Data Processing Addendum

This Data Processing Addendum (DPA) applies when incorporated by reference or executed as part of a written agreement between Vizavi AI Inc. (Vizavi) and the identified business customer (Customer). Viewing this page or accepting a cookie notice does not execute the DPA. Contact legal@vizavi.ai to incorporate it and establish the applicable processing schedule before covered processing begins.

This DPA governs personal data processed by Vizavi on behalf of Customer (Customer Personal Data). Customer acts as controller or, where applicable, a processor authorized by its controller; Vizavi acts as processor or subprocessor accordingly. Independent processing for Vizavi’s own account, billing or security purposes is governed by applicable law and its Privacy Policy, and cannot be used to circumvent this DPA.

Applicable Data Protection Law means privacy and data-protection law applicable to the covered processing, including the GDPR, UK GDPR and applicable United States state privacy laws where relevant. This DPA prevails over conflicting general terms for covered processing; mandatory transfer clauses prevail where they apply.

Vizavi will process Customer Personal Data only on Customer’s documented lawful instructions, including the agreement, agreed schedule and authorized use of configured features, unless required by law. If legally permitted, Vizavi will inform Customer of that legal requirement before the processing. Vizavi will inform Customer if it considers an instruction to infringe applicable data-protection law and may suspend the affected processing while the parties resolve it.

Customer is responsible for the lawfulness of its purposes and instructions, the accuracy and minimization of data supplied, necessary notices and legal grounds, and the authority of users configuring integrations, recordings, access and actions. Customer will not instruct processing outside an agreed deployment’s permitted scope or provide specially regulated data without the required agreement and safeguards.

Customer’s instructions do not authorize the sale of Customer Personal Data, its use for third-party advertising or the training of generalized models. Any additional purpose requires a separate lawful, specific agreement and cannot override restrictions attached to source data.

Vizavi will limit access to authorized personnel who need it for the agreed purposes and are bound by confidentiality obligations or an appropriate statutory duty. Access will be limited according to role and operational need and withdrawn when no longer authorized. Additional restrictions, including Google-data human-access restrictions, remain applicable.

Taking account of the nature, scope, context and purposes of processing, available technology, implementation costs and risks to individuals, Vizavi will implement appropriate technical and organizational safeguards under applicable law. The agreed security schedule will identify the measures applicable to the deployment and any customer responsibilities.

The security baseline in Appendix B is a contractual requirement for a covered deployment, not a claim that every available product configuration holds a particular certification. Changes must not materially reduce the agreed protection during the term. Customer must appropriately configure its own accounts, source permissions, endpoints and recipient access.

Before processing begins, Customer and Vizavi will identify the authorized subprocessors in the deployment’s provider schedule. Subject to that schedule and any specific-authorization terms, Customer grants general written authorization for changes following the process below. The public provider directory alone is not approval of every supported vendor.

Vizavi will give Customer at least 30 days' advance written notice of a new or replacement subprocessor, including its identity, function and processing locations. Customer may object on reasonable, documented data-protection grounds within that period. The parties will seek a reasonable alternative or mitigation before the new subprocessor receives the affected data. If no reasonable solution is available, either party may terminate the affected service without penalty for that termination; Vizavi will refund prepaid unused fees for the terminated portion.

Vizavi will impose written data-protection obligations on subprocessors appropriate to their processing and no less protective in substance than the relevant obligations here, and remains responsible for their performance to the extent required by law and the agreement. A subprocessor cannot be used to bypass an agreed training prohibition or transfer restriction.

The processing schedule will identify relevant locations and transfers. Before a restricted transfer occurs, the parties will establish the applicable valid transfer mechanism and any necessary supplementary measures. A US address, a provider brand or acceptance of these general terms is not itself a transfer mechanism.

Where required, the parties must execute or validly incorporate the applicable EU Standard Contractual Clauses with the correct module, completed annexes and selections, and any required UK Addendum or other valid instrument. This DPA does not deem uncompleted transfer instruments executed. Vizavi will provide reasonable information to support Customer’s transfer assessment and notify Customer where it can no longer comply with the agreed safeguard. The affected transfer must then be suspended or otherwise made lawful.

Taking account of the processing and information available, Vizavi will reasonably assist Customer with rights requests, security obligations, impact assessments and consultations required by law. Unless legally required or authorized by Customer, Vizavi will not independently respond to a request concerning Customer-controlled content beyond acknowledging it and directing it to Customer.

Vizavi will notify Customer without undue delay of a relevant request received directly. Customer remains responsible for determining the lawful response. Assistance must protect other customers' data and credentials. Any agreed reasonable charge for exceptional assistance must not prevent statutory compliance or apply to remediation of Vizavi’s own breach.

Vizavi will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data and provide available information about its nature, affected data and individuals where known, likely consequences, mitigation and a contact point. Information may be provided in phases as the investigation develops.

Vizavi will take reasonable steps to contain and remediate the breach, preserve relevant evidence and cooperate with Customer’s lawful notification obligations. Notification is not an admission of liability. An unsuccessful attack without compromise is not automatically a personal data breach, but must still be addressed through appropriate security processes. Customer decides notifications to individuals or authorities unless law requires Vizavi to act directly.

Vizavi will make available information reasonably necessary to demonstrate compliance with this DPA and allow and contribute to legally required audits or inspections by Customer or a qualified independent auditor bound by confidentiality. Existing reports and documentation may be used first where sufficient.

Routine audits should use reasonable advance notice, business hours and measures to avoid disruption or exposure of other customers' data or security secrets. Frequency and cost arrangements must not prevent an audit required by law, a competent authority or a credible material incident. Customer will promptly share relevant findings so corrective action can be addressed.

At the end of covered services, or on a lawful documented instruction, Vizavi will, at Customer’s choice, return or delete Customer Personal Data and delete existing copies, unless applicable law requires retention. The agreed schedule will specify operational deletion and backup lifecycles. Customer should choose return before irreversible deletion where it needs an export.

Deletion scope includes covered source content and related derived representations in active stores and instructed subprocessor copies. Residual backups remain restricted and expire under the agreed lifecycle; if restored, prior deletion instructions must be reapplied before ordinary use. Any legally retained data is isolated to the required purpose. On request, Vizavi will provide appropriate confirmation and identify remaining lawful retention.

This DPA continues for as long as Vizavi retains Customer Personal Data subject to it. The agreement’s liability rules apply only to the extent lawful and cannot reduce a data subject’s rights, mandatory transfer-clause obligations or regulatory powers.

Where applicable state law treats Vizavi as a service provider or contractor for covered data, Vizavi will process it only for the specified business purposes and permitted uses; will not sell or share it for cross-context behavioral advertising; and will not retain, use or disclose it outside those purposes or the direct business relationship except as permitted by law. Combining it with other data is prohibited except where applicable law permits it for the contracted purpose.

Vizavi will provide the legally required level of privacy protection, notify Customer if it determines it can no longer meet its obligations, and permit reasonable steps to verify compliance and stop and remediate unauthorized use. Vizavi understands and will comply with these restrictions. Customer retains responsibility for its own disclosures and lawful instructions.

The executed agreement identifies Customer, authorized contacts, the applicable services, term and instructions. The following description applies only to features enabled under that agreement and must be supplemented with deployment-specific providers, locations, retention periods and any required transfer annexes before processing begins.

The security schedule for an agreed deployment must address the following controls proportionately to risk. Specific implementations, exceptions and responsibilities must be documented; marketing labels are not substitutes for the schedule.

• Authorized access, least privilege, tenant isolation, source-permission enforcement and timely access revocation.
• Protected transport, appropriate stored-data protection, credential and key management, and secure administrative access.
• Logging and monitoring with data minimization, incident handling, vulnerability management and controlled changes.
• Availability, recovery testing, backup access restrictions, retention and deletion propagation to derived stores and providers.
• Personnel confidentiality, appropriate training, provider due diligence, rights-request handling and periodic verification of safeguards.