Data Processing Addendum (US Service-Provider Terms)
This DPA is incorporated into the Contextuar Platform Access Agreement ("Agreement"). Capitalized terms not defined here have the meanings in the Agreement.
1) Scope
This DPA applies when a Customer uses Contextuar to process Customer Personal Information ("CPI"). Parties agree this DPA reflects US service provider/contractor terms under applicable state privacy laws (e.g., CPRA, CO/CT/VA/UT/TX, etc.). It is not a GDPR addendum; an EU/UK annex may be added if Customer processes EU/UK data.
2) Roles & Instructions
Customer is the business/controller and gives documented instructions via the Agreement, this DPA, the Services UI, and written requests.
Contextuar is Customer's service provider/processor and will process CPI only per Customer's instructions and this DPA.
3) Nature, Purpose, Duration, Types of Data
Nature/Purpose: Provide, secure, maintain, and improve the Services: email ingestion and analysis, AI-generated suggestions and classifications, AI agent execution of Customer-approved actions in connected systems, workspaces, tasking, file storage/sharing, search, and analytics for service operations. Contextuar does not use CPI to train AI models.
Data Types: Email addresses, names, headers/metadata, message content/attachments (as enabled by Customer), business context configured by Customer (e.g., customers, vendors, projects), user account/profile data, audit logs, and derived data (e.g., classifications, suggestions, and agent outputs).
Data Subjects: Customer end users, Customer personnel, and individuals referenced in email/content.
Duration: Term of the Agreement plus deletion period in §10.
4) Service-Provider/Contractor Certification (CPRA-style)
Contextuar:
a) Does not sell or share CPI for cross-context behavioral advertising;
b) Uses CPI only for permitted business purposes and to provide the Services;
c) Will not combine CPI with personal info from other sources except as permitted for service operations or as instructed by Customer;
d) Ensures any sub-processors provide the same level of protection and use limits;
e) Notifies Customer if Contextuar determines it can no longer meet these obligations;
f) Does not use CPI to train AI models, and contractually requires its AI service subprocessors to refrain from using CPI to train their models.
5) Confidentiality
Contextuar ensures personnel accessing CPI are under confidentiality obligations and trained in security/privacy; access is least-privilege and logged.
6) Security (TOMs)
Contextuar maintains appropriate technical and organizational measures described in Annex A (encryption in transit/at rest, IAM, logging/monitoring, vulnerability mgmt, BCP/DR, secure SDLC, etc.). Upon request, Contextuar will provide a security whitepaper and, if available, a SOC 2 Type II report under NDA. (Customers may request a copy of the current SOC 2 audit by emailing security@contextuar.com.)
7) Sub-processors
Customer authorizes Contextuar to use sub-processors listed on the Contextuar Subprocessors page (the "Subprocessor Page"). Contextuar will:
a) Flow-down materially equivalent obligations;
b) Post updates to the Subprocessor Page and provide advance notice (target 10 business days) before materially new sub-processors begin processing CPI;
c) Allow Customer to object for reasonable data-protection grounds; if unresolved, parties will work in good faith to modify processing; if not feasible, Customer may suspend the affected feature or terminate the impacted order with a pro-rated refund.
8) Assistance (DSRs, Security, Assessments)
Contextuar will reasonably assist Customer with:
Data Subject Requests (access, deletion, correction, portability) as directed by Customer, via product features or Support. Target response: within 15 business days of Customer request.
Security obligations (e.g., incident information, TOMs, responses to reasonable security questionnaires).
Data Protection Assessments required by state laws (where applicable to Customer).
9) Security Incidents
Contextuar will notify Customer without undue delay and no later than 48 hours after confirmation of a Security Incident involving CPI. Notice will include known facts, scope, likely impact, and mitigation. Contextuar will cooperate with Customer's investigation and notifications. (See also your Incident Response Plan and state breach laws.)
10) Return & Deletion
Upon termination/expiration or on Customer request, Contextuar will return or delete CPI. Unless legally required to retain, Contextuar will delete remaining copies (including backups) within 90 days. Deletion certificates are available upon request.
11) Audits & Information Rights
Contextuar will make available information reasonably necessary to demonstrate compliance (e.g., whitepaper, SOC 2 report under NDA, pen-test summary). If additional verification is required, Customer may conduct a scoped audit no more than once in 12 months (or following a material incident), on 30 days' notice, during business hours, subject to confidentiality and a mutually agreed scope; Customer bears its audit costs.
12) Government & Law-Enforcement Requests
Contextuar will disclose CPI only pursuant to valid legal process and will notify Customer (where lawful) before disclosure, and challenge overbroad or unlawful requests. (See the Law-Enforcement Request Policy for the specific legal instrument requirements and detailed notification procedures.)
13) Data Location & Transfers
Contextuar hosts and processes CPI in the United States, with one exception: for Customers whose agent integrations use workflow orchestration, data required to execute approved agent actions is processed by our subprocessor n8n GmbH on Microsoft Azure infrastructure in Germany (EU), as disclosed on the Subprocessors page. These workflows are configured so that execution data is not retained after completion. If Customer later requires additional cross-border transfer safeguards (e.g., SCCs/UK addendum), the parties will implement them in an addendum.
14) Precedence & Changes
If there's a conflict between this DPA and the Agreement, this DPA controls for CPI processing. Contextuar may update this DPA to reflect legal or operational changes; material changes will be posted with advance notice.
Contact for privacy/security: privacy@contextuar.com (or) security@contextuar.com