert Terms and Conditions); and other Data Subjects identified in the Agreement or in User’s instructions. Subject Matter of Processing: Provision of the Platform and related services described in the Agreement, including identification, evaluation, screening, ranking, matching, and selection of Experts for Projects (where applicable to User’s use case). Duration of Processing: Duration of the Agreement. Nature and Purpose of Processing: Ethos will Process Personal Data for the purposes of providing services to User in accordance with the Agreement and this DPA, including hosting, storage, transmission, retrieval, structuring, analysis, and presentation of Personal Data, and the operation of AI Tools (as described in the Ethos Privacy Policy) on Personal Data to perform the matching, ranking, screening, and selection functions of the Platform. Type of Data: Categories may include, depending on User’s use of the Platform: identifiers (name, email, phone, user ID, IP address); professional/employment information (job title, employer, work history, areas of expertise, billing rate, availability); content submitted to the Platform (messages, files, audio/video); usage and log data; account and authentication data; and outputs generated by AI Tools (e.g., match scores, screening evaluations, ranking signals). Further specifics shall be as agreed in the Agreement. Sensitive Data: User may not give Ethos any sensitive or other similar Personal Data without written approval from Ethos. Where such approval is given, the Parties shall agree the additional safeguards required under Article 9 of the UK GDPR and the EU GDPR (and applicable U.S. state law equivalents) in advance of any such Processing. Frequency of Transfer: Continuous, for the duration of the Agreement. Retention Period: As set forth in §10 of this DPA and the Agreement; aggregated and de-identified data may be retained indefinitely as described in the Ethos Privacy Policy. Sub-processors: As listed at https://agent.askethos.com/ethos-subprocessors and updated from time to time in accordance with §7 of this DPA. The transfers, processing operations, and durations performed by each Sub-processor correspond to the support, hosting, analytics, payment, and integration services described on the Sub-processor Site. Attachment B Technical and Organizational Measures This Attachment B describes the technical and organisational measures implemented by Ethos (the “Processor”) to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR and applicable Data Protection Laws. The Processor may update these measures from time to time, provided that such updates do not materially diminish the overall level of security described herein. 1. Information Security Program The Processor maintains documented information security policies and procedures governing the protection of Personal Data. These are reviewed and updated as needed to reflect material changes to the Processor’s operations, systems, or applicable Data Protection Laws, and responsibility for information security is assigned to designated personnel within the Processor. 2. Access Control The Processor restricts access to Personal Data to authorised personnel who require such access to perform their job functions, applying the principles of least privilege and need-to-know. Access rights are uniquely assigned, reviewed periodically, and revoked promptly upon role change or termination of employment. Access to systems requires individual user credentials, and the use of shared accounts is avoided. Multi-factor authentication is required for remote access and for access to systems processing Personal Data. 3. Authentication and Password Management The Processor enforces password policies that include minimum complexity, length, and rotation requirements, and stores authentication credentials using salted cryptographic hashing. Default vendor credentials are changed prior to deployment. 4. Encryption The Processor encrypts Personal Data in transit over public networks using current industry-standard protocols (e.g., TLS 1.2 or higher) and encrypts Personal Data at rest using industry-standard algorithms (e.g., AES-256). Encryption keys are managed securely and access to keys is restricted. 5. Pseudonymisation and Minimisation Where appropriate and technically feasible, the Processor applies pseudonymisation and data minimisation techniques to reduce the risk to data subjects. 6. Network and System Security The Processor maintains network security controls including firewalls, network segmentation, intrusion detection or prevention systems, and regular vulnerability scanning. Systems are hardened in accordance with industry standards, and security patches are applied in a timely manner based on risk. 7. Physical Security Personal Data is hosted in facilities (including those operated by approved sub-processors) that maintain physical access controls such as secured entry, surveillance, visitor management, and environmental safeguards. Access to data centers is restricted to authorised personnel. 8. Logging and Monitoring The Processor logs access to and activity within systems processing Personal Data, protects logs against tampering and unauthorised access, and monitors systems for anomalous or unauthorised activity. Logs are retained for a defined period consistent with operational and legal requirements. 9. Endpoint and Malware Protection The Processor requires personnel devices used to access Personal Data to use standard operating-system security features, including full-disk encryption, automatic security updates, and built-in malware protection. 10. Business Continuity and Disaster Recovery The Processor maintains backup and disaster-recovery arrangements designed to support the availability and timely restoration of Personal Data following a physical or technical incident. Backups are protected by access controls and encryption, and backup-restore procedures are validated as part of routine engineering operations. 11. Personnel Security and Training All personnel with access to Personal Data are subject to written confidentiality obligations. The Processor provides data-protection and security guidance to such personnel and undertakes background checks where appropriate and permitted by applicable law. 12. Secure Development The Processor follows secure software development practices, including code review, separation of development, testing, and production environments, and testing of changes prior to deployment. 13. Sub-processor Management The Processor imposes data-protection and security obligations on its sub-processors that are no less protective than those set out in this Attachment, and assesses the security practices of sub-processors prior to engagement. 14. Incident Management and Breach Notification The Processor maintains an incident response plan that provides for the detection, investigation, containment, and remediation of security incidents, and for notification to the Controller without undue delay upon becoming aware of a Personal Data Breach, in accordance with the DPA. 15. Data Return and Deletion Upon termination or expiry of the services, the Processor will, at the Controller’s choice, delete or return Personal Data and delete existing copies, except to the extent retention is required by applicable law, in accordance with the DPA. 16. Audit and Assessment The Processor periodically tests, assesses, and evaluates the effectiveness of these technical and organisational measures, and where applicable maintains independent certifications or audit reports (e.g., SOC 2, ISO/IEC 27001) that may be made available to the Controller in accordance with the audit provisions of the DPA. Attachment C Cross-Border Transfer Mechanisms In such event, the Parties shall rely on the following transfer mechanisms (as applicable): (a) EU GDPR transfers. For transfers from User to Ethos that are subject to the EU GDPR and require appropriate safeguards under Chapter V of the EU GDPR, the EU Standard Contractual Clauses set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (controller-to-processor), are incorporated by reference and deemed completed with the information set out in Attachment A. For onward transfers from Ethos to Sub-processors, including affiliated Sub-processors, Ethos shall ensure that the relevant onward transfer is subject to an appropriate transfer mechanism as described in Section 11.3. (b) UK GDPR transfers. For transfers from User to Ethos that are subject to the UK GDPR and require appropriate safeguards under Chapter V of the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner’s Office under section 119A(1) of the Data Protection Act 2018 is incorporated by reference and deemed completed with the information set out in Attachment A. For onward transfers from Ethos to Sub-processors, including affiliated Sub-processors, Ethos shall ensure that the relevant onward transfer is subject to an appropriate transfer mechanism as described in Section 11.3. (c) Swiss FADP transfers. For transfers subject to the Swiss Federal Act on Data Protection (FADP), the EU Standard Contractual Clauses referenced in (a) above apply as amended in accordance with the guidance of the Swiss Federal Data Protection and Information Commissioner (FDPIC), including that references to the EU GDPR are understood as references to the FADP, references to EU member state law are understood as references to Swiss law, the competent supervisory authority is the FDPIC, and data subjects in Switzerland may enforce their rights in Switzerland. (d) Completion of the Clauses. The Clauses referenced above are completed as follows: (i) the optional docking clause in Clause 7 applies; (ii) for purposes of Clause 9, Option 2, general written authorisation applies, and the time period for prior notice of Sub-processor changes is as set out in Section 7 of this DPA; (iii) for purposes of Clause 11, the optional independent dispute resolution body language does not apply; (iv) for purposes of Clause 17, Option 1 applies and the EU SCCs are governed by the laws of Ireland; (v) for purposes of Clause 18(b), the courts of Ireland are the competent courts; (vi) for purposes of Clause 13 and Annex I.C, the competent supervisory authority is the Irish Data Protection Commission for EU GDPR transfers, the Information Commissioner’s Office for UK GDPR transfers under the UK Addendum, and the FDPIC for Swiss FADP transfers; (vii) Annex I.A is completed with the party details set out in this DPA and the Agreement, with User as data exporter and Controller and Ethos as data importer and Processor; (viii) Annex I.B is completed with the description of transfer set out in Attachment A; (ix) Annex II is completed with the technical and organisational measures set out in Attachment B; (x) Annex III is completed by reference to the Sub-processor Site, as updated in accordance with Section 7; and (xi) for the UK Addendum, the information required by Tables 1 to 3 is completed with the information set out in this DPA, Attachment A, Attachment B, and the Sub-processor Site, and Table 4 specifies that neither Party may end the UK Addendum under Section 19 except as permitted by the UK Addendum.