Data Processing Addendum

Effective Date: Date of first use of the Services — Last Updated: December 2, 2025

This Data Processing Addendum (“DPA”) forms part of, and is subject to, the Obvious Services Agreement (the “Agreement”) by and between Obvious and Customer. Notwithstanding anything in the Agreement to the contrary, to the extent Obvious engages in the Processing of Customer Personal Data that is subject to Applicable Data Protection Laws, this DPA applies. Capitalized terms used but not defined in this DPA have the meanings given to them in the Agreement. In the event of a conflict between the Agreement and this DPA, this DPA shall control solely to the extent of the conflict.

1. Definitions

“Applicable Data Protection Laws” means all laws, regulations, and binding legal requirements relating to the privacy, protection, security, or processing of Personal Data, including without limitation: (a) EU Regulation 2016/679 (“GDPR”); (b) the UK Data Protection Act 2018 and the retained EU law version of the GDPR (“UK GDPR”); (c) the Swiss Federal Data Protection Act (“Swiss FDPA”); (d) the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA”); and (e) any other applicable privacy, data protection, or data security laws in any jurisdiction governing the Processing of Personal Data, as each may be amended, superseded, or replaced from time to time.

Common Terms. “Controller,” “Data Subject,” “Personal Data,” “Personal Data Breach,” “Processing,” “Processor,” and “Supervisory Authority” will have the meaning(s) given in the Applicable Data Protection Laws.

“Customer Affiliate” means an entity that directly or indirectly controls, is controlled by, or is under common control with Customer, where “control” means ownership or control of more than 50% of the voting interests of the subject entity.

“Customer Personal Data” means Personal Data that Customer or any Customer Affiliate uploads or provides to Obvious as part of the Service and that is governed by this DPA.

“EEA” means the European Economic Area.

“Restricted Transfer” means a transfer of Customer Personal Data from the EEA, United Kingdom, or Switzerland to a country or territory outside of those jurisdictions which is not subject to an adequacy decision or adequacy regulations.

“SCCs” means the standard contractual clauses annexed to the European Commission’s Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679.

“Subprocessor” means any third party, including any affiliate of the Processor, engaged by the Processor to Process Customer Personal Data on behalf of the Customer in connection with the Agreement.

“UK Addendum” means the international data transfer addendum to the SCCs issued by the Information Commissioner for Parties making Restricted Transfers under S119A(1) Data Protection Act 2018.

2. Description of Processing

As applicable and where such concepts are recognized by Applicable Data Protection Law, Customer is the Controller and Obvious is the Processor or Service Provider in respect of all Customer Personal Data made available to and Processed by Obvious in connection with the provision of the Services. Obvious will Process Customer Personal Data as contemplated in and in accordance with the Agreement and this DPA.

Obvious will only Process Customer Personal Data in accordance with Customer’s documented instructions, including as set out in the Agreement and this DPA, unless required to do so by applicable laws. Obvious will immediately inform Customer if it is unable to follow the Processing instructions.

Customer represents and warrants that it has provided all necessary notices and obtained all necessary consents and authorizations under Applicable Data Protection Laws for Obvious to Process Customer Personal Data as contemplated by the Agreement and this DPA. The subject matter, nature, purpose, and duration of the Processing, as well as the categories of Customer Personal Data and Data Subjects, are described in Exhibit 1 of this DPA.

3. Compliance with Applicable Data Protection Law

During the term of the Agreement, Obvious will comply with the Applicable Data Protection Laws applicable to Obvious’s Processing of Customer Personal Data.

Obvious will make available all information reasonably requested by Customer to demonstrate Obvious’s compliance with Applicable Data Protection Laws and this DPA.

Obvious will cooperate with and provide reasonable assistance to Customer for: (a) Customer’s performance of any data protection impact assessment of the Processing; and (b) related consultation with Supervisory Authorities.

4. Restrictions

4.1 General Restrictions

Obvious will not:

  • Retain, use, disclose, sell, or share Customer Personal Data for any purpose other than to provide the Services or as otherwise authorized in the Agreement
  • Retain, use or disclose Customer Personal Data for a commercial purpose beyond the context of the direct business relationship between Obvious and Customer
  • Combine Customer Personal Data received from or on behalf of Customer with Personal Data received from or on behalf of another person, except as permitted by Applicable Data Protection Laws and in accordance with Customer’s documented instructions

4.2 Exceptions

The restrictions in Section 4.1 shall not apply: (a) if Obvious is required to perform such actions by any applicable law; or (b) to Obvious’s Processing of de-identified, anonymized or aggregated data, or to the use of internal analytics that do not involve Customer Personal Data.

4.3 Certification

Obvious certifies that it understands the restrictions of this Section 4 and will comply with all Applicable Data Protection Laws.

5. Data Retention and Deletion

Obvious will retain Customer Personal Data only for as long as necessary to perform the Services, or for such other purposes as agreed to by the parties or as required by applicable law.

Following the termination of the Agreement, Obvious shall return or safely destroy all non-anonymized and identifiable Customer Personal Data within ninety (90) days following such termination (excluding Customer Personal Data retained in archival or backup systems or subject to legal hold or other legal requirements), and shall notify Customer in writing once all such information has been returned or destroyed.

If return or destruction is impracticable or prohibited by applicable laws, Obvious will prevent additional Processing of Customer Personal Data and will continue to protect the Customer Personal Data remaining in its possession, custody, or control.

6. Information Security Program

Obvious will implement appropriate physical, technical and administrative safeguards designed to protect Customer Personal Data from unauthorized or unlawful destruction, loss, alteration, disclosure or access.

Obvious will maintain annually updated reports or annual certifications of compliance with the following: ISO 27001 and SOC 2 Type II.

Obvious will conduct annual penetration tests and share summary results with Customer if requested.

7. Breach Notification and Investigation

Obvious will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach impacting Customer Personal Data.

Such notice will include, to the extent known at the time of notification: (a) the nature of the Customer Personal Data Breach, including categories and approximate number of Data Subjects and records concerned; (b) the likely consequences of the Breach; and (c) the measures taken or proposed to address the Breach.

Obvious’s notification of a Customer Personal Data Breach will not be construed as an acknowledgement by Obvious of any fault or liability with respect to the Breach. Obvious shall provide reasonable assistance to Customer as required to investigate and remediate the Breach.

8. Data Subject Rights

To the extent that Applicable Data Protection Laws require Customer to comply with requests from Data Subjects regarding the Processing of Customer Personal Data, Obvious will promptly notify Customer of any Data Subject Requests directed to and directly received by Obvious and will provide reasonable assistance necessary to fulfill such requests, taking into account the nature of Obvious’s Processing.

Obvious will forward to Customer promptly any Data Subject Request received by Obvious relating to Customer Personal Data and may advise the applicable Data Subject to submit their request directly to Customer.

9. Subprocessors

Customer grants Obvious a general authorization to engage Subprocessors in connection with the performance of Obvious’s obligations under the Agreement. Obvious will maintain an up-to-date list of authorized Subprocessors, available at https://trust.obvious.ai (“Subprocessor List”).

Obvious will provide Customer with at least fifteen (15) days advance notice of any intended additions or replacements to the Subprocessor List. If Customer objects to such change on reasonable data protection grounds within fifteen (15) days of notice, the parties will discuss such concerns in good faith. If no resolution is reached, Customer may terminate only the affected portion of the Services without penalty.

Obvious will have a written agreement with each Subprocessor ensuring the Subprocessor only accesses and uses Customer Personal Data to the extent required to perform the obligations subcontracted to it. Obvious remains fully liable for all obligations subcontracted to its Subprocessors.

10. Audit

Obvious will provide a copy of its then-current audit report once per each rolling 12-month period upon request of Customer and subject to the confidentiality obligations set out in the Agreement. Such audit report refers to a SOC 2 Type II audit or another industry standard audit conducted by an independent third-party auditor on an annual basis.

Additionally, Obvious will permit an independent Certified Public Accountant engaged by Customer to audit Obvious’s compliance with this DPA in the event Customer receives a written inquiry from a competent Supervisory Authority or regulator relating to Obvious’s Processing of Customer Personal Data under this DPA.

Any audit will be subject to reasonable scheduling, confidentiality obligations, and Obvious’s security policies and will not unreasonably interfere with Obvious’s business operations. Customer will pay any reasonably incurred costs and expenses incurred by Obvious in the event Customer performs an audit that is not required by Applicable Data Protection Laws or in response to a Customer Personal Data Breach. Obvious will maintain records of its compliance with this DPA for 3 years after the DPA ends.

11. Limitation of Liability

Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set forth in the Agreement.

This DPA does not limit any liability to an individual about the individual’s data protection rights under Applicable Data Protection Laws. In addition, this DPA does not limit any liability between the parties for violations of the EEA SCCs or UK Addendum.

12. No Third-Party Beneficiaries

Nothing in this DPA shall be construed to create any duty or obligation on the part of either party to, or confer any rights, remedies, or benefits upon, any third party (including any Data Subject), except as expressly set forth herein or required under Applicable Data Protection Laws.

13. Term

This DPA will start when Obvious and Customer agree to this DPA and will continue until the Agreement expires or is terminated. However, Obvious and Customer will each remain subject to the obligations in this DPA and Applicable Data Protection Laws until Customer stops transferring Customer Personal Data to Obvious and Obvious stops Processing Customer Personal Data.

14. Cross-Border Transfers

14.1 Authorization for Restricted Transfers

Customer authorizes Obvious to transfer Customer Personal Data outside the EEA, the United Kingdom, Switzerland, or other relevant jurisdictions as necessary to provide the Services, subject to the requirements of Applicable Data Protection Laws.

14.2 Transfer Mechanisms

If Obvious carries out a Restricted Transfer of Customer Personal Data, Obvious will implement appropriate safeguards consistent with Applicable Data Protection Laws. These safeguards may include:

  • Entering into the SCCs
  • Entering into the UK Addendum
  • Entering into the Swiss Addendum set forth in Exhibit 3
  • Entering into any other contractual provisions or frameworks approved by a competent regulator or authority for cross-border Personal Data transfers

14.3 Standard Contractual Clauses

The parties agree that to the extent that the Processing of Customer Personal Data involves a Restricted Transfer, the parties shall each comply with their respective obligations as set out in the SCCs and/or the UK Addendum, each incorporated herein by reference, and amended as follows:

  • The optional docking clause in Clause 7 does not apply
  • In Clause 9, Option 2 (general written authorization) applies; minimum time period for prior notice of Subprocessor changes is as specified in Section 9 of this DPA
  • In Clause 11, the optional language does not apply
  • Module Two (Controller to Processor) applies where Customer is a Controller; Module Three (Processor to Processor) applies where Customer is a Processor
  • In Clause 13(a) and Annex I.C, Option 1 shall apply with the competent Supervisory Authority being the Irish Data Protection Commission
  • In Clause 17 (Option 1), the SCCs will be governed by the laws of Ireland
  • In Clause 18(b), disputes will be resolved in the courts of Ireland
  • For the purposes of Annex I.A, the Customer shall be the data exporter and Obvious shall be the data importer
  • For the purposes of Annex I.B, the description of transfer is set out at Exhibit 1
  • For the purposes of Annex I.C, the technical and organizational measures are set out at Exhibit 2

14.4 Assistance and Cooperation

If required by Applicable Data Protection Laws, Obvious will reasonably assist Customer in conducting any mandated data protection impact assessments or data transfer impact assessments and consultations with relevant Supervisory Authorities.

Exhibit 1: Description of Processing

Categories of Data Subjects

  • Customer’s Authorized Users (employees, contractors, agents)
  • Customer’s end users or customers
  • Any other Data Subjects included or referenced in Customer content, Artifacts, or data uploaded into the Service by Customer or its Authorized Users

Categories of Customer Personal Data

  • Identification data: first and last name, username, email address, phone number
  • Professional data: employer, title and position, business contact information
  • Account data: login credentials, account settings, user preferences
  • Content data: any Personal Data contained within Artifacts, documents, workbooks, presentations, Projects, or other content created or uploaded by Customer
  • Usage data: connection and/or localization data, IP addresses, device information, activity logs
  • Special category Personal Data (if uploaded by Customer): as defined in Article 9 of the GDPR and/or UK GDPR, including racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, and data regarding health, sex life, genetic data, or biometric data

Nature and Purpose of Processing

  • Receiving Customer Personal Data: including collection, accessing, retrieval, recording, and data entry
  • Holding Customer Personal Data: including storage, organization, and structuring
  • Processing Customer Personal Data: including analysis, transformation, manipulation, and AI-assisted processing via the Agent
  • Updating Customer Personal Data: including correcting, adaptation, alteration, alignment, and combination
  • Sharing Customer Personal Data: including disclosure, dissemination, allowing access, or otherwise making available (within Customer’s organization or to Permitted Third Parties as authorized by Customer)
  • Deleting Customer Personal Data: including erasure and destruction

Duration and Frequency

Obvious will Process Customer Personal Data as long as required to conduct the Processing activities instructed in this DPA or by applicable laws, and shall retain the Customer Personal Data as described in Section 5. Frequency of Transfer: Continuous.

Exhibit 2: Data Security Policy and Measures

1. Physical and Environmental Security

Obvious, or Obvious’s Subprocessors, implements measures designed to prevent unauthorized persons from gaining access to the Customer Personal Data Processing equipment. This includes following industry-standard guidelines provided by data centers, securing equipment via standard cloud data hosting providers with restricted access controls, and endpoint monitoring for all Obvious-owned devices with mobile device management.

2. Access Control

  • Role-based access controls with centrally-managed, industry standard SSO providers
  • Access to IT systems protected by authentication mechanisms including multi-factor authentication for privileged accounts
  • All access to Customer Personal Data is logged, monitored, and tracked
  • Privileged access rights granted only to individuals who reasonably need it (least-privilege principle)
  • Access rights removed immediately upon termination of employment or contract

3. Availability Control

  • Anti-malware solutions with industry-standard solutions built into all physical hardware
  • Customer Personal Data stored in multiple availability zones to protect against environmental threats
  • Regular (daily) backup snapshots that allow for point-in-time rollback
  • IT systems and applications in non-production environments are logically or physically separated from production environments

4. Operations Security

  • Information Security Framework maintained and reviewed at least quarterly
  • Annual security awareness and data privacy training for all employees
  • Security-relevant events logged (user management activities, failed logons, security configuration changes)
  • All critical vulnerabilities identified must be remediated within seven (7) days of identification

5. Transmission Controls

  • IT systems and applications administered using encrypted connections with TLS and SSH
  • Content integrity during transmission protected by network protocols such as TLS 1.2 or greater
  • Customer Personal Data transmitted over public networks is encrypted
  • Secure Key Management Systems (KMS) used to store secret keys in the cloud

6. Security Incidents

Obvious maintains and implements an incident handling process including records of security breaches, notification processes according to legal standards, and an incident response scheme addressing roles, responsibilities, communication strategies, and specific procedures covering all critical system components.

7. Asset Management, System Acquisition, Development and Maintenance

  • Information security requirements identified and documented prior to development and acquisition of new IT systems
  • Formal process to control and perform changes to developed applications
  • Security tests incorporated into the System Development Life Cycle

8. Human Resource Security

  • Background check conducted for all employees and contractors who will Process Customer Personal Data, including criminal check and employment verification going back seven (7) years where permitted by applicable law
  • Employees with access to Customer Personal Data are bound by confidentiality obligations
  • Employees with access to Customer Personal Data are trained regularly regarding data protection laws, annually at minimum

9. Cryptography

  • Digital certificates accepted and trusted only if issued by a trusted certification authority
  • Certificates used and allocated to dedicated IT-systems and applications
  • Process maintained for the management and implementation of cryptographic keys, including rules and requirements to generate, store, backup, distribute, and revoke cryptographic keys

Exhibit 3: Swiss Addendum

This Swiss Addendum forms part of the DPA and applies to any Processing of Customer Personal Data that is subject to the Swiss Federal Act on Data Protection (“Swiss FDPA”) or to both the Swiss FDPA and the GDPR.

1. Interpretation

Where this Addendum uses terms that are defined in the SCCs, those terms will have the same meaning as in the SCCs. In addition: (a) “Swiss FDPA” means the Swiss Federal Act on Data Protection of 25 September 2020 (in force as of 1 September 2023), and the Swiss Ordinance on Data Protection of 31 August 2022, as each may be amended from time to time; (b) “FDPIC” means the Swiss Federal Data Protection and Information Commissioner.

This Addendum will be read and interpreted in light of the provisions of the Swiss FDPA so that it fulfills the intention to provide appropriate safeguards as required by Article 16 of the Swiss FDPA, and will not be interpreted in a way that conflicts with rights and obligations provided for in the Swiss FDPA.

2. Hierarchy

In the event of a conflict or inconsistency between this Addendum and the provisions of the SCCs or other related agreements between the parties, the provisions which provide the most protection to Data Subjects will prevail.

3. Amendments to the SCCs for Swiss Transfers

To the extent that any Processing of Customer Personal Data is exclusively subject to the Swiss FDPA, the SCCs as incorporated in Section 14.3 of this DPA are amended as follows:

  • References to “GDPR” are replaced by “Swiss FDPA” and references to specific Articles of the GDPR are replaced with the equivalent Article or Section of the Swiss FDPA
  • References to Regulation (EU) 2018/1725 are removed
  • References to the “European Union,” “Union,” “EU,” and “EU Member State” are replaced with “Switzerland”
  • Clause 13(a) and Part C of Annex I are not used; the competent supervisory authority is the FDPIC insofar as the transfers are governed by the Swiss FDPA
  • Clause 17 is replaced to state: “These Clauses are governed by the laws of Switzerland insofar as the transfers are governed by the Swiss FDPA.”
  • Clause 18 is replaced to state disputes will be resolved by the courts of Switzerland, with Data Subjects able to bring proceedings before the courts of Switzerland in which they have their habitual residence

The Swiss FDPA extends data protection rights to legal entities as well as natural persons. Accordingly, the protections under this DPA and the SCCs as amended by this Addendum shall apply to Personal Data of legal entities to the extent required by the Swiss FDPA.

4. Dual Application

To the extent that any Processing of Customer Personal Data is subject to both the Swiss FDPA and the GDPR, this DPA will apply: (a) as set forth in Section 14.3 with respect to transfers subject to the GDPR; and (b) as amended by Section 3 of this Swiss Addendum with respect to transfers subject to the Swiss FDPA.

5. Notifications

Customer warrants that it and/or Customer Affiliates have made any notifications to the FDPIC which are required under the Swiss FDPA.

Contact Information

If you have questions regarding this Data Processing Addendum, please contact us at compliance@obvious.ai. For the complete terms, please refer to our Terms of Service.