Data Processing Agreement

1. Definitions

Terms defined in the Agreement have the same meaning in this DPA. In addition:

Applicable Data Protection Laws

All laws that apply to the processing of Customer Personal Data under the Agreement, including the GDPR, the UK GDPR, and applicable U.S. Privacy Laws.

Customer Personal Data

Personal data that YeshBe processes on behalf of the Customer in providing the services, including personal data of the Customer’s users and of end users of apps, websites and digital products the Customer builds using YeshBe.

GDPR

Regulation (EU) 2016/679. Where the Customer is in the United Kingdom, references to the GDPR include the UK GDPR and the Data Protection Act 2018.

Personal Data Breach

A confirmed breach of YeshBe’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. Unsuccessful attempts that do not compromise Customer Personal Data — such as failed log-ins, pings or port scans — are not Personal Data Breaches.

Service Data

Data about the use and operation of the services, such as usage metrics, logs, diagnostic information and billing records, that YeshBe collects for its own legitimate business purposes.

Sub-processor

Any third party engaged by YeshBe to process Customer Personal Data on the Customer’s behalf.

U.S. Privacy Laws

U.S. federal and state privacy laws that apply to the processing of Customer Personal Data, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”).

“Controller”, “processor”, “data subject”, “processing” and “personal data” have the meanings given in the GDPR. Where the CCPA applies, the Customer is the “business” and YeshBe is the “service provider” or “contractor”, as applicable.

2. Roles and scope

For Customer Personal Data, the Customer is the controller and YeshBe is the processor. Where the Customer is itself a processor for another party, YeshBe acts as its sub-processor.

YeshBe processes Service Data as an independent controller, as described in section 9. This DPA does not create a joint-controller relationship.

The subject matter, nature, purpose and categories of data and data subjects are described in Annex 1. This DPA remains in effect for as long as YeshBe processes Customer Personal Data under the Agreement.

3. Customer obligations

The Customer:

• Has a lawful basis, and any consents or notices required, for the personal data it provides to YeshBe or collects through apps, websites and digital products it builds using YeshBe.
• Is responsible for the accuracy, quality and legality of Customer Personal Data and of the means by which it was obtained.
• Is responsible for how it configures and uses the services, including access controls, the security of its account credentials, and the design and operation of the apps, websites and digital products it builds.
• Acts as the single point of contact for YeshBe for itself and its affiliates on all matters under this DPA.

Unless expressly agreed in writing by YeshBe, the Customer will not use the services to process special categories of personal data under the GDPR, protected health information subject to HIPAA, payment card data, or government identification numbers.

4. YeshBe obligations

YeshBe will:

• Process Customer Personal Data only on the Customer’s documented instructions, including the Agreement, this DPA and the Customer’s use and configuration of the services, unless applicable law requires otherwise. Where legally permitted, YeshBe will inform the Customer before carrying out processing required by law.
• Inform the Customer promptly if YeshBe believes a Customer instruction infringes Applicable Data Protection Laws.
• Ensure that persons authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.
• Taking into account the nature of the processing, assist the Customer with data subject requests, data protection impact assessments and consultations with supervisory authorities where required by Applicable Data Protection Laws.
• Forward to the Customer, without undue delay, any request YeshBe receives directly from a data subject relating to Customer Personal Data and not respond to the request except on the Customer’s documented instructions or where required by law.

5. Security

YeshBe maintains appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data, taking into account the nature, scope, context and purposes of the processing and the risks to individuals.

The technical and organizational measures maintained by YeshBe are further described in Annex 2. YeshBe may update these measures from time to time, provided that such updates do not materially reduce the overall level of protection provided to Customer Personal Data.

6. Personal Data Breach

YeshBe will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. As information becomes available, YeshBe will provide:

• A description of the breach, including the categories and approximate number of data subjects and records concerned, where known.
• The likely consequences of the breach, where known.
• The measures taken or proposed to address the breach and reduce its possible adverse effects.

YeshBe will investigate the breach and take reasonable steps to contain, mitigate and remediate it and to reduce the risk of recurrence. Notification of a breach is not an admission of fault or liability.

If the Customer plans to notify regulators, data subjects or the public about a breach that refers to YeshBe, it will, where legally permitted, give YeshBe advance notice and a reasonable opportunity to comment.

7. Sub-processors

The Customer provides general authorization for YeshBe to engage Sub-processors to help provide the services. YeshBe may use Sub-processors for artificial intelligence processing, communications, email delivery, infrastructure and other functionality necessary to provide the services.

YeshBe will maintain a current list of Sub-processors that process Customer Personal Data, including the nature of the services they provide. The list may be made available on YeshBe’s website or through the privacy contact identified in this DPA.

YeshBe will provide notice before adding or replacing a Sub-processor that processes Customer Personal Data. The Customer may object on reasonable data protection grounds within twenty (20) days after receiving notice. The parties will work in good faith to resolve the objection. If the parties cannot resolve it, the Customer may terminate the affected services and receive a refund of prepaid fees for the unused portion of those affected services.

YeshBe will impose data protection obligations on each Sub-processor that are appropriate to the processing performed by that Sub-processor and are no less protective of Customer Personal Data than the relevant obligations imposed on YeshBe under this DPA. YeshBe remains responsible for the performance of its Sub-processors to the extent required by Applicable Data Protection Laws.

8. International transfers

YeshBe is based in the United States and may process Customer Personal Data in the United States and in other countries where YeshBe or its Sub-processors operate.

Where Customer Personal Data subject to the GDPR is transferred to a country that has not been recognized as providing an adequate level of protection, the parties agree that the EU Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 (“SCCs”) apply and are incorporated into this DPA by reference, as further described in Annex 3.

Module Two of the SCCs applies where the Customer is a controller and YeshBe is a processor. Module Three applies where the Customer is a processor and YeshBe acts as its sub-processor.

For transfers subject to the UK GDPR, the applicable UK International Data Transfer Addendum to the EU Standard Contractual Clauses will apply, as further described in Annex 3.

If a government or public authority requests access to Customer Personal Data, YeshBe will, where legally permitted, notify the Customer and use reasonable efforts to redirect the requesting authority to obtain the information directly from the Customer. YeshBe will review such requests and challenge them where YeshBe reasonably considers there are lawful grounds to do so.

9. Service Data

YeshBe may collect and use Service Data for its own legitimate business purposes, including billing and accounting, security and fraud prevention, analytics, and operating, maintaining and improving the services.

YeshBe processes Service Data as an independent controller and not on the Customer’s behalf. To the extent Service Data constitutes personal data under Applicable Data Protection Laws, YeshBe will process it in accordance with those laws and its Privacy Policy.

Where YeshBe publishes or shares information derived from Service Data, it will be aggregated or de-identified so that it does not identify the Customer or any individual. Where Applicable Data Protection Laws impose requirements on de-identified data, YeshBe will process such data in accordance with those requirements.

10. Artificial intelligence processing

YeshBe uses third-party artificial intelligence processing providers, including OpenAI, Anthropic and Google, solely to provide AI-powered functionality requested by the Customer, such as generating, modifying and assisting with the development of applications, websites, interfaces, code and related project content.

Customer Personal Data contained in prompts, files, project content or other Customer-provided inputs may be transmitted to these providers only as necessary to process the Customer’s request and provide the requested functionality.

YeshBe does not use Customer Personal Data to train, retrain or fine-tune artificial intelligence or machine learning models.

YeshBe uses commercial services and configurations intended to prevent Customer Personal Data submitted through YeshBe from being used by its artificial intelligence processing providers to train or improve their general-purpose models.

11. Return and deletion

When the Agreement ends, YeshBe will stop processing Customer Personal Data except as necessary to return, delete or securely retain the data as required by law.

Within thirty (30) days after the Agreement ends, the Customer may request in writing that its Customer Personal Data be exported or deleted. After that period, YeshBe will delete or irreversibly anonymize Customer Personal Data unless Applicable Data Protection Laws require YeshBe to retain it.

Customer Personal Data that has been deleted from active systems may remain in backups for a limited period in accordance with YeshBe’s backup and retention procedures and will be deleted or overwritten in the ordinary course of those procedures.

12. Information and audits

On written request, and no more than once per year unless otherwise required by Applicable Data Protection Laws, a supervisory authority, or following a Personal Data Breach affecting Customer Personal Data, YeshBe will make available information reasonably necessary to demonstrate compliance with its obligations under this DPA.

YeshBe may satisfy this obligation by providing relevant documentation, written responses to security or privacy questionnaires, independent audit reports or certifications where available, or other information reasonably appropriate to the request.

Where such information is not sufficient for the Customer to meet its obligations under Applicable Data Protection Laws, the Customer may conduct an audit relating to YeshBe’s processing of Customer Personal Data, subject to reasonable advance written notice, during normal business hours, under appropriate confidentiality obligations, in a manner that does not unreasonably interfere with YeshBe’s operations, and at the Customer’s expense.

13. U.S. Privacy Laws

Where U.S. Privacy Laws apply to YeshBe’s processing of Customer Personal Data on behalf of the Customer, YeshBe will:

• Not sell or share Customer Personal Data, as those terms are defined under the CCPA.
• Not retain, use or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement and this DPA, or outside the direct business relationship with the Customer, except as permitted by applicable U.S. Privacy Laws.
• Not combine Customer Personal Data with personal data received from or on behalf of another person, or collected from YeshBe’s own interactions with individuals, except as permitted by applicable U.S. Privacy Laws.
• Provide the level of privacy protection for Customer Personal Data required of a service provider or contractor under applicable U.S. Privacy Laws.
• Notify the Customer if YeshBe determines that it can no longer meet its obligations under applicable U.S. Privacy Laws.
• Allow the Customer to take reasonable and appropriate steps to help ensure that YeshBe uses Customer Personal Data consistently with the Customer’s obligations under applicable U.S. Privacy Laws and to stop and remediate unauthorized use where required by law.

14. Liability

Each party’s liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability set out in the Agreement, except to the extent such limitations are prohibited by Applicable Data Protection Laws or the applicable Standard Contractual Clauses.

15. General

This DPA is governed by the law that governs the Agreement, except where Applicable Data Protection Laws or the Standard Contractual Clauses require otherwise. If this DPA and the Agreement conflict with respect to the processing of Customer Personal Data, this DPA will prevail.

If this DPA conflicts with the Standard Contractual Clauses with respect to processing or transfers governed by those clauses, the Standard Contractual Clauses will prevail.

If any provision of this DPA is found invalid or unenforceable, the remaining provisions will remain in effect.

YeshBe may update this DPA from time to time. Any update will not materially reduce the overall level of protection provided to Customer Personal Data during the term of the Agreement. The “Last Updated” date displayed at the top of this DPA identifies the date of the most recent revision.

Annex 1: Description of processing

Parties

Data exporter

The Customer, as identified in its YeshBe account, order form or Agreement. Depending on the circumstances, the Customer acts as a controller or processor.

Data importer

Yesh Platforms LLC. Contact: privacy@yeshbe.com. YeshBe acts as a processor or sub-processor, as applicable.

Nature and purpose of processing

YeshBe is an AI-powered application and website builder. Customers describe software and digital products in natural language, and YeshBe generates, modifies, hosts, operates and helps maintain those products.

Processing may include receiving, transmitting, storing, hosting, generating, analyzing, retrieving, modifying and deploying code, prompts, files, content, databases and other project data as necessary to provide, secure, support and maintain the services requested by the Customer.

Categories of data subjects

• The Customer’s account users, including employees, contractors, developers and collaborators.
• End users and visitors of apps, websites and digital products that the Customer builds or publishes using YeshBe.
• Other individuals whose personal data the Customer chooses to process through its projects, subject to the Agreement and this DPA.

Categories of personal data

• Account data, including name, email address, profile information and billing contact details.
• Content and project data, including personal data entered by the Customer or its end users into projects, prompts, forms, files and databases.
• Technical data, including IP address, device information, browser information, diagnostic information and usage logs.
• Other personal data that the Customer chooses to process using the services, subject to the restrictions in the Agreement and this DPA.

Sensitive data

The services are not intended for processing special categories of personal data under the GDPR, protected health information subject to HIPAA, payment card data, or government identification numbers unless YeshBe has expressly agreed otherwise in writing.

Frequency and duration

Processing occurs on a continuous or Customer-directed basis for the term of the Agreement and for the applicable retention and deletion period described in section 11.

Sub-processors

YeshBe currently uses the following Sub-processors in connection with the services:

OpenAI

Artificial intelligence processing used to generate, modify and assist with applications, websites, interfaces, code and related project content.

Anthropic (Claude)

Artificial intelligence processing used to generate, modify and assist with applications, websites, interfaces, code and related project content.

Google (Gemini)

Artificial intelligence processing used to generate, modify and assist with applications, websites, interfaces, code and related project content.

Twilio

Communications, messaging and related communications infrastructure.

Twilio SendGrid

Transactional email delivery and related email infrastructure.

YeshBe may update its list of Sub-processors from time to time in accordance with section 7 of this DPA.

Annex 2: Technical and organizational measures

YeshBe maintains technical and organizational measures designed to provide a level of security appropriate to the nature and risk of the processing of Customer Personal Data. These measures include, as applicable:

Access control

Access to production systems and Customer Personal Data is restricted to authorized personnel based on business need and the principle of least privilege.

Encryption and transmission security

YeshBe uses industry-standard encrypted communication protocols to protect Customer Personal Data transmitted over public networks. Data stored by YeshBe is protected using security and encryption capabilities provided by YeshBe’s infrastructure providers, where applicable.

Authentication

YeshBe maintains authentication and access-control mechanisms designed to prevent unauthorized access to systems and services that process Customer Personal Data.

Logging and monitoring

YeshBe uses logging and monitoring mechanisms designed to identify unauthorized access, security events, system failures and other operational issues affecting its production environment.

Backups and recovery

YeshBe maintains backup and recovery procedures appropriate to the services to reduce the risk of accidental loss or destruction of Customer Personal Data.

Secure development

YeshBe applies secure software development and deployment practices designed to reduce security vulnerabilities and unauthorized changes to its services.

Incident response

YeshBe maintains procedures for identifying, investigating, containing, mitigating and responding to suspected security incidents involving Customer Personal Data.

Confidentiality

Personnel authorized to access Customer Personal Data are subject to appropriate confidentiality obligations.

Data deletion

YeshBe maintains procedures designed to delete or anonymize Customer Personal Data in accordance with section 11 of this DPA and applicable retention requirements.

Sub-processor security

YeshBe requires Sub-processors that process Customer Personal Data to maintain appropriate technical and organizational measures designed to protect that data.

YeshBe may modify these measures as technologies and security practices evolve, provided that such modifications do not materially reduce the overall level of protection provided to Customer Personal Data.

Annex 3: International data transfers

EU Standard Contractual Clauses

Where the transfer of Customer Personal Data from the European Economic Area to YeshBe requires an appropriate safeguard under Chapter V of the GDPR, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 are incorporated into this DPA by reference.

Module Two (Controller to Processor) applies where the Customer acts as a controller and YeshBe acts as a processor. Module Three (Processor to Processor) applies where the Customer acts as a processor and YeshBe acts as a sub-processor.

For purposes of Annex I of the Standard Contractual Clauses, the identity and contact details of the parties, categories of data subjects, categories of personal data, nature and purpose of processing, frequency of processing and duration of processing are described in Annex 1 of this DPA.

For purposes of Annex II of the Standard Contractual Clauses, the technical and organizational measures implemented by YeshBe are described in Annex 2 of this DPA.

The competent supervisory authority will be determined in accordance with Clause 13 of the Standard Contractual Clauses.

United Kingdom

Where Customer Personal Data protected by the UK GDPR is transferred to a country that does not provide an adequate level of protection, the then-current International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner will apply to the relevant transfer.

Additional transfer safeguards

YeshBe will use commercially reasonable efforts to maintain appropriate safeguards for international transfers of Customer Personal Data as required by Applicable Data Protection Laws and will cooperate with the Customer where reasonably necessary to address applicable international transfer requirements.

If YeshBe receives a legally binding request from a government or public authority for Customer Personal Data, YeshBe will, where legally permitted, notify the Customer and use reasonable efforts to redirect the requesting authority to the Customer. YeshBe will review such requests and challenge them where YeshBe reasonably considers there are lawful grounds to do so.