Data Processing Addendum

1. Scope and how this addendum applies

1.1 This Data Processing Addendum ("DPA") forms part of the agreement between Louvain AI Ltd, a company registered in England and Wales (company number 17506006) ("Louvain", "we"), and the customer that has accepted our Terms of Service or signed an order for hosted Louvain ("Customer", "you") (together, the "Agreement").

1.2 It applies whenever we process Customer Personal Data in providing the Service. It takes effect when the Agreement does and needs no separate signature.

1.3 If this DPA conflicts with the rest of the Agreement, this DPA prevails for the processing of personal data. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail.

2. Definitions

Capitalised terms not defined here have the meaning given in the Terms of Service.

• Data Protection Laws means all laws on privacy and the processing of personal data that apply to the processing under the Agreement, which may include the EU General Data Protection Regulation 2016/679 ("GDPR"); the GDPR as it forms part of UK law and the UK Data Protection Act 2018 ("UK GDPR"); the Swiss Federal Act on Data Protection ("FADP"); the California Consumer Privacy Act as amended ("CCPA"); the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486); the Australian Privacy Act 1988 (Cth); and the New Zealand Privacy Act 2020.
• Customer Personal Data means personal data within Customer Data that we process on your behalf in providing the Service.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data processed by us or our Subprocessors.
• Subprocessor means a third party we engage to process Customer Personal Data.
• Standard Contractual Clauses or SCCs means the standard contractual clauses for the transfer of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914.
• UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018, version B1.0.
• controller, processor, data subject, personal data, processing and supervisory authority have the meanings given in the GDPR, and include their equivalents under other Data Protection Laws (including "business" and "service provider" under the CCPA).

3. Roles

3.1 You are the controller of Customer Personal Data, or a processor acting for another controller. We are your processor, or your subprocessor where you act as a processor.

3.2 You are responsible for the lawfulness of the processing you instruct, including having a lawful basis for it, giving any required notices to data subjects (including your employees and the people whose information appears in the sources you connect), and obtaining any required consents.

3.3 Under the CCPA, we are a service provider. We will not sell or share Customer Personal Data; retain, use or disclose it for any purpose other than performing the Service; retain, use or disclose it outside our direct business relationship with you; or combine it with personal data we receive from other sources, except as the CCPA permits. We will notify you if we can no longer meet these obligations.

4. Processing on your instructions

4.1 We process Customer Personal Data only on your documented instructions. The Agreement, your configuration of the Service (including the sources you connect, who can read them, and the features your administrators turn on), and any further written instructions you give that we agree are consistent with the Agreement are your complete instructions.

4.2 We will tell you promptly if we believe an instruction breaches Data Protection Laws, and we may suspend the relevant processing until the instruction is changed. We may process Customer Personal Data where the law requires us to; in that case we will tell you before processing unless the law prohibits it.

4.3 The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are described in Annex I.

5. Our obligations

5.1 Confidentiality. We ensure that everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.

5.2 Security. We implement and maintain the technical and organisational measures described in Annex II, which are designed to protect Customer Personal Data against Personal Data Breaches and to ensure a level of security appropriate to the risk. We may update them, but we will not materially reduce the overall protection they provide.

5.3 Helping you respond to data subjects. The Service lets your administrators manage members, disconnect sources and delete a workspace. Where you cannot respond to a data subject request using the Service, we will give you reasonable help, at your reasonable cost where the help goes beyond what the Service provides. If a data subject contacts us directly about Customer Personal Data, we will direct them to you and will not respond ourselves unless you instruct us or the law requires it.

5.4 Helping with your obligations. Taking into account the nature of the processing and the information available to us, we will give you reasonable help with data protection impact assessments, prior consultations with supervisory authorities, and your security obligations, as they relate to the Service.

5.5 Records. We keep the records of processing that Data Protection Laws require of a processor.

6. Subprocessors

6.1 General authorisation. You authorise us to engage Subprocessors. Our current Subprocessors are listed at louvain.ai/subprocessors, which forms Annex III.

6.2 Our commitments. We impose data protection obligations on each Subprocessor, by written contract, that are no less protective in substance than those in this DPA, to the extent applicable to the service it provides. We remain responsible to you for our Subprocessors' performance of those obligations.

6.3 Notice of changes. We will update the Subprocessors page at least 30 days before a new Subprocessor begins processing Customer Personal Data, and we will email that notice to anyone who has asked for updates at legal@louvain.ai. Where we must replace a Subprocessor urgently to keep the Service running or secure, we will give notice as soon as we reasonably can.

6.4 Objections. You may object to a new Subprocessor on reasonable data protection grounds by emailing legal@louvain.ai within the notice period. We will discuss your concerns in good faith. If we cannot resolve them within 30 days, you may terminate the affected part of the Service by notice, and we will refund prepaid fees for the period after termination.

7. Personal Data Breaches

7.1 We will notify you without undue delay, and in any event within 72 hours, after we become aware of and confirm a Personal Data Breach.

7.2 Our notice will describe, as far as we know at the time, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, its likely consequences, and the measures taken or proposed to address it. Where we cannot provide all of this at once, we will provide it in phases without undue delay.

7.3 We will take reasonable steps to contain and investigate the breach and to reduce its effects, and will cooperate with you so you can meet your own notification obligations.

7.4 We send breach notices to your account owner's email address and to any security contact you give us. Our notice of a breach is not an acknowledgement of fault or liability.

8. Deletion and return

8.1 During the subscription. You can remove content by removing a connection, with or without the content it imported; by removing members; and, as an owner, by deleting a workspace, as described in the Documentation. Where a connected source reports that an item was deleted, the Service removes it. A file or folder deleted from the Library is kept in Recently deleted for 30 days, where it is not searched or used in answers and can be restored, and is then deleted; the person who deleted it, an administrator of its collection or a workspace administrator can delete it sooner. Deleting a workspace deletes its content from our database, its search-index entries and its permission records, and removes email addresses from the audit entries it leaves behind. You can also ask us to delete specific content.

8.2 When the Agreement ends. If you ask us before the Agreement ends or within 30 days after, we will provide an export of Customer Data in a commonly used, machine-readable format. We keep Customer Personal Data for 30 days after the Agreement ends, so that you can ask for an export or reactivate, and delete it, including derived indexes and embeddings, after that period, or promptly after providing an export you asked for if that comes later. Copies in backups are deleted as those backups expire in the ordinary course, and remain protected by this DPA until then.

8.3 Legal retention. We may keep Customer Personal Data where the law requires it, in which case this DPA continues to apply to it and we process it only for that purpose.

8.4 Certification. On request, we will confirm in writing that deletion has been completed.

9. Audits and information

9.1 Information. On request, we will provide the information reasonably necessary to demonstrate our compliance with this DPA, such as answers to security questionnaires, descriptions of our controls, and summaries of relevant policies. Louvain does not currently hold a SOC 2 report or ISO 27001 certification; if we obtain third-party audit reports, we will make them available under confidentiality terms.

9.2 Audits. If the information in section 9.1 does not reasonably satisfy an audit right you have under Data Protection Laws, or a supervisory authority requires it, or following a Personal Data Breach, you may audit our compliance with this DPA. You must give at least 30 days' notice, agree the scope, timing and duration with us in advance, use an auditor bound by confidentiality who is not our competitor, avoid disrupting our operations or compromising other customers' data, and bear your own costs. Audits may take place no more than once in any 12 months except where a supervisory authority requires or a Personal Data Breach justifies one.

10. International transfers

10.1 Where we process. We process Customer Personal Data in the European Union (Frankfurt, Germany), and our Subprocessors process it in the locations listed on the Subprocessors page, some of which are outside the European Union. We are based in the United Kingdom. You authorise these transfers, subject to this section.

10.2 EU transfers. Where the GDPR applies to a transfer of Customer Personal Data to us that is not covered by an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) applies where you are a processor;
• in Clause 7, the optional docking clause applies;
• in Clause 9, Option 2 (general written authorisation) applies, and the notice period is that set out in section 6.3 of this DPA;
• in Clause 11, the optional redress language does not apply;
• in Clause 13, the competent supervisory authority is the one determined under Annex I, Part C;
• in Clause 17, Option 1 applies and the governing law is that of Ireland;
• in Clause 18(b), disputes are resolved before the courts of Ireland; and
• Annexes I and II of the SCCs are completed with Annexes I and II of this DPA.

10.3 UK transfers. Where the UK GDPR applies to such a transfer, the UK Addendum is incorporated into this DPA and completed as follows: in Table 1, the parties are those in Annex I; in Table 2, the Addendum EU SCCs are the SCCs as incorporated under section 10.2, including the modules and options selected there; in Table 3, the Appendix Information is in Annexes I, II and III of this DPA; and in Table 4, either party may end the UK Addendum as its Section 19 allows.

10.4 Swiss transfers. Where the FADP applies to such a transfer, the SCCs apply as set out in section 10.2 with these changes: references to the GDPR include the FADP; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; and the term "member state" does not exclude data subjects in Switzerland from exercising their rights in their place of habitual residence.

10.5 Onward transfers. Where a Subprocessor processes Customer Personal Data in a country that does not have an adequacy decision, we put in place an appropriate transfer mechanism with that Subprocessor.

10.6 Other laws. Where other Data Protection Laws require a transfer safeguard, the parties agree that the commitments in this DPA, including the SCCs where incorporated, apply as that safeguard to the extent the law allows.

10.7 Government requests. If we receive a request from a public authority for Customer Personal Data, we will review its lawfulness, challenge it where we reasonably believe it is unlawful, disclose only what is legally required, and notify you before disclosing unless the law prohibits it.

11. Liability and term

11.1 Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Laws or the SCCs do not allow that.

11.2 This DPA continues for as long as we process Customer Personal Data, even after the rest of the Agreement ends.

Annex I — Details of the processing

A. The parties

Data exporter: the Customer named in the account or order for hosted Louvain. Contact: the account owner or the contact named in the order. Activities relevant to the transfer: use of the Service. Role: controller, or processor on behalf of another controller.

Data importer: Louvain AI Ltd, registered in England and Wales (company number 17506006), operating Louvain. Contact: privacy@louvain.ai for data protection matters, legal@louvain.ai for notices. Activities relevant to the transfer: providing the Service. Role: processor, or subprocessor.

B. Description of the processing

Categories of data subjects

• The Customer's Authorised Users.
• The Customer's employees, contractors and other personnel whose information appears in connected sources.
• The Customer's customers, prospects, suppliers, partners and other people whose information appears in content the Customer connects or submits, such as the senders and recipients of email, participants in chat and meetings, and people named in documents and records.

Categories of personal data

• Identification and contact details, such as names, email addresses, usernames and identifiers in connected systems.
• Professional information, such as job titles, teams, managers and roles, including information imported from HR, directory and identity systems the Customer connects.
• Content of communications and documents, such as email, chat messages, calendar entries, files, tickets and CRM records, and any personal data within them.
• Questions, conversations and generated output that refer to people.
• Facts and relationships derived from that content, such as who works on a project or who owns an account.
• Technical information about Authorised Users' use of the Service, such as sign-in records and audit log entries.

Special categories of data. The Customer decides what it connects. Sources such as mailboxes, files and HR systems may contain special categories of personal data. The Service is not designed specifically for such data. The safeguards in Annex II apply to all Customer Personal Data, in particular that content is retrievable only by people permitted to read its source.

Frequency of the transfer. Continuous, for as long as the Customer uses the Service.

Nature of the processing. Collecting content from connected sources; storing it; indexing it, including creating search indexes and numerical embeddings and extracting facts and relationships using language models; retrieving it for people permitted to read it; generating answers, briefings and other output using language models; emailing Authorised Users notifications about discussions they take part in, which name people, documents and collections but never carry what anyone wrote; applying permission changes; and deleting it.

Purpose of the processing. Providing the Service to the Customer under the Agreement.

Duration of the processing. The term of the Agreement, and the deletion period in section 8.

Transfers to Subprocessors. For the subject matter, nature and duration described on the Subprocessors page (Annex III).

C. Competent supervisory authority

Where the Customer is established in the EU, the supervisory authority of the member state in which it is established. Where it is not established in the EU but falls within the territorial scope of the GDPR and has appointed a representative, the supervisory authority of the member state in which the representative is established. Otherwise, the supervisory authority of the member state in which the data subjects whose personal data is transferred are located. For the UK Addendum, the UK Information Commissioner.

Annex II — Technical and organisational measures

These are the measures in place for hosted Louvain at the date above.

Access to content

• Permissions are applied before retrieval. For every question, search, briefing and agent request, the Service first works out which content the requesting person may read — from the permissions the connected source reports, or the audience an administrator chose for a workspace connection — and retrieves and ranks only within that set. Content outside it cannot be retrieved, ranked, summarised or cited.
• Fail closed. Content with missing permission information, and permission changes that have not yet been applied, are treated as not readable.
• Derived information inherits its sources' permissions. A fact concluded from several sources is shown only to people who can read all of them.
• The same rules for people, the API and agents. API tokens and agent connections act with the permissions of the person they belong to. Agent connections can also save files, and replace files an agent saved, but only where the person they belong to has allowed it and could add files themselves. A saved file is readable only by the people who can read the collection it is saved in. Agent connections cannot change settings, connections, members or who can read any content.
• Roles do not widen visibility. Owner and administrator roles manage a workspace; they do not by themselves grant access to content.
• Private conversations. Ask conversations are visible only to the person who started them.

Tenant isolation

• Every request and query is scoped to one organisation.
• Automated end-to-end tests of organisation isolation and fail-closed visibility run against every change, and a permission benchmark attempts to read one tenant's content from another tenant with valid credentials and fails if any content is returned.

Authentication and credentials

• Sign-in for hosted Louvain is provided by our authentication provider. Louvain's own session cookie is HTTP-only, sent only over HTTPS and bound to its origin, and sessions expire after 7 days without use and after 14 days at most.
• Cookie-authenticated requests that change data are checked against the site's own origin.
• API tokens, agent tokens and single-use sign-in links are stored only as one-way hashes and are shown once when created. Agent connections use OAuth 2.1 with PKCE, and revoking one takes effect immediately.
• Credentials you give us for connected sources are encrypted in the database with AES-256-GCM before storage. OAuth tokens for connected sources are held by an authorisation broker that runs within our own hosting environment and is not reachable from the public internet except for the pages a person's browser needs to complete a sign-in.
• Connector processes run with an allowlisted environment that excludes the database credentials and the key used to encrypt stored credentials.
• Rate limits apply to sign-in, sign-up, invitation and token endpoints.

Encryption

• In transit: connections to the Service use TLS, and HTTPS is enforced with HTTP Strict Transport Security. Traffic between our services runs over our hosting provider's private network, which is encrypted between hosts, and connections to the database use TLS.
• At rest: stored data is encrypted at rest by our hosting and database providers, using keys they manage. Stored connector credentials are additionally encrypted by the application, as above.

Logging, monitoring and audit

• Administrative actions — including changes to members, roles, invitations, connections, single sign-on settings, tokens, agent connections, web search settings and workspace deletion — are recorded in the workspace audit log, which administrators can view.
• Error monitoring, metrics and product analytics are designed to exclude customer content, and a verification script sends a test marker through the Service and fails if the marker reaches any of them.
• The Service exposes health and readiness checks and a public status page.

Operator access

• Access to production systems is limited to named Louvain personnel who need it.
• We access customer content only to provide support you ask for, to keep the Service secure, or where the law requires it. Where support requires signing in as a user, we use a single-use link that expires within minutes, and the sign-in is recorded in the audit log of the workspace it opens.

Handling untrusted content and AI output

• Content imported from sources is treated as data, never as instructions. Messages carrying known instruction-override patterns are quarantined before any model reads them.
• Figures, dates and names in generated answers are checked against the sources they cite, and unsupported sentences are removed.
• Nothing a model writes can change what a person is permitted to read.

Resilience and recovery

• The database is hosted by a managed provider with point-in-time recovery.
• Our backup and restore procedure includes a verification step that restores a backup into a separate database and checks it.

Deletion

• Where a connected source reports that an item was deleted, it is removed from every tier — search, answers, facts and the keyword index — and a later replay of it is refused.
• Removing a connection revokes every permission it granted at once and can delete everything it imported.
• Workspace owners can delete a workspace, which removes its content from our database, its entries from the keyword index and its records from the permission store, and leaves an audit trail with no email addresses in it.
• Customer Data is deleted after the Agreement ends as described in section 8.

Development and vulnerability management

• Changes are checked by automated type checks and tests, including permission and tenant-isolation tests.
• Dependencies are pinned by lockfile and updated to address published security advisories.
• We run a vulnerability disclosure process at security@louvain.ai.

Incident response

• Suspected security incidents are investigated, contained and remediated, and Personal Data Breaches are notified as set out in section 7.

People and suppliers

• Personnel with access to Customer Personal Data are bound by confidentiality obligations.
• Subprocessors are engaged under written terms that include data protection obligations, as set out in section 6.

Annex III — Subprocessors

The Subprocessors authorised under this DPA are those listed at louvain.ai/subprocessors at the relevant time, which is incorporated into this DPA by reference.

Questions about this document: legal@louvain.ai.