Data Processing Addendum

Introduction

This Data Processing Addendum (“DPA”) forms part of the Customer Terms between Tauri Pro (“Processor”) and Customer (“Controller”). It applies where Tauri Pro processes personal data on Customer’s behalf in providing the Service and is intended to satisfy Article 28 GDPR, UK GDPR, and equivalent applicable legislation.

Annex A – Processing Details

1. Roles and Instructions

Customer is controller and Tauri Pro is processor for Customer-submitted personal data. Tauri Pro independently acts as controller for registration, billing, account management, and website analytics data. Tauri Pro processes Customer personal data only on documented instructions, as necessary to provide and secure the Service, or as required by law. Tauri Pro may decline an instruction it reasonably believes violates data-protection law while the parties identify a lawful alternative.

2. Customer’s Obligations

• Maintain a valid legal basis for processing and transfers.
• Provide required notices and obtain required consents.
• Keep personal data accurate, current, relevant, and limited.
• Configure access controls and permissions appropriately.
• Submit special-category, criminal-record, or sensitive data only with a lawful basis and required impact assessments.

3. Security Measures

Tauri Pro will maintain measures appropriate to risk, including TLS 1.2 or higher in transit, encryption at rest, role-based access, audit logging, vulnerability management, security testing, backups, business continuity, incident response, confidentiality obligations, and staff training. Customer remains responsible for security incidents resulting from improper configuration of its account, access controls, or User permissions.

4. Sub-processors

Customer grants general authorization for Tauri Pro to use sub-processors listed at tauri.pro/legal/subprocessors. Equivalent data-protection obligations will apply. Tauri Pro will provide at least fourteen (14) days’ advance notice before adding or replacing a sub-processor. Customer may object on reasonable data-protection grounds within that period. Tauri Pro remains responsible for sub-processor acts and omissions, subject to the liability cap in the Terms.

5. International Transfers

For transfers outside the EEA or an equivalent jurisdiction without adequacy status, Tauri Pro will use an approved mechanism, including applicable EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or another legally recognized safeguard. Applicable clauses are incorporated by reference and available on request.

6. AI Features – Additional Terms

When Customer enables AI Features, AI Input Data may be processed by Tauri Pro and listed AI sub-processors solely to generate requested outputs on Customer’s instructions. Tauri Pro will not use Customer AI Input Data to train, fine-tune, or improve an AI model without Customer’s prior written consent. Customer must ensure a lawful basis for AI Input and should not submit special-category data unless permitted by law and this DPA. AI output accuracy is not warranted.

7. Confidentiality

Personnel authorized to process Customer Data are bound by confidentiality obligations, receive appropriate data-protection training, and receive access only on a need-to-know basis.

8. Data Subject Rights and Assistance

Tauri Pro will reasonably assist Customer with access, rectification, erasure, restriction, portability, objection, DPIAs, and supervisory-authority engagement. Tauri Pro will notify Customer within five (5) business days after receiving a request relating to Customer Data and will not respond directly unless instructed or legally required.

9. Retention, Deletion, and Return

Customer Data is retained during the subscription and applicable export period. Accounts are not deleted for inactivity, however long they go without a User login. On termination, Customer may export data during the applicable window. Tauri Pro will then delete or return Customer Data, including sub-processor copies, unless law requires limited continued retention.

10. Personal-Data Breach Notification

Tauri Pro will notify Customer without undue delay and, where practicable, within forty-eight (48) hours after confirming a qualifying personal-data breach affecting Customer Data. Available information will include the breach nature, affected categories and approximate scale, contact information, likely consequences, and mitigation measures. Customer is responsible for determining and making legally required notifications to authorities and data subjects.

11. Audit and Compliance Information

Tauri Pro will provide information reasonably necessary to demonstrate compliance. Customer may conduct one audit per calendar year on at least thirty (30) days’ written notice, during normal business hours, with minimal disruption and confidentiality protections. Tauri Pro may provide an appropriate independent audit report in place of a bespoke audit unless Customer documents a specific unmet concern. Customer bears its audit costs and reasonable excess facilitation costs.

12. Governing Law

This DPA is governed by the same law as the Customer Terms. If this DPA conflicts with the Terms, this DPA controls for data-protection matters.

13. Contact

Data-protection queries should be sent to office@tauri.pro. Controller identity, location, and supervisory-authority details are stated in the Privacy Policy.