Data processing addendum.

This Data Processing Addendum ("DPA") is part of the EMLbot Terms of Service (the "Terms") between EVKII, Inc., a corporation doing business as EMLbot, 7040 Avenida Encinas, Suite 104-441, Carlsbad, CA 92011, USA ("EVKII"), and the business that accepted the Terms ("Customer"). It is incorporated into the Terms (Section 11.6 of the Terms) and applies whenever EVKII processes personal information in Customer Content on Customer's behalf. No signature is needed. Customer's authorized person accepts it by accepting the Terms.

1. Definitions

• Applicable Data Protection Law: the laws that apply to the processing of personal information in Customer Content, including the California Consumer Privacy Act as amended by the CPRA and its regulations ("CCPA"), other U.S. state privacy laws, and, where they apply, the EU General Data Protection Regulation ("GDPR"), the UK GDPR and the Swiss Federal Act on Data Protection.
• Personal Data (also "personal information"): information in Customer Content that relates to an identified or identifiable person, or that is otherwise protected under Applicable Data Protection Law.
• Controller, Processor, Business, Service Provider, Data Subject, Processing, Sell and Share have the meanings given in Applicable Data Protection Law.
• Personal Data Breach: accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data that EVKII processes under this DPA.
• Subprocessor: a third party that EVKII engages to process Personal Data on Customer's behalf. EVKII's current Subprocessors are listed in Annex 3 and at emlbot.com/subprocessors.
• SCCs: the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914.
• Other capitalized words have the meaning given in the Terms.

2. Roles

2.1 Customer. Customer may act as a Controller (or a Business) of the Personal Data in its Customer Content, or as a Processor (or Service Provider) acting for another Controller, such as an agency's client. Customer confirms that it has the authority to give EVKII the instructions in this DPA, including on behalf of any other Controller.

2.2 EVKII. EVKII acts as a Processor (and a Service Provider) for Customer. Where Customer is itself a Processor, EVKII acts as a further Processor (a Subprocessor of Customer).

2.3 EVKII's own data. EVKII is an independent Controller of account, billing, security and website data that it handles for its own purposes. The Privacy Policy covers that data. This DPA does not.

3. Processing on instructions

3.1 Documented instructions. EVKII will process Personal Data only on Customer's documented instructions. Customer's instructions are: this DPA and the Terms, the settings that Customer's workspace owner and admins choose in the console, and Customer's use of the API and MCP server. Customer may give other reasonable written instructions to support@emlbot.com. EVKII will follow them if they are consistent with the Terms and the Service. If an instruction would require a change to the Service, EVKII may decline or may charge for it as the parties agree in writing.

3.2 Illegal instructions. EVKII will tell Customer if it believes an instruction infringes Applicable Data Protection Law. EVKII may suspend the instruction until Customer confirms or changes it.

3.3 Details. Annex 1 describes the subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects.

3.4 Required by law. If EVKII must process Personal Data to comply with a legal obligation, it will tell Customer before doing so unless the law forbids it.

4. California (CCPA) service-provider terms

For Personal Data that is personal information subject to the CCPA:

1. EVKII processes the personal information only for the specific business purposes in Annex 1, which are the purposes of providing the Service to Customer and the other purposes the CCPA regulations permit a service provider to carry out.
2. EVKII will not sell or share the personal information.
3. EVKII will not retain, use or disclose the personal information for any purpose other than those business purposes, including for any commercial purpose other than the business purposes, or outside the direct business relationship between EVKII and Customer, except as the CCPA permits.
4. EVKII will not combine the personal information with personal information that it receives from or on behalf of another person, or collects from its own interactions with a consumer, except as the CCPA permits.
5. EVKII will comply with the CCPA that applies to service providers and will give the personal information the same level of privacy protection that the CCPA requires of Customer.
6. EVKII will tell Customer within a reasonable time if it determines that it can no longer meet its obligations under the CCPA.
7. Customer may take reasonable and appropriate steps to make sure EVKII uses the personal information consistently with Customer's obligations under the CCPA, including through the audit provisions in Section 11. If Customer reasonably believes EVKII is using the personal information without authorization, Customer may notify EVKII, and EVKII will work with Customer to stop and remediate the unauthorized use.
8. Customer discloses the personal information to EVKII only for the limited and specified business purposes in Annex 1.
9. EVKII certifies that it understands these restrictions and will comply with them.
10. Where EVKII engages a Subprocessor, EVKII will bind it by a written contract with the same obligations (Section 7) and will tell Customer as Section 7 describes.

5. Confidentiality of personnel

EVKII will make sure that everyone who processes Personal Data for EVKII is under a duty of confidentiality, and that access is limited to people who need it to provide the Service, support Customer, keep the Service secure, or comply with law.

6. Security

EVKII will implement and maintain appropriate technical and organizational measures to protect Personal Data, taking into account the state of the art, the cost, the nature, scope, context and purposes of processing, and the risks to Data Subjects. The measures in place at the date of this DPA are summarized in Annex 2. EVKII may update them over time, provided the update does not materially reduce the overall level of protection.

Customer is responsible for the security of its own systems, bots, credentials and Connected Services, and for configuring its workspace settings (such as roles, keys, allowlists, approvals and retention) to suit its risks.

7. Subprocessors

7.1 General authorization. Customer gives EVKII a general authorization to engage Subprocessors. Customer approves the Subprocessors listed in Annex 3 and at emlbot.com/subprocessors.

7.2 Flow-down. EVKII will have a written contract with each Subprocessor that requires it to protect Personal Data in a way that is no less protective than this DPA, to the extent applicable to the services the Subprocessor provides. EVKII remains responsible to Customer for its Subprocessors' performance of those obligations.

7.3 Notice of changes. EVKII will tell workspace owners by email, and update emlbot.com/subprocessors, at least 30 days before a new or replacement Subprocessor starts processing Personal Data.

7.4 Objection. Customer may object to a new Subprocessor on reasonable data protection grounds by writing to legal@emlbot.com during the notice period. EVKII will work with Customer in good faith to address the objection. If the parties cannot resolve it, Customer may cancel the affected Service by closing its workspace, and EVKII will refund any prepaid fees for the period after the closure.

7.5 Customer-selected integrations. Third-party services that Customer independently selects and connects (for example an AI platform, a webhook destination or Customer's own system) are not EVKII's Subprocessors. Customer's use of them is governed by Customer's agreements with those providers.

8. Help with Data Subject requests

EVKII will give Customer the tools in the console, such as search, export and deletion, that let Customer respond to requests from Data Subjects to exercise their rights under Applicable Data Protection Law. If EVKII receives a request directly from a Data Subject about Personal Data in Customer Content, EVKII will not respond except to tell the person to contact the Customer, unless the law requires a response or Customer has told EVKII otherwise. Taking into account the nature of the processing, EVKII will give Customer reasonable additional help with requests at Customer's request. EVKII may charge a reasonable fee if the help requires unusual effort.

9. Help with Customer's other obligations

Taking into account the nature of the processing and the information available to it, EVKII will give Customer reasonable help with Customer's obligations on the security of processing, notification of Personal Data Breaches, data protection impact assessments and prior consultation with a supervisory authority.

10. Personal Data Breaches

10.1 Notice. EVKII will notify the affected Customer without undue delay after becoming aware of a Personal Data Breach. EVKII does not promise a fixed number of hours, because the time needed to confirm what happened depends on the facts. The notice goes to the workspace owner's and admins' email addresses.

10.2 Content. EVKII will give Customer the information it has when it notifies, and updates as the investigation proceeds. To the extent known, that includes: what happened and when; the categories and approximate number of Data Subjects and records affected; the likely consequences; the measures EVKII has taken or proposes to take; and a contact point.

10.3 Cooperation. EVKII will cooperate with Customer's reasonable steps to investigate the breach and with Customer's applicable notification obligations to regulators and Data Subjects. Customer, not EVKII, decides whether and how to notify regulators and Data Subjects, unless the law requires EVKII to notify.

10.4 Not an admission. EVKII's notice or response is not an acknowledgment of fault.

11. Audits and information

11.1 Information. On written request, no more than once a year unless there has been a Personal Data Breach, EVKII will give Customer the information reasonably needed to show that EVKII complies with this DPA. This includes a summary of its security measures, answers to a reasonable security questionnaire, and any third-party audit report or certification EVKII holds. EVKII does not currently hold third-party security certifications.

11.2 Audit. If that information is not enough to show compliance, or if Applicable Data Protection Law requires it, Customer (or an independent auditor bound by confidentiality that Customer appoints and EVKII reasonably accepts) may audit EVKII's compliance with this DPA. Customer will give at least 30 days' written notice, will agree the scope and timing with EVKII, will carry out the audit during business hours without unreasonable disruption, will bear its own costs and EVKII's reasonable costs, and will not have access to other customers' data or to information that would compromise EVKII's security. Customer will share the results with EVKII.

11.3 SCC audits. Where the SCCs apply, the audit rights in the SCCs apply and prevail over this Section 11 to the extent they require more.

12. Return and deletion

12.1 Export. While its workspace is open, Customer can export Personal Data in Customer Content from the console.

12.2 Deletion. EVKII deletes Customer Content, including the Personal Data in it, 30 days after the workspace closes. Copies in backups expire within 90 days of closure. EVKII keeps only the records that the Data Retention Schedule lists (for example billing records, legal acceptance records and minimal text-message suppression records), and those are not Customer Content.

12.3 Confirmation. On written request, EVKII will confirm in writing that it has deleted the Personal Data.

12.4 Legal holds. If the law requires EVKII to keep Personal Data longer, EVKII will keep it protected, will use it only for that legal purpose, and will delete it when the requirement ends.

13. Hosting and international transfers

13.1 Hosting. EVKII hosts the Service in the United States. Personal Data may be processed on the global edge network of EVKII's hosting provider, but is stored in the United States.

13.2 Transfers from the EEA, UK and Switzerland. If Customer transfers Personal Data that is subject to the GDPR, the UK GDPR or the Swiss FADP to EVKII in the United States, the parties agree that:

1. the SCCs, Module Two (controller to processor) apply where Customer is a Controller, and Module Three (processor to processor) apply where Customer is a Processor, and they are incorporated into this DPA by reference, with Customer as "data exporter" and EVKII as "data importer";
2. in the SCCs: Clause 7 (docking clause) applies; in Clause 9(a), Option 2 (general written authorization) applies with the notice period in Section 7.3 of this DPA; the optional wording in Clause 11(a) does not apply; for Clause 17 the SCCs are governed by the law of Ireland; and for Clause 18 the courts of Ireland resolve disputes;
3. Annex 1 of this DPA serves as Annex I.B of the SCCs, Annex 2 serves as Annex II, and Annex 3 serves as Annex III; Annex 4 completes Annex I.A and I.C;
4. for transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the SCCs (version B1.0) applies, completed with the information in this DPA, and the parties may end the addendum as it provides;
5. for transfers subject to the Swiss FADP, the SCCs apply with references to the GDPR read as references to the FADP, references to a Member State read as Switzerland, and the Swiss Federal Data Protection and Information Commissioner as the competent authority for those transfers.

The parties rely on the SCCs for these transfers, and not on an adequacy decision.

13.3 Government access. EVKII will tell Customer, unless the law forbids it, if it receives a legally binding request from a public authority for Personal Data, and will challenge a request that it reasonably believes is unlawful. EVKII will disclose only the minimum permitted.

14. Liability

Each party's liability under this DPA is subject to the limits in Section 20 of the Terms, to the extent those limits are enforceable. Nothing limits a party's liability to Data Subjects under the SCCs or under Applicable Data Protection Law where the law does not allow it to be limited, and nothing limits a party's liability that the law does not allow to be limited.

15. Order of precedence

If there is a conflict about the processing of Personal Data, this order controls: the SCCs (to the extent they require it), then this DPA, then the Terms.

16. Term and changes

This DPA lasts as long as EVKII processes Personal Data for Customer, and Sections that by their nature should survive (including 10, 12, 13 and 14) survive. EVKII may update this DPA as the Terms allow, and a material change needs re-acceptance by an authorized human (Terms Sections 4.7 and 25). A change required to comply with Applicable Data Protection Law, a regulator's decision or an updated version of the SCCs takes effect when the law requires it.

17. Contact

Questions about this DPA: support@emlbot.com. Legal notices, Subprocessor objections and Data Protection requests: legal@emlbot.com. By mail: EVKII, Inc., 7040 Avenida Encinas, Suite 104-441, Carlsbad, CA 92011, USA.

---

Annex 1: Details of the processing

Annex 2: Technical and organizational measures

EVKII maintains the following measures, which describe how the Service is built and run at the date of this DPA.

1. Encryption in transit. Traffic between users, bots, EVKII and its Subprocessors is encrypted with TLS.
2. Encryption at rest. Customer Content and message metadata are stored in encrypted storage provided by EVKII's hosting provider (database and object storage).
3. Tenant isolation. Each workspace's data is logically separated. API keys are scoped to the actions and inboxes Customer chooses, and a key cannot reach other inboxes. Messages and attachments are served only to credentials that can read the inbox concerned.
4. Credential protection. API keys are shown once and stored only as a hash and a short prefix. Webhooks are signed (HMAC-SHA256, with a timestamp to stop replays), and signing secrets are returned only when created. Repeated failed authentication attempts from one IP address lock that address out for a period.
5. Bot Shield screening. Inbound email, chat, tasks and texts are screened for prompt injection, hidden text, phishing links and dangerous attachments. Risky mail is quarantined for an admin to release or delete, and sender verification results (SPF, DKIM and DMARC) are recorded.
6. Access control. Roles for people (owner, admin, viewer), clearance and approval controls for bots, and limits on EVKII personnel access to what each role needs. EVKII personnel access Customer Content only when needed for support at Customer's request, to investigate abuse or security, or to meet legal obligations.
7. Logging and monitoring. An audit log records changes to keys, inboxes, webhooks, approvals, sign-ins and users, and an event log records activity in the workspace. Access to systems is logged.
8. Backups. Nightly encrypted backups, which expire within 90 days.
9. Retention and deletion. Workspace retention settings, a nightly deletion job, deletion of Customer Content 30 days after closure, and backup expiry within 90 days.
10. Incident response. Security reports go to security@emlbot.com. EVKII investigates, contains, and notifies customers as Section 10 describes.
11. Subprocessor management. Written contracts with each Subprocessor, and the notice process in Section 7.
12. Limitations. EVKII does not currently hold third-party security certifications. No system is perfectly secure.

Annex 3: Subprocessors

The current list, with the data each Subprocessor handles, is at emlbot.com/subprocessors.

Annex 4: SCC details (Annex I.A and I.C)

• Data exporter: Customer, the business identified in its EMLbot account. Contact: the workspace owner's email address on the account. Role: Controller or Processor, as Section 2.1 says.
• Data importer: EVKII, Inc., 7040 Avenida Encinas, Suite 104-441, Carlsbad, CA 92011, USA. Contact: legal@emlbot.com. Role: Processor.
• Competent supervisory authority (Clause 13): the authority responsible for the data exporter's establishment in the EEA or, if none, the authority of the Member State where its representative is established or where the Data Subjects are located. For UK transfers, the UK Information Commissioner's Office.
• Signature and date: each party's acceptance of the Terms (with the date recorded on acceptance) counts as signing these SCCs and this Annex.