Data Processing Addendum

Last updated: 18 October 2026

Adithana Marketing LLC (“AIMAR”), a limited liability company incorporated in Bulgaria under UIC (ЕИК) 205958514, with registered office and address of management at 11 G Prof. Hristo Vakarelski Str., 1700 Sofia, Bulgaria, publishes this Data Processing Addendum (“Addendum”) for each person or organization that enters into AIMAR’s Terms of Service and uses the Services (the “Customer”).

This Addendum, including its annexes, forms part of the Terms of Service and is the sole data processing addendum for Customer Personal Data under the Terms. The Customer accepts it through the express acceptance process in the Terms. For a new Customer it takes effect on acceptance; for an existing Customer, only when the update becomes binding under Section 24(c) of the Terms. AIMAR shall retain the legal identity, notice contact, document version and binding acceptance record. Where the Customer acts for an upstream controller, it shall have authority to issue instructions and give authorizations on that controller’s behalf. The Services and processing are described in Annex 1.

1 Definitions and scope

1.1 Defined terms

“Applicable Data Protection Law” means Regulation (EU) 2016/679 (the “GDPR”), the laws of EEA states supplementing it, and any other privacy or data protection law applicable to the processing under this Addendum. “Customer Personal Data” means personal data in Customer Content, Outputs or other information that AIMAR processes on behalf of the Customer under the Terms, as described in Annex 1. “Account Data” means information used to administer the Customer’s account and commercial relationship with AIMAR, such as the designated contact, user account and billing details. “Service usage information” means logs and information about use, operation and security of the Services. The same item of data may be processed in different roles for different purposes, as disclosed in AIMAR’s privacy notice. “Personal Data Breach” has the meaning in Article 4(12) GDPR. “Subprocessor” means another processor engaged by AIMAR to process Customer Personal Data on the Customer’s behalf. “Services” means the services described in the Terms and Annex 1. GDPR terms including controller, processor, data subject, personal data and processing have their GDPR meanings.

1.2 Roles

For Customer Personal Data, the Customer is a controller or, where it processes for its own controller, a processor, and AIMAR is its processor or subprocessor respectively. Each party shall comply with its own obligations under Applicable Data Protection Law. AIMAR acts as an independent controller only where it independently determines the purposes and means of processing Account Data or Service usage information for account administration, billing, security, fraud prevention, legal compliance or Service improvement as described in the Terms and its Privacy Policy. This role description does not authorize AIMAR to repurpose Customer Personal Data processed on the Customer’s behalf.

2 Processing instructions

2.1 Documented instructions

AIMAR shall process Customer Personal Data only on documented instructions from the Customer, including for transfers to a third country or international organization, unless Union or Member State law to which AIMAR is subject requires otherwise. In that event AIMAR shall inform the Customer before processing unless the law prohibits notice on important grounds of public interest. The Terms, this Addendum, Annex 1, and the Customer’s documented use of the Services constitute instructions. The Customer may issue additional written instructions consistent with the Terms and law.

2.2 Unlawful instructions

AIMAR shall immediately inform the Customer if, in AIMAR’s opinion, an instruction infringes the GDPR or other applicable Union or Member State data protection law. AIMAR may suspend the affected processing while the parties resolve the instruction, to the extent permitted by law.

2.3 Limits on use

AIMAR shall not sell Customer Personal Data, use it for its own marketing, or use it to train or improve a general model or service for other customers. On the Customer’s instruction in Section 9(b) of the Terms, AIMAR may process Customer Personal Data to create aggregated statistics that identify neither the Customer nor any individual. Those statistics are not Customer Personal Data; AIMAR uses them only to operate, secure and improve the Services, never to train AI models, and creates them from information received from Google APIs only as Section 11 of the Terms permits. AIMAR shall not authorize AI subprocessors to train or improve their own or any other models using Customer Personal Data. Any separately accepted program for additional processing requires a lawful documented instruction and may not override these prohibitions, Section 4.5 or the Google API restrictions in Section 11 of the Terms. AIMAR shall not disclose Customer Personal Data except as instructed, required by applicable law or permitted under this Addendum. Any anonymization of Customer Personal Data is itself processing requiring a documented Customer instruction; only genuinely anonymous information ceases to be personal data under the GDPR. Pseudonymized or encoded information remains subject to this Addendum where it is personal data.

2.4 Customer obligations

The Customer shall comply with its controller or processor duties under Applicable Data Protection Law, including determining a lawful basis, providing required notices, and obtaining any required consents for the personal data it submits or connects to the Services. It shall issue lawful instructions, maintain the accuracy and lawful collection of Customer Personal Data, and comply with laws governing any electronic marketing it sends or schedules through the Services, where applicable. It shall not submit special category data, criminal offence data, or children’s data unless Annex 1 expressly permits that processing and appropriate protections are agreed. This clause does not relieve AIMAR of its own legal duties.

3 Personnel confidentiality and security

3.1 Confidentiality

AIMAR shall ensure that each person it authorizes to process Customer Personal Data is subject to a binding duty of confidentiality or an appropriate statutory obligation of confidentiality, receives access only as needed for the Services, and is informed of relevant data protection responsibilities.

3.2 Security measures

Taking account of the state of the art, implementation costs, and the nature, scope, context, purposes and risks of processing, AIMAR shall implement appropriate technical and organizational measures under Article 32 GDPR. AIMAR shall maintain the measures described in Annex 2 throughout processing. AIMAR may update measures if the overall level of protection is not materially reduced and shall provide the Customer with an updated description on request. The Customer is responsible for security measures within its control, including account security under Section 2 of the Terms and security of its Connected Services.

4 Subprocessors

4.1 General authorization and list

The Customer grants general written authorization for AIMAR to engage the Subprocessors listed in Annex 4. AIMAR shall maintain an accurate list of all Subprocessors, including their legal identity, contact details, processing function and processing locations, and make it readily available to the Customer. A provider is a Subprocessor when it processes Customer Personal Data on AIMAR’s behalf, including hosting, support or other downstream services with access to such data.

4.2 Changes and objection

AIMAR shall publish its current Subprocessor register in Annex 4 at https://aimar.chat/data-processing-addendum/. Before a new Subprocessor that AIMAR engages directly begins processing Customer Personal Data, AIMAR shall actively notify the Customer at its designated notice address or through a delivered in-Service notice at least fourteen (14) calendar days in advance; updating the published register alone is not notice. Each notice shall identify the legal entity, contact details, function, processing and access countries, transfer safeguard and intended start date. For a provider engaged by a Subprocessor, AIMAR shall pass on each notice of an intended change that the Subprocessor gives AIMAR within two (2) business days of receiving it and, where the Subprocessor gives advance notice, before the new provider begins processing Customer Personal Data, with the information listed above to the extent AIMAR has it.

A shorter advance period for a directly engaged Subprocessor may be used only where necessary for security or continuity, is explained to the Customer and still provides a meaningful opportunity to object before processing starts. An emergency does not waive required authorization or safeguards. The Customer may object on reasonable data-protection grounds within fourteen (14) days after a notice. AIMAR shall review the objection and, where reasonably possible, provide an alternative that avoids the objected-to processing, including by raising the objection with the relevant Subprocessor. If no reasonable alternative is available, the Customer may terminate the affected Services, receive a pro-rata refund of Fees Received (as defined in the Terms) for their unused period, subject to mandatory law and Section 9.4, and have its Customer Personal Data returned or deleted under Section 7. A lack of objection following notice and expiry of the objection period constitutes authorization under the general authorization in Section 4.1.

AIMAR shall use reasonable efforts to obtain and keep supplier terms that give AIMAR advance notice of new downstream providers early enough to pass the notice on and handle objections before processing starts, and shall monitor its Subprocessors’ published lists. If AIMAR learns that a downstream provider has begun, or will begin, processing Customer Personal Data without notice that allows the Customer to object in advance, AIMAR shall inform the Customer without undue delay. If the Customer objects on reasonable data-protection grounds within fourteen (14) days after that notice, AIMAR shall, where reasonably possible and without undue delay, stop the objected-to processing for that Customer by ceasing to send its Customer Personal Data to that provider or by moving the affected processing to an authorized Subprocessor. Where neither is reasonably possible, the Customer may choose to have the affected feature or Services suspended for it until the objection is resolved, or to terminate the affected Services, receive a pro-rata refund under this Section and have its Customer Personal Data returned or deleted under Section 7. Where that provider already holds the Customer’s Personal Data, AIMAR shall request, through the relevant Subprocessor, that the data be deleted or returned, and shall inform the Customer of the response. Late notice does not retrospectively authorize the processing.

4.3 Flow down and liability

Before a Subprocessor processes Customer Personal Data, AIMAR shall enter into a binding written contract imposing data protection obligations no less protective in substance than those in this Addendum, including appropriate technical and organizational measures. AIMAR remains fully liable to the Customer for the Subprocessor’s performance of those obligations. AIMAR shall take reasonable steps to verify and monitor sufficient guarantees, proportionate to the processing risk, and provide the Customer information reasonably needed to assess the chain of processing.

4.4 Customer enabled third party services

Where the Customer independently contracts with and connects a third party service to AIMAR at its own direction, that provider is not a Subprocessor merely because of the connection. The Customer’s agreement with that provider governs the provider’s independent processing. If AIMAR engages the provider to process Customer Personal Data on AIMAR’s behalf, the provider is a Subprocessor and must be listed in Annex 4. The Terms identify Gmail, LinkedIn, HubSpot, Google Analytics and Google Search Console as actual Connected Services.

4.5 AI service providers

AIMAR shall establish a binding restriction preventing an AI or model Subprocessor from using Customer Personal Data to train or improve its own or any other models. Product settings supplement but do not replace the required written processor terms. AIMAR shall not send Customer Personal Data through feedback, research or opt-in data-sharing features that permit such use. Before enabling a new model or stored-data feature for Customer Personal Data, AIMAR shall review its retention and deletion terms and reflect them in Annex 1.

5 Assistance to the Customer

5.1 Data subject rights

Taking into account the nature of processing, AIMAR shall assist the Customer, by appropriate technical and organizational measures insofar as possible, to respond to requests under Chapter III GDPR. AIMAR shall promptly notify the Customer of a request it receives relating to Customer Personal Data and, where the request identifies the Customer, refer the requester to the Customer. AIMAR shall not respond substantively except on the Customer’s instruction or as legally required.

5.2 Security and impact assessments

Taking into account the nature of processing and information available to AIMAR, AIMAR shall assist the Customer with its obligations under Articles 32 to 36 GDPR, including security, Personal Data Breach assessment and notification, data protection impact assessments and prior consultation with a supervisory authority, to the extent relevant to the Services. The parties may agree reasonable reimbursement for substantial assistance that exceeds routine compliance support, but no charge may prevent performance of a mandatory Article 28 duty.

5.3 Breach notice

AIMAR shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, using the contact in Annex 1. AIMAR shall provide information available at the time about the nature of the breach, affected data and data subjects, likely consequences, measures taken or proposed, and a contact point for follow-up; it may provide information in stages without undue further delay. AIMAR shall take reasonable steps to contain, investigate, mitigate and remediate the breach and cooperate with the Customer. Notification is not an admission of fault.

6 Information and audits

6.1 Demonstrating compliance

AIMAR shall make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR and this Addendum, including relevant security information, Subprocessor details, written responses to reasonable security questionnaires and relevant certifications or third-party reports that AIMAR holds, subject to appropriate confidentiality protections.

6.2 Audit rights

AIMAR shall allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer. The parties shall agree reasonable scope, timing, confidentiality and security safeguards to avoid unnecessary disruption and protect other customers’ data. Remote document review may be used where it provides sufficient evidence. These practical arrangements shall not prevent an audit necessary to demonstrate compliance, respond to a material incident, or satisfy a supervisory authority. The Customer bears its own audit costs; any AIMAR charge requires prior written agreement and may not defeat the statutory audit right.

7 Return and deletion

7.1 End of Services

At the Customer’s choice, when the relevant Services end, AIMAR shall return or delete Customer Personal Data and delete existing copies unless Union or Member State law requires storage. The Customer may retrieve Customer Content and Outputs during the thirty (30) day Retrieval Period in Terms Section 18(b), or the longer switching and retrieval period in Section 18(c). An authorized administrator may request return or earlier deletion at support@aimar.chat; AIMAR may verify authority. After the applicable period, or earlier on a lawful documented instruction, AIMAR shall delete data from active systems without undue delay, delete temporary and stored working copies and instruct Subprocessors to do the same. Backup copies are governed by Annex 1: they shall be isolated from ordinary use, protected, used only for necessary disaster recovery and expired without renewed retention. AIMAR shall reapply deletions before restored data returns to ordinary use. Annex 1 also describes copies that Subprocessors keep under their own terms, including AI model provider retention that runs from when data is sent or generated and retention for safety or legal reasons; those copies are not AIMAR’s disaster-recovery backups. Legally required retention is governed by Section 7.2. AIMAR shall confirm completion in writing on request, identifying the categories of copies described in Annex 1 that may remain and when they are expected to expire, to the extent AIMAR has that information.

7.2 Legally retained data

If law requires retention, AIMAR shall identify the legal requirement to the Customer where permitted, protect the retained data, limit processing to that requirement, and delete it when retention is no longer required. This clause does not allow indefinite retention for general business purposes.

8 International transfers

8.1 Transfer rule

AIMAR shall not transfer Customer Personal Data to a recipient outside the EEA, including by granting such a recipient remote access, except on the Customer’s documented instructions and in compliance with Chapter V GDPR. Annex 4 records each authorized Subprocessor and its processing location. Annex 3 describes the conditional transfer route to a Customer outside the EEA. The Customer’s acceptance of the completed Annexes constitutes its instruction for the corresponding disclosed transfers, subject to Section 4.2 for later Subprocessor changes. EEA hosting alone does not establish that all processing remains in the EEA if personnel or providers access data from elsewhere.

8.2 Safeguards

For a transfer to a country covered by a valid European Commission adequacy decision, the parties may rely on that decision within its scope. Otherwise AIMAR shall put in place an applicable Article 46 safeguard before the transfer, normally the unmodified European Commission transfer standard contractual clauses under Decision (EU) 2021/914 with the correct module, parties and annexes completed and executed. Where necessary, AIMAR shall assess the destination and implement supplementary measures to ensure essentially equivalent protection. If no lawful route is available, the transfer shall not occur.

8.3 EU standard contractual clauses for customer transfers

Where AIMAR, as an EEA processor, transfers Customer Personal Data to a Customer acting as controller outside the EEA, no applicable adequacy decision covers the transfer, and the transfer falls within the scope of Decision (EU) 2021/914, the unmodified Standard Contractual Clauses under that Decision, Module Four and the general clauses applicable to that module, are incorporated by reference into this Addendum. The official text is available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj/eng. This route applies only where the importer’s relevant processing is not already subject to the GDPR, as required by Article 1 of that Decision. AIMAR is the exporter and the Customer is the importer. The parties complete the Appendix information through Annexes 1 and 3 and the incorporated Customer account/order acceptance record. Clause 7 and the optional independent-dispute-resolution wording in Clause 11 do not apply. Clause 17 selects Bulgarian law, which permits third-party beneficiary rights, and Clause 18 selects the courts of Sofia, Bulgaria. Electronic acceptance concludes the clauses only when the parties and relevant Appendix information are complete and the binding acceptance record is retained. The SCCs prevail over conflicting provisions of this Addendum or the Terms. Clauses 14 and 15 apply to Module Four where required by their terms, including where AIMAR combines data received from the non-EEA controller with personal data collected by AIMAR in the EEA; the narrow pure-return exception must not be applied to such a mixed dataset.

8.4 Other transfer routes

Transfers by AIMAR to a Subprocessor outside the EEA require a separate valid Chapter V mechanism between AIMAR and that recipient, including Module Three SCCs where appropriate. A Customer that is itself a processor rather than a controller, or a transfer subject to UK or Swiss transfer rules, may require a different instrument or adaptation. The parties shall document any such route and put the necessary instrument in place before the transfer begins. Where the importer’s relevant processing is already subject to GDPR, the parties must assess and implement a lawful transfer route applicable to that situation; Section 8.3 does not supply an automatic route. No affected transfer may begin without the required mechanism.

9 Term and general provisions

9.1 Term

This Addendum starts on its effective date and continues while AIMAR processes Customer Personal Data, including any period needed to complete return or deletion under Section 7.

9.2 Notices

Notices under this Addendum to AIMAR shall be sent to support@aimar.chat. Notices to the Customer shall be sent to the account administrator email or other privacy or legal notice address that the Customer designates in its account or order record. AIMAR shall send breach notices to that address unless the Customer has designated a separate incident contact. Each party shall keep its contact details current.

9.3 Governing law and jurisdiction

Subject to mandatory Applicable Data Protection Law and any validly incorporated or executed transfer clauses, this Addendum is governed by the law of Bulgaria and disputes are subject to the competent courts in Sofia, Bulgaria, consistent with Section 25 of the Terms.

9.4 Liability

Any limitations or exclusions of liability in Sections 21 and 22 of the Terms apply to claims arising under this Addendum only to the extent they are valid under Applicable Data Protection Law and do not contradict or undermine the liability rules of any applicable standard contractual clauses, including Clause 12 of the EU transfer clauses. Nothing in this Section limits the rights of data subjects under Article 82 GDPR, the SCCs, or other mandatory law.

9.5 Precedence

For the processing of Customer Personal Data, this Addendum prevails over conflicting provisions of the Terms and any order form or signed agreement. Applicable Standard Contractual Clauses prevail over this Addendum, the Terms and any order form. No contractual limitation, indemnity, retention permission or exclusion of third-party rights limits mandatory data-protection obligations or rights or contradicts applicable Standard Contractual Clauses.

10 US state privacy laws

10.1 Role and business purposes

Where Customer Personal Data includes personal information governed by the California Consumer Privacy Act, as amended (the “CCPA”), or another US state consumer privacy law, AIMAR acts as the Customer’s “service provider”, “contractor” or “processor” under that law. AIMAR processes that data only for the business purposes described in Annex 1, namely to provide, secure and support the Services.

10.2 Restrictions

AIMAR shall not: (a) sell or share Customer Personal Data, including for cross-context behavioral advertising; (b) retain, use or disclose it for any purpose other than the business purposes in Annex 1, or outside the direct business relationship with the Customer, except as those laws permit a service provider or contractor; or (c) combine it with personal information that AIMAR receives from or on behalf of another person, or collects from its own interactions with consumers, except as those laws permit.

10.3 Compliance, notice and remediation

AIMAR shall comply with its obligations under those laws and provide the level of privacy protection they require. AIMAR shall notify the Customer if it determines that it can no longer meet those obligations. The Customer may, on notice, take reasonable and appropriate steps to ensure that AIMAR uses Customer Personal Data consistently with the Customer’s obligations under those laws, and to stop and remediate unauthorized use, through the mechanisms in Sections 5 to 7.

10.4 Assistance

Taking into account the nature of the processing, AIMAR shall provide reasonable assistance, through the functionality of the Services and the mechanisms in Sections 5 and 6, to enable the Customer to respond to consumer requests under those laws, including requests to know, correct or delete personal information, and to carry out any risk assessment, data protection assessment or cybersecurity audit that those laws require of the Customer for processing involving the Services.

10.5 De-identified information

Where AIMAR creates de-identified information from Customer Personal Data, it shall take reasonable measures to ensure that the information cannot be associated with an individual, keep and use it only in de-identified form, not attempt to re-identify it, and contractually require any recipient to do the same.

10.6 Subprocessors and certification

AIMAR shall bind each Subprocessor to written terms no less protective than this Section 10. AIMAR certifies that it understands the restrictions in this Section 10 and will comply with them.

Annex 1 Processing details

This Annex describes the processing AIMAR performs on behalf of Customers in providing the Services. The Customer determines which permitted data it submits and the instructions it gives through its use of the Services.

Services and subject matter: The AIMAR AI-powered marketing platform, software tools, AI agents, integrations and Expert Services described in the Terms, processing Customer Personal Data in Customer Content, Outputs and related Service information to provide the Service.
Nature of processing: Hosting, storing, organizing, retrieving, analyzing and transmitting Customer Personal Data; generating Outputs; and transmitting Customer-approved communications or content through Connected Services.
Purposes: Providing marketing strategies, plans, recommendations, content, campaigns, performance insights and related Service functions requested or configured by the Customer, including supported integrations and Expert Services.
Categories of data subjects: The Customer’s customers, prospects, leads, contacts, subscribers, employees, contractors and authorized users, and other individuals whose personal data the Customer lawfully submits.
Categories of personal data: Names, email addresses, telephone numbers, job titles, employers, professional and business profile information, communications and marketing content, engagement, analytics and campaign-performance data, and other permitted Customer Content.
Special category and criminal offence data: Not permitted under Section 6(d) of the Terms unless AIMAR expressly agrees in writing; the same restriction applies to government identifiers, payment-card data and children’s personal data.
Frequency and duration: As initiated by the Customer during the Service term and applicable Retrieval Period under Section 18(b) or 18(c) of the Terms; thereafter only as Section 7 of this Addendum permits.
Processing locations: AIMAR’s employees access Customer Personal Data from the European Union, including while temporarily travelling for work. Individual contractors and Experts who are not AIMAR employees access Customer Personal Data only once engaged as Subprocessors under Section 4: listed in Annex 4 with their country, bound by a written contract meeting Article 28 GDPR and, if located outside the EEA, covered by a Chapter V transfer mechanism before access. Subprocessor locations are identified in Annex 4. Any later change is subject to this Addendum’s instruction, authorization and transfer requirements.
Customer role: Controller, or processor acting for an upstream controller, according to the Customer’s own processing and instructions.
Customer incident contact: Account administrator email or separately designated incident address in the Customer account or order record.
AIMAR incident contact: support@aimar.chat
Retention and deletion of copies: Copies of Customer Personal Data are kept and deleted as set out in the items below. Until deletion, AIMAR’s own copies remain protected and are not used for other purposes, and AIMAR reapplies deletion if a backup is restored.
Database backups controlled by AIMAR: AIMAR shall configure both production point-in-time restore history and scheduled database backups to expire deleted data within seven (7) days after its deletion from the active database. This maximum covers each backup mechanism controlled by AIMAR, not an assumption that a recovery-window setting controls every infrastructure copy. Deleted data shall not be copied into a new backup cycle. Restoration is subject to Section 7.1.
Working copies (AIMAR): Copies made for data exports, support or troubleshooting are kept only for as long as that purpose requires, are not used for other purposes and are in any event deleted under Section 7.1.
Hosting and sign-in providers (Managed Google Cloud Service and Clerk): AIMAR deletes live database records through the hosting service and removes the corresponding Clerk user when it deletes the related account or user. Copies these providers keep in their own infrastructure are deleted under their data processing addenda (Annex 4), which publish no specific period for individual records while AIMAR’s agreement with them continues. AIMAR shall ask Replit and Clerk for written details of how they treat deleted individual records and residual copies while that agreement continues, update this Annex when it receives them and provide them on request.
AI model provider, ordinary retention (Anthropic): Anthropic deletes API inputs and outputs within thirty (30) days of receipt or generation. This period runs from when the data is sent to or generated by Anthropic, not from deletion in AIMAR’s systems.
AI model provider, exceptional retention (Anthropic): Anthropic may keep inputs and outputs flagged for a Usage Policy violation for up to two (2) years and the related trust and safety classification scores for up to seven (7) years, keep data where law requires, and apply additional limited retention and review for certain models as its terms describe. These copies are kept for Anthropic’s safety and legal purposes, not as AIMAR backups. AIMAR does not submit Customer Personal Data through provider feedback features that permit additional retention or model improvement.
AI model provider, stored files (Anthropic): If AIMAR uses an Anthropic feature that stores files or other data until they are deleted, such as the Files API, AIMAR deletes the stored data through that feature when it is no longer needed for the relevant Service function, and in any event under Section 7.1.

Annex 2 Technical and organizational measures

AIMAR shall maintain measures appropriate to the processing risk under Article 32 GDPR.

Encryption: Current TLS standards for data in transit; encryption at rest through hosting providers; encrypted storage of Connected Service tokens and credentials.
Access and authentication: Access to production systems and Customer Personal Data restricted to authorized personnel on a need-to-know basis; multi-factor authentication for administrative access.
Monitoring and maintenance: Logging of administrative access and actions executed through Connected Services; timely application of security updates.
Availability and recovery: Regular backups of production data.
People and response: Confidentiality obligations and security awareness for personnel with access to Customer Personal Data; documented incident-response procedure.
Supplier assurance: Risk-based security due diligence before engagement and periodic review of each Subprocessor, including available independent assurance reports or certifications, their scope and expiry. No certification is represented as covering a provider or processing activity unless verified.
Assurance and testing: Regular review and testing of the effectiveness of technical and organizational security measures, with findings used to improve measures where needed.

Annex 3 Conditional transfers to Customers outside the EEA

This Annex applies only if AIMAR makes Customer Personal Data available to a Customer acting as controller outside the EEA. It does not describe a transfer to an AIMAR employee or Subprocessor outside the EEA.

Exporter: AIMAR, processor, Bulgaria.
Importer and destination: Customer acting as controller outside the EEA, identified by its legal name, address, contact details and destination country in its account or order record.
Data and purpose: Categories of data and data subjects in Annex 1; continuous access to Customer Content and Outputs to use the Services during the term and Retrieval Period. The Customer determines retention after receipt according to its own retention policies and applicable law.
Mechanism: Applicable EU adequacy decision under Article 45 GDPR, including relevant certification where required; otherwise incorporated Module Four SCCs under Section 8.3.

SCC Appendix and electronic execution record

For a transfer under Section 8.3, SCC Annex I.A consists of AIMAR’s full legal identity, address and contact in the introduction and Section 9.2, its role as processor/exporter, and the Customer’s full legal name, registered address, country, notice contact, role as controller/importer and relevant service activities in its account or order record. The record shall identify the accepting representative and authority, acceptance date/time, document version and the parties’ binding electronic execution; AIMAR shall retain evidence of its corresponding contractual assent. An incomplete record does not authorize a transfer.

SCC Annex I.B consists of Annex 1 and this Annex 3, including data categories, data subjects, purposes, transfer frequency, processing nature, applicable sensitive-data restrictions and retention criteria. Customer retention after receipt must be limited to the period necessary for its lawful purposes and applicable legal duties, with the criteria recorded in the relevant transfer record. Annex 2 supplies the security measures to the extent required for the selected route. Any additional Appendix information required for another route is completed before reliance on it.

Annex 4 Authorized Subprocessors

This register identifies AIMAR’s directly engaged Subprocessors. AIMAR also keeps a dated register of the downstream providers that these Subprocessors list for the services AIMAR uses, with the legal identities, functions, locations and transfer safeguards they publish, and provides it to the Customer on request. Supplier-list links are supporting information; Section 4.2 governs change notices.

1. Provider: Anthropic

Legal entity: Anthropic Ireland, Limited, the contracting entity for AIMAR’s Anthropic API account under Anthropic’s Commercial Terms.
Function and data: AI language processing to generate Outputs: prompts, Customer Content sent for inference and generated Outputs.
Processing and access locations: United States and other countries where Anthropic and its subprocessors operate.
Contract and transfer safeguard: Anthropic’s Data Processing Addendum, incorporated into its Commercial Terms, with the EU Standard Contractual Clauses (Modules Two and Three), the UK Addendum and the Swiss addendum for transfers outside the EEA. Anthropic may not train models on Customer Content (Section 4.5).

2. Provider: Google Cloud

Legal entity: Google Cloud Managed Service by Replit, Inc.
Function and data: Application hosting including storage and backups: Customer Content, Outputs, service records and logs.
Processing and access locations: European Union and United States. AIMAR runs the Service in Replit’s Europe and North America geographies. Replit support staff may access data from the United States.
Contract and transfer safeguard: Replit’s Data Processing Agreement, with the EU Standard Contractual Clauses (Modules Two and Three) and the UK Addendum.

3. Provider: Databricks (Neon)

Legal entity: Databricks, Inc.
Function and data: Managed PostgreSQL database, including storage and backups; Customer Content, Outputs and service records stored in the database.
Processing and access locations: European Union and United States.
Contract and transfer safeguard: Replit’s Data Processing Agreement, with the EU Standard Contractual Clauses (Modules Two and Three) and the UK Addendum.

4. Provider: Clerk

Legal entity: Clerk, Inc.
Function and data: Sign-in and account management for the Customer’s authorized users: account identifiers, email addresses, and sign-in and session metadata.
Processing and access locations: United States.
Contract and transfer safeguard: Clerk’s Data Processing Addendum. Transfers rely on the EU–US Data Privacy Framework while Clerk is certified and the framework remains valid; otherwise on the EU Standard Contractual Clauses (Modules Two and Three), the UK Addendum and the Swiss addendum included in that DPA.
Role: Clerk mainly processes account data for AIMAR’s own controller purposes, as described in the Privacy Policy. It is listed here to the extent it processes Customer Personal Data.

Providers that AIMAR uses only for its own controller purposes, such as payment processing and appointment scheduling, are described in the Privacy Policy and are not Subprocessors.

Change notices go to the account administrator or designated notice address under Section 9.2, or are provided within the Service under Section 4.2.