Data Processing Addendum

1. Scope and application

This Data Processing Addendum ("DPA") supplements the Intended Terms of Service and applies when Intended, Inc. ("Intended", "Processor") processes personal data on behalf of the Customer ("Controller") in connection with the Authority Runtime Services. This DPA applies to all personal data processed through the Services, including intent metadata, authority decision records, escalation data, and account information. In the event of conflict between this DPA and the Terms of Service, this DPA prevails with respect to data protection matters.

2. Definitions

• "Personal Data" — any information relating to an identified or identifiable natural person processed through the Services
• "Processing" — any operation performed on Personal Data, including collection, storage, evaluation (risk scoring), token issuance, and deletion
• "Sub-processor" — a third-party entity engaged by Intended to process Personal Data on behalf of the Controller
• "Authority Decision Data" — intent metadata, risk evaluations, policy outcomes, token claims, and audit records generated during authority evaluation
• "Security Incident" — a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of Personal Data
• "Standard Contractual Clauses" or "SCCs" — the standard contractual clauses approved by the European Commission for the transfer of personal data to third countries
• "UK Addendum" — the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner's Office

3. Processor obligations

• Process Personal Data only on documented instructions from the Controller (as configured through policies and platform settings)
• Ensure that persons authorized to process Personal Data have committed to confidentiality obligations
• Implement and maintain technical and organizational security measures as described in Section 5 and the TOMs Appendix
• Engage sub-processors only with prior notice and under equivalent data protection obligations, in accordance with Section 6
• Assist the Controller in responding to data subject requests (access, correction, deletion, portability) within the timeframes required by applicable law
• Assist the Controller in ensuring compliance with security, breach notification, and data protection impact assessment obligations
• Cooperate with the Controller in conducting data protection impact assessments (DPIAs) where required under GDPR Article 35
• Delete or return all Personal Data upon termination of Services, subject to legal retention requirements
• Make available all information necessary to demonstrate compliance and allow for audits
• Maintain a record of processing activities carried out on behalf of the Controller in accordance with GDPR Article 30(2)

4. Categories of data processed

5. Security measures

• Encryption at rest: AES-256-GCM for all sensitive data and signing keys
• Encryption in transit: TLS 1.3 for all API, database, and cache connections
• Per-tenant isolation: Database-scoped queries (application + Postgres row-level security), separate Ed25519 signing key pairs
• Access control: Role-based access (4 runtime roles, 24 permissions) enforced at middleware level
• Audit integrity: SHA-256 hash-chained ledger with tamper detection
• Key management: Automated key rotation lifecycle (ACTIVE → PREVIOUS → RETIRED)
• Nonce protection: Single-use nonces consumed on first verification
• Infrastructure: AWS with VPC isolation, security groups, and encrypted storage volumes
• Monitoring: CloudWatch alarms, CloudTrail logging, and automated anomaly detection
• Fail-closed architecture: Unresolvable evaluations result in denial, not bypass

6. Sub-processors

Intended maintains a current, authoritative list of sub-processors at intended.so/legal/subprocessors. The Controller will be notified at least thirty (30) days in advance of any new sub-processor engagement or material change to an existing sub-processor. The Controller may object to a new sub-processor within twenty (20) days of notification by providing written notice to dpa@intended.so with a reasonable basis for the objection. If the Controller objects and Intended cannot reasonably accommodate the objection, either party may terminate the affected Services upon thirty (30) days written notice, with a pro-rata refund of prepaid fees for the affected Services. Enterprise customers may negotiate a longer advance-notice period (e.g., sixty (60) days) in their Order Form or enterprise agreement, which will take precedence over this standard period.

7. Security incident notification

Intended will notify the Controller of a confirmed Security Incident in accordance with the following timelines:

• GDPR: Notification without undue delay, and no later than 72 hours after becoming aware of a breach likely to result in a risk to the rights and freedoms of natural persons
• Other jurisdictions: Notification without undue delay, and in compliance with applicable breach notification laws
• Notification will include: nature of the incident, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed
• Intended will cooperate with the Controller's investigation and provide ongoing updates until the incident is resolved
• Intended maintains an incident response plan with defined roles, communication procedures, and remediation protocols
• Intended will document all Security Incidents, including those that do not trigger notification obligations, and make records available to the Controller upon request

8. International data transfers

Intended processes data in the United States. For transfers of personal data from jurisdictions with transfer restrictions, Intended provides the following safeguards:

• European Economic Area (EEA): Intended relies on the Standard Contractual Clauses (SCCs) as approved by the European Commission (Implementing Decision (EU) 2021/914) for transfers of personal data from the EEA to the United States. The SCCs are incorporated by reference into this DPA as Module Two (Controller to Processor)
• United Kingdom: For transfers of personal data from the UK, Intended relies on the UK International Data Transfer Addendum (UK IDTA), Version B1.0, Module Two (Controller to Processor), as issued by the UK Information Commissioner's Office under Section 119A of the UK Data Protection Act 2018. The UK IDTA supplements the SCCs with UK-specific safeguards and is incorporated by reference into this DPA.
• Switzerland: Intended relies on the SCCs as recognized under the Swiss Federal Act on Data Protection (FADP / nDSG), with the modifications required by the Swiss Federal Data Protection and Information Commissioner (FDPIC) for transfers from Switzerland
• Supplementary measures include encryption at rest and in transit, per-tenant isolation, access controls, and fail-closed architecture as described in Section 5
• Enterprise customers requiring data residency in specific regions should contact Intended to discuss deployment options

9. Schrems II supplementary measures

In addition to Standard Contractual Clauses (SCCs) and UK IDTA, Intended implements the following supplementary technical and organizational measures to address post-Schrems II requirements:

• Encryption and Key Management: Personal data encrypted at rest (AES-256-GCM) and in transit (TLS 1.3). Encryption keys managed per-tenant. Master keys derived from tenant-controlled key material where technically feasible. US government authorities cannot decrypt data without Intended's cooperation.
• Data Isolation: Per-tenant isolation prevents aggregation of EU data with other customer data, limiting exposure in government requests.
• Fail-Closed Architecture: Unresolvable authority evaluations result in denial, not approval, preventing over-inclusive government access.
• Government Access Notification: Intended will notify Controller of any legal demand (subpoena, FISA order, NSL) requiring disclosure of personal data, unless Intended is legally prohibited. Notification will be sent to the Controller's designated contact without undue delay after receipt, and within any shorter period specified in the applicable Order Form, unless Intended is legally prohibited from doing so.
• Transparency Reporting: Intended publishes annual transparency report detailing number of government access requests, jurisdiction, and Controller's response (aggregate, non-identifying).
• Objection and Termination Rights: Controller may object to processing upon government access demand. If Intended cannot accommodate objection, either party may terminate affected Services without penalty.
• These measures do not eliminate risk of compelled US government access but substantially reduce risk and provide Controller with remedies and visibility.

10. Model training and product improvement

Intended does not send Personal Data or Authority Decision Data to any third-party AI provider, and sub-processors shall NOT use Personal Data or Authority Decision Data to train, fine-tune, or improve their models (Section 12). Where the Controller connects its own AI provider key, that provider's use of the data is governed by the Controller's own agreement with it. Intended uses Personal Data and Authority Decision Data to train or improve its own models, rules or systems only as described under Product improvement below, or with the Controller's explicit prior written consent.

By default, authority decisions for the Controller's agents are made by deterministic rules, the Controller's policies and its people; no AI model makes, scores or influences them unless the Controller turns on an optional AI feature. Optional AI features are disabled by default and are enabled only by the Controller (Settings → Privacy & AI). The Controller may block all such processing for its tenant at any time.

11. Data protection impact assessments

Intended will provide reasonable cooperation and assistance to the Controller in conducting data protection impact assessments (DPIAs) where required under GDPR Article 35 or equivalent provisions of other applicable data protection laws. Intended will provide information about its processing activities, technical and organizational measures, and sub-processors as needed for the Controller to complete its assessment. Requests for DPIA cooperation should be directed to dpa@intended.so.

12. Sub-processor obligations

Each sub-processor engaged by Intended shall implement obligations substantially equivalent to this DPA, including but not limited to:

• Process Personal Data only on documented instructions from Intended (which, in turn, follows Controller instructions).
• Implement and maintain technical and organizational security measures per Section 5 (Appendix TOMs).
• Notify Intended of any Security Incident within 24 hours of discovery.
• Assist with data subject access, deletion, correction, and portability requests within timeframes specified in Section 13.
• Delete or return Personal Data upon termination, except where legal retention applies.
• Submit to audits and provide compliance documentation to Intended (which Intended may share with Controller under NDA).
• Not engage further sub-processors without prior written approval from Intended.
• Implement the same prohibition on model training per Section 10.
• Intended shall ensure all sub-processor agreements are executed before engagement and shall provide evidence of compliance upon request.

13. Data subject rights assistance

Assist the Controller in responding to data subject requests in accordance with the following timelines and procedures:

• Requests for Access (GDPR Art. 15, CCPA §1798.100): Extract all personal data held for the data subject in machine-readable format (CSV, JSON) within 10 business days of request. Provide all authority decisions, audit records, outcome reports, and account data.
• Requests for Deletion (GDPR Art. 17, CCPA §1798.105): Delete all personal data associated with data subject within 10 business days, except where legal retention (SOX 7-year, GDPR Art. 17(3)) or ongoing disputes require retention. Notify Controller if deletion is not fully possible and explain legal basis for retention.
• Requests for Correction (GDPR Art. 16, CCPA §1798.106): Correct factual inaccuracies in account data (name, email) within 5 business days. For authority decision data, correction may not be technically possible (hash-chained, tamper-evident audit ledger); in that case, Intended will flag the record as disputed and provide attestation of the error.
• Requests for Portability (GDPR Art. 20): Provide all personal data and authority decision records in structured, machine-readable format (CSV, JSON, XML) within 10 business days, suitable for import to another processor.
• Requests for Objection (GDPR Art. 21): Upon Controller's instruction that data subject has objected to processing, Intended will cease processing that data subject's data within 5 business days, except where legal basis for continued processing applies.
• Cost: Routine requests (up to 5 per calendar year per data subject) are included in Services fees. Requests in excess of 5 per data subject per year are subject to professional services fees at Intended's standard rate as specified in the applicable Order Form or quoted on request; contact dpa@intended.so for the current rate.
• Procedure: Data subject rights requests should be submitted to dpa@intended.so with sufficient information to identify the data subject and the requested action. Intended will acknowledge receipt within 2 business days and provide progress updates every 5 business days if response exceeds 10 business days.

14. Limitation of liability for DPA breaches

Intended's liability for DPA breach is governed by the Terms of Service Section 14 (Limitation of Liability) and the liability cap specified in any MSA. Specifically:

• Intended's aggregate liability for data protection claims (breach of confidentiality, failure to implement security measures per §5, unauthorized access) shall not exceed the liability cap set out in the Terms of Service Section 14 or the amount specified in the applicable MSA or Order Form, whichever is lower.
• Intended is not liable for losses arising from Controller's use of personal data or authority decisions (e.g., customer's own discriminatory use of Intended's risk scores) if Intended has complied with §3 (instructions) and §5 (security measures).
• Intended is not liable for sub-processor breaches unless Intended failed to exercise reasonable oversight of the sub-processor or failed to flow down equivalent DPA obligations per Section 6.
• Carve-outs from liability cap: Gross negligence, willful misconduct, breach of confidentiality (Section 3), IP indemnification (Terms §16A), and Intended's payment obligations.

15. Supervisory authority cooperation

Intended will cooperate with EU/EEA DPAs, UK ICO, Swiss FDPIC, and other supervisory authorities in investigations concerning Personal Data processing, including:

• Responding to information requests and interrogatories within statutory timeframes (typically 30 days).
• Providing copies of relevant processing records, security policies, incident reports, and compliance documentation.
• Allowing DPA representatives to conduct on-site inspections of facilities and systems processing personal data (with reasonable notice, no more than once per year absent ongoing investigation).
• Notifying Controller of any DPA investigation, audit, or enforcement action concerning Controller's data without undue delay following Intended's receipt of notice, and within any shorter period specified in the applicable Order Form, unless legally prohibited.
• Cooperating in remediation of any finding and providing evidence of remediation to DPA.
• Intended will not disclose Controller's confidential information to DPA without reasonable notice to Controller, except where required by law.

16. AI Act compliance confirmation

Intended confirms the following regarding Personal Data and AI processing:

• Personal Data and Authority Decision Data are used to train or improve AI systems only as described in Section 10 (de-identified product improvement, subject to the Controller's contribution settings) or with explicit prior written Controller consent.
• Intended complies with EU AI Act (Regulation 2024/1689), Articles 4–7 (prohibited practices), Articles 8–15 (high-risk AI), and Articles 51–55 (GPAI deployer obligations), to the extent Personal Data is processed in connection with AI.
• Intended maintains documentation of processing and AI safeguards required by AI Act Article 13(3) and Article 5(2)(a) and will provide to Controller upon request.
• Intended will give at least 90 days' advance notice, with a right to object under Section 6, before any change that sends Personal Data or Authority Decision Data to a new recipient (a new AI provider or any new sub-processor) or changes where it is processed or transferred. Improvements to models and pipelines that Intended hosts itself, operating within the published Tier 0, Tier 1 and Tier 2 contribution settings (Section 10), are expressly exempt.
• Controller remains responsible for compliance with AI Act Articles 6(1)–(2) (high-risk AI assessment and conformity) and Article 22 (GDPR right to human review when AI makes decisions about natural persons).

17. Data retention and deletion

• Authority decision data is retained according to the Controller's plan tier (Free 30 days, Platform 1 year, Enterprise custom up to 7 years; 7 years if no custom window is set), enforced by a daily deletion job
• If a legal hold is active for the Controller's tenant, no data is deleted while the hold is in place
• Account data is retained for the duration of the active agreement plus 30 days for export
• Upon termination, Intended will delete or return Personal Data within 30 days, except where retention is required by law
• Audit records subject to regulatory retention requirements (e.g., SOX 7-year) are retained on encrypted, versioned storage with deletion protection for the applicable retention period; immutable WORM storage (S3 Object Lock, Compliance mode), which blocks deletion before the retention period expires, is on the enterprise roadmap and available for dedicated deployments
• The Controller may request certification of deletion upon completion of the deletion process

18. Audits and compliance

The Controller may audit Intended's compliance with this DPA once per year with 30 days written notice. Audits will be conducted during business hours and will not unreasonably interfere with operations. Intended has scoped an independent third-party penetration test and is engaging a qualified security firm; independent testing runs on at least an annual cadence thereafter. Intended will provide available compliance documentation upon request under NDA, including SOC 2 reports and penetration-test summaries once the respective audit and first assessment are complete. Enterprise customers may request additional compliance documentation through their account team. Intended will maintain a record of processing activities in accordance with GDPR Article 30(2) and make it available to the Controller and supervisory authorities upon request.

19. Duration and termination

This DPA remains in effect for the duration of the Services agreement. Obligations regarding data deletion, retention, confidentiality, and cooperation with data protection authorities survive termination. In the event of conflict between this DPA and the Terms of Service, this DPA prevails with respect to data protection matters.

20. Data processing jurisdiction

• Primary processing location: United States (AWS us-east-1)
• Data may be processed in AWS regions selected by Customer for Enterprise deployments
• International transfers are governed by Standard Contractual Clauses (SCCs) for EEA/UK transfers, as described in Section 8
• Sub-processor list is maintained and updated with thirty (30) days advance notice in accordance with Section 6

21. Contact

For DPA-related inquiries, data protection officer contact, or to request a signed copy: dpa@intended.so or legal@intended.so. For EU-specific data protection inquiries: eu-privacy@intended.so.

Appendix: Technical and organizational measures (TOMs)

The following technical and organizational measures are implemented by Intended to protect personal data processed under this DPA: