Data Processing Agreement

1. Scope and Background

1. This DPA applies to the processing of personal data carried out by the Processor on behalf of the Customer for the purpose of providing the Services as defined in the Service Agreement.
2. The Customer is the Controller of the personal data, and the Processor acts solely as a Processor in accordance with the Customer’s instructions.
3. This DPA enters into force on the effective date of the Service Agreement and remains in force for as long as the Processor processes personal data on behalf of the Customer, and for any period thereafter as required by law.
4. To the extent the Processor qualifies as a "holder" (מחזיק) of the Customer’s database under the Israeli Privacy Protection (Information Security) Regulations, the Processor will comply directly with the obligations applicable to a holder under those Regulations, including Regulations 2 and 15(a).

2. Definitions

"Personal Data" — information about an identified or identifiable individual, as defined under the Privacy Protection Law.

"Processing" — any operation performed on personal data, including collection, storage, organization, analysis, alteration, retrieval, disclosure, deletion, or destruction.

"Data Subject" — the individual to whom the personal data relates.

"Sub-processor" — a third party engaged by the Processor to process personal data on behalf of the Customer.

"Data Protection Law" — the Israeli Privacy Protection Law, 1981 (including Amendment 13 and its regulations), the GDPR, and any applicable privacy law binding on the parties.

Capitalized terms not defined here have the meaning given in the Service Agreement.

3. Description of Processing

1. The subject matter, purpose, nature of processing, categories of personal data, and categories of data subjects are detailed in Schedule A to this DPA.
2. The Processor shall process personal data solely on the documented instructions of the Customer, including those reflected in the Service Agreement and this DPA.
3. The Processor shall promptly inform the Customer if, in its opinion, an instruction conflicts with applicable Data Protection Law.

4. Processor Obligations

1. The Processor shall process personal data only for the purpose of providing the Services and in accordance with the Customer’s instructions.
2. The Processor shall ensure that any person authorized to process personal data on its behalf is bound by an obligation of confidentiality.
3. The Processor shall implement reasonable and customary information security measures, as detailed in Schedule C to this DPA.
4. The Processor shall, to the extent reasonably possible, assist the Customer in fulfilling its obligations under Data Protection Law, including responding to data subject requests, performing data protection impact assessments (DPIAs), and consulting with the supervisory authority where required.
5. The Processor shall provide the Customer, at least once per year, with a written report on its compliance with this DPA and the applicable provisions of the Privacy Protection (Information Security) Regulations, and shall promptly notify the Customer of any security incident as set forth in Section 8.

5. Information Security

1. The Processor implements technical and organizational security measures appropriate to the sensitivity of the personal data and the risks of its processing, including encryption, access controls, monitoring, hardening, and incident response procedures. Further detail is provided in Schedule C.
2. The Processor shall periodically review and update its security measures in light of technological developments and identified risks.

6. Sub-processors

1. The Customer provides general authorization for the engagement of sub-processors to process personal data on its behalf, provided that the Processor enters into a written agreement with each sub-processor that imposes data-protection obligations no less protective than those set forth in this DPA.
2. The list of sub-processors engaged at the effective date of this DPA is attached as Schedule B. Updates to this list will be communicated to the Customer in accordance with Section 6.3.
3. The Processor shall give the Customer at least 30 days’ prior notice of its intention to engage or replace any material sub-processor. The Customer may object on reasonable grounds related to data protection, and may terminate the Service Agreement if the Processor cannot reasonably address the objection, provided the objection is submitted within 14 days of the notice.

7. Data Subjects and Their Requests

1. The Processor shall, by appropriate technical and organizational measures and to the extent possible, assist the Customer in fulfilling its obligations to respond to data subject requests (including rights of access, correction, deletion, objection, and portability).
2. If the Processor receives a request directly from a data subject, it shall, without undue delay, inform the Customer and shall not respond directly to the request unless expressly instructed by the Customer or required by law.

8. Personal Data Breach

1. In the event of a personal data breach affecting personal data processed for the Customer, the Processor shall notify the Customer without undue delay, and in any event within 72 hours of becoming aware of the breach.
2. The notification shall include, to the extent available: a description of the breach, the categories of data and approximate number of data subjects affected, the likely consequences, the measures taken, and recommendations for mitigating harm.
3. The Processor shall, to the extent possible, assist the Customer in fulfilling its reporting obligations to the Privacy Protection Authority and to data subjects under applicable law.

9. International Data Transfers

1. Some of the Processor’s sub-processors are located outside Israel, including in the United States and the European Union. The Customer authorizes the transfer of personal data to such sub-processors, subject to appropriate safeguards.
2. For transfers subject to the GDPR or similar law, the Processor shall implement Standard Contractual Clauses (SCCs) or another mechanism that constitutes an adequate safeguard under applicable law.

10. Audits and Inspections

1. The Customer is entitled to receive from the Processor reasonable documentation evidencing its compliance with this DPA, including certifications, third-party audit reports (such as SOC 2 or ISO 27001) where available, and information security certificates.
2. Where such documentation is insufficient, and subject to at least 30 days’ prior written notice, the Customer may conduct an audit of the Processor no more than once per year, through an independent auditor that is not a competitor of the Processor, during normal business hours, in a manner that does not disrupt the Processor’s operations, and at the Customer’s sole cost.

11. Return and Deletion of Data

1. Upon termination of the Services, and at the Customer’s election, the Processor shall delete or return the personal data in its possession.
2. Unless the Customer requests otherwise, the Processor shall delete personal data from its active systems within 90 days of termination of the Services, except for data that must be retained by law.
3. Upon completion of the deletion or return, the Processor shall, on the Customer’s written request, confirm in writing that the deletion or return has been carried out.
4. Statutory retention requirements shall override the foregoing.

12. Liability, Term, and Termination

1. This DPA shall remain in effect for as long as the Processor processes personal data on behalf of the Customer. Provisions relating to confidentiality, security, liability, and deletion shall survive termination as required.
2. The parties’ liability under this DPA is subject to the limitation of liability set forth in the Service Agreement, except where such limitation is prohibited by Data Protection Law.

13. Miscellaneous

1. In any conflict between this DPA and the Service Agreement regarding the processing of personal data, this DPA prevails.
2. The Processor may update this DPA from time to time. Updates will be published at figureit.ai/dpa and will take effect 30 days after notice to the Customer, unless an earlier change is required by law.
3. This DPA is governed by the laws of the State of Israel. The competent courts in Tel Aviv-Yafo shall have exclusive jurisdiction.
4. For questions about this DPA: privacy@figureit.ai.

Schedule A — Description of Processing

Subject Matter: Processing of personal data in the course of providing Figureit Services to the Customer under the Service Agreement.

Purpose and Nature: Storage, analysis, AI-powered insight generation, reporting, and forecasting based on Customer Data.

Duration: For the term of the Service Agreement, subject to Section 11 of this DPA (deletion period of up to 90 days).

Categories of Data Subjects: Customer’s employees, advisors, and contractors; Customer’s end customers; suppliers and business contacts whose data the Customer uploads to the Platform.

Categories of Personal Data: Full names, contact details (email, phone, address), roles and employment details, business activity data (sales, purchasing, inventory), Platform interaction data. Sensitive data (health, biometric, payment-card data, etc.) shall not be entered unless expressly agreed in writing.

Nature of Processing: Storage, organization, analysis, computation, application of AI models, presentation through the Platform, backup, and use of anonymized or aggregated non-identifying data for service improvement.

Schedule B — List of Sub-processors

At the effective date of this DPA, the Processor engages the following sub-processors:

• Amazon Web Services (AWS) — cloud infrastructure, storage, and runtime systems. Location: United States / European Union.
• Google Cloud Platform (including BigQuery) — cloud infrastructure, data warehouse, and AI services. Location: United States / European Union / Israel.
• Render — database hosting and infrastructure. Location: United States.
• OpenAI — large language model (LLM) services powering AI capabilities. Location: United States.
• Anthropic (Claude) — large language model (LLM) services powering AI capabilities. Location: United States.
• Additional operational service providers: email, analytics, billing, and customer relationship management (CRM).

Schedule C — Technical and Organizational Measures

The Processor applies reasonable technical and organizational security measures appropriate to the nature of the Services and the level of risk, as implemented in the relevant service environment. These include, among others:

• Encryption: TLS 1.2 or higher in transit; encryption at rest where technically feasible.
• Access Controls: Role-based access control (RBAC), principle of least privilege, and multi-factor authentication for Processor staff.
• Network Security: Infrastructure-level security measures, as implemented in the operating environment.
• Monitoring and Oversight: Secure logging and incident response procedures, as appropriate.
• Vulnerability Management: Periodic security scans and patching, with additional measures (including penetration testing) where implemented.
• Organizational Security: Confidentiality agreements with personnel, security training, and data access procedures.
• Business Continuity: Backup and recovery procedures, in accordance with the service environment.
• Sub-processor Management: Vendor screening, binding DPAs, ongoing oversight.