Data Processing Addendum

1. Scope and Applicability

This Data Processing Addendum (“DPA”) applies to the processing of Personal Data by Chemanta (“Processor”) on behalf of the User (“Controller”) in the course of providing the Chemanta Safety Intelligence Service. This DPA is incorporated into and forms part of the Terms of Service.

2. Roles and Responsibilities

The parties acknowledge that the User is the **Data Controller** of the Personal Data and Chemanta is the **Data Processor**. Chemanta shall process data only upon the documented instructions of the Controller and for the sole purpose of providing chemical safety automation services.

3. Technical and Organizational Measures

Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including but not limited to:

• **Encryption:** Data encryption in transit (TLS 1.2+) and at rest (AES-256).
• **Access Control:** Strict internal access protocols to production environments.
• **Resilience:** Regular backups and disaster recovery procedures for the production database infrastructure.

4. Sub-processing

Controller grants a general authorization to Processor to engage sub-processors (e.g., MongoDB, Paddle, and AI document-processing sub-processors including Google Gemini, OpenAI, DeepSeek, and DeepInfra) for the delivery of the Service. Processor ensures that all sub-processors are bound by data protection obligations at least as stringent as those in this DPA.

5. Data Subject Rights

Processor shall, to the extent legally permitted, assist Controller by appropriate technical measures for the fulfillment of Controller’s obligation to respond to requests for exercising Data Subject rights (access, erasure, or rectification) under applicable data protection laws.

6. Audit and Deletion

Upon termination of the Agreement, Processor shall, at the choice of Controller, delete or return all Personal Data, unless local law requires continued storage. Processor shall make available to Controller information necessary to demonstrate compliance with these obligations.