Data Processing Agreement

This agreement is part of the Terms of Service between Unbox AI AB(“Unbox”, the processor) and the customer (the controller). It applies when Unbox processes personal data for the customer under the Terms, as defined in the EU General Data Protection Regulation (GDPR). Where it differs from the Terms on data protection, this agreement wins.

• Subject matter and purpose: ranking, search and recommendation for the customer with BehaviorGPT, and the portal's apps and insights, as the customer uses the Services, and developing and improving Unbox's services, including its models.
• Nature: receiving, storing, ranking from and deleting the data.
• Duration: while the customer's account is open, until the data is deleted.
• Data subjects: the customer's users, such as visitors to its sites and apps.
• Personal data: pseudonymous user ids (such as the tracking cookie's random id), searches, views, orders and the items and pages involved, times and time zones, and, if the customer sends them, market, gender and age group. The customer does not send special category data.

Unbox will:

• process the data only on the customer's documented instructions, unless the law requires otherwise, and tell the customer if it thinks an instruction breaks the law. The customer's instructions are the Terms, its use and settings of the Services, and to process the data to provide, secure, develop and improve Unbox's services, including its models, and to aggregate or anonymize it;
• make sure those who process it are bound to confidentiality;
• keep appropriate technical and organizational security measures (GDPR art. 32);
• help the customer, as far as it reasonably can, to answer data subjects' requests and to meet its obligations on security, breach notification and impact assessments;
• tell the customer without undue delay after it becomes aware of a personal data breach;
• delete the data when the customer deletes it or closes its account, or return it if the customer asks before then, unless the law requires it to be kept. Aggregated or anonymized data is not personal data and is not covered;
• make available the information needed to show it meets this agreement, and allow audits by the customer or its auditor on reasonable notice, at the customer's cost, no more than once a year unless a supervisory authority asks.

The customer authorizes Unbox to use subprocessors, under written terms that protect the data at least as this agreement does. Unbox remains responsible for them. The current ones are:

• Microsoft Ireland Operations Ltd (Azure): hosting, databases and storage, in the EU (North Europe).
• Anthropic: Claude, for the apps and assistant built on it, when the customer uses them.

Unbox will tell customers of a new subprocessor before it starts, by updating this list. A customer that objects on reasonable data protection grounds may close its account.

The data is stored in the EU. Where a subprocessor processes it outside the EU/EEA, Unbox relies on an adequacy decision, such as the EU-US Data Privacy Framework, or the EU Standard Contractual Clauses.

The customer is responsible for having a lawful basis for the processing, for informing its users and collecting any consent the law requires (including for cookies), and for what it sends. Liability under this agreement follows the Terms. Questions: admin@unboxai.com.