Data Processing Addendum

1. 1. Definitions and Roles

"Applicable Data Protection Law" means all laws relating to privacy and the processing of personal data that apply to the processing under this DPA, which may include the GDPR, UK GDPR, and U.S. state privacy laws. "Customer Personal Data" means personal data processed by AI Franchises on behalf of Customer through the Service, including data about Customer's own customers and leads.

With respect to Customer Personal Data, Customer is the controller (or business) and AI Franchises is the processor (or service provider).

2. 2. Scope and Instructions

AI Franchises will process Customer Personal Data only on Customer's documented instructions, including those given through the Service's configuration and settings, and as necessary to provide the Service, unless required otherwise by law. AI Franchises will inform Customer if it believes an instruction violates Applicable Data Protection Law.

AI Franchises will not sell or share Customer Personal Data, retain, use, or disclose it for any purpose other than providing the Service, or combine it with other data except as permitted by Applicable Data Protection Law.

3. 3. Details of Processing

Subject matter and purpose: operating Customer's franchise, including marketing, sales, checkout, invoicing, support, and fulfilment. Categories of data subjects: Customer's customers, prospects, and authorized users. Categories of data: contact details, communications, order and transaction information, and usage data. Duration: the term of the Terms of Service plus any retention period described in this DPA.

4. 4. Confidentiality and Security

AI Franchises will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations. AI Franchises will implement appropriate technical and organizational measures to protect Customer Personal Data, including encryption in transit and at rest, access controls based on least privilege, logging and monitoring, and regular security assessments.

5. 5. Sub-processors

Customer grants general authorization for AI Franchises to engage service providers who help us operate the Service as sub-processors. AI Franchises will impose data protection obligations on each sub-processor that are no less protective than those in this DPA and will remain responsible for their performance. AI Franchises will provide notice of new sub-processors, and Customer may object on reasonable data protection grounds.

6. 6. Data Subject Requests and Assistance

Taking into account the nature of the processing, AI Franchises will provide reasonable assistance to Customer in responding to requests from data subjects to exercise their rights, and in conducting data protection impact assessments and consultations with supervisory authorities where required.

7. 7. Personal Data Breaches

AI Franchises will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include available information reasonably required for Customer to meet its own obligations, and AI Franchises will take reasonable steps to contain and remediate the breach.

8. 8. International Transfers

Where Customer Personal Data is transferred to a country that has not been recognized as providing adequate protection, the parties agree that the applicable standard contractual clauses are incorporated by reference, or that another lawful transfer mechanism will apply.

9. 9. Audits

Upon reasonable written request, and no more than once per year unless required by a supervisory authority or following a breach, AI Franchises will make available information reasonably necessary to demonstrate compliance with this DPA, which may include security documentation and responses to questionnaires, subject to confidentiality obligations.

10. 10. Return, Deletion, and Contact

Upon termination of the Service, AI Franchises will, at Customer's choice, return or delete Customer Personal Data within a reasonable period, unless retention is required by law. Customer may export its data through the Service prior to termination.

In the event of conflict between this DPA and the Terms of Service regarding the processing of Customer Personal Data, this DPA will control. Questions regarding this DPA may be sent to legal@aifranchises.ai.