Data Processing Addendum

1.Scope and roles

This Data Processing Addendum ("DPA") is part of the agreement between GenX Pro LLC ("GenX Pro", "Processor") and a business customer ("Customer") for the GenX Pro services, including the Terms of Service and, where used, the GenX Router API Terms (the "Agreement"). It applies when GenX Pro processes personal data on Customer's behalf ("Customer Personal Data") that is subject to Data Protection Laws, such as the EU and UK General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection and U.S. state privacy laws including the California Consumer Privacy Act (CCPA).

Customer is the controller (or a processor acting for its own controller), and GenX Pro is the processor (or subprocessor) of Customer Personal Data. Under the CCPA, GenX Pro is a service provider. Personal data that GenX Pro processes as a controller, such as account and billing information, is covered by our Privacy Policy instead.

Customer is responsible for collecting and using Customer Personal Data lawfully, giving required privacy notices, and obtaining permissions needed for its instructions to GenX Pro. A Customer acting as a processor must have its controller's authorization to use GenX Pro.

This DPA applies automatically to Customer's use of the services. A countersigned copy is available on request from support@genx.pro. If this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA controls. The SCCs and UK Addendum described in Section 11 take priority over conflicting terms in either document.

GenX Pro's contact details: GenX Pro LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States; support@genx.pro.

2.Details of processing

• Subject matter and purpose: providing the services, including running requests through AI models and tools, storing conversations, files and outputs, Teams, Cloud Library and the GenX Router API, and related support and security.
• Nature: collection, storage, transmission to AI providers, generation, retrieval, deletion and other processing needed to provide the services.
• Duration: the term of the Agreement, plus the deletion period in Section 9.
• Data subjects: Customer's personnel and team members, and any individuals whose personal data Customer or its end users submit.
• Categories of data: identification and contact data, account and usage data, and any personal data contained in prompts, messages, files, images, audio, video, code and outputs.
• Sensitive data: Customer should not submit special categories of personal data unless needed for its use of the services and lawful. Customer is responsible for that decision.

3.Processing on instructions

GenX Pro processes Customer Personal Data only on Customer's documented instructions, which are the Agreement, this DPA and Customer's use and configuration of the services, unless the law requires otherwise; in that case GenX Pro will inform Customer before processing where the law allows. GenX Pro will tell Customer if it believes an instruction violates Data Protection Laws.

GenX Pro does not sell Customer Personal Data or share it for cross-context behavioral advertising, does not use it to train AI models, and does not use, retain or disclose it for any purpose other than providing the services described in Section 2, or outside the direct business relationship with Customer, except as the CCPA permits for service providers. GenX Pro will not combine it with personal data from other customers or its own interactions with individuals, except as the CCPA permits.

GenX Pro will comply with applicable Data Protection Laws and provide the level of privacy protection the CCPA requires. If GenX Pro can no longer meet these obligations, it will notify Customer. Customer may take reasonable steps to verify compliance and, on notice, stop and remedy unauthorized use of Customer Personal Data.

4.Confidentiality

GenX Pro ensures that people authorized to process Customer Personal Data are bound by confidentiality obligations and access it only as needed to provide the services.

5.Security

GenX Pro maintains technical and organizational measures appropriate to the risk, including:

• Encryption of data in transit (TLS) and encryption of stored data at rest.
• Authenticated access to account and workspace functions, account and team access controls, and internal access limited to what staff need for their work. Generated media and Cloud Library files are delivered through unlisted links that can be opened by anyone who has the link.
• Hosting on infrastructure providers with industry-recognized security certifications.
• Secret management, logging and monitoring, and prompt remediation of security issues.
• Deletion processes for content and accounts as described in our Privacy Policy.

6.Subprocessors

Customer authorizes GenX Pro to engage the subprocessors listed on our Subprocessors page. GenX Pro imposes data protection obligations on each subprocessor that are no less protective than this DPA, and remains responsible for their performance.

GenX Pro will update the list and notify affected Customers at their account contact email at least 15 days before adding or replacing a subprocessor. Customer may object on reasonable data protection grounds within 10 days of notice by emailing support@genx.pro. The parties will work to resolve the objection; if they cannot within 10 days after the objection, Customer may terminate the affected services without penalty. GenX Pro will not send Customer Personal Data to the proposed subprocessor while a timely objection remains unresolved.

7.Assistance

Taking into account the nature of the processing, GenX Pro will help Customer respond to requests from data subjects to exercise their rights, mainly through the deletion and export features of the services, and will forward to Customer any such request it receives about Customer Personal Data. GenX Pro will provide reasonable information to help Customer with data protection impact assessments and consultations with supervisory authorities.

8.Security incidents

GenX Pro will notify Customer without undue delay after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. The notice will describe the incident, its likely consequences and the measures taken, as that information becomes available. GenX Pro will take reasonable steps to contain and remedy the incident and help Customer meet its own notification obligations. Notice is not an admission of fault.

9.Deletion and return

Customer can delete and export its content using the services. When the Agreement ends, Customer may choose to have Customer Personal Data returned before deletion by contacting support@genx.pro. Within 30 days after the Agreement ends or Customer's account is closed, GenX Pro will delete Customer Personal Data from active systems, except data it must keep by law, which it will continue to protect under this DPA. Copies in backups are overwritten within a further 30 days. GenX Pro will confirm deletion in writing on request.

10.Audits

GenX Pro will provide information reasonably needed to demonstrate compliance with this DPA and allow audits and inspections required by Data Protection Laws. Routine reviews start with available documentation and written questions, normally no more than once a year. Further audits normally require 30 days' notice and take place during business hours, at Customer's cost, with confidentiality protections and reasonable steps to avoid disruption. These arrangements do not restrict rights under Data Protection Laws or the SCCs, or delay urgent reviews after a security incident.

11.International transfers

GenX Pro and its subprocessors process data in the United States and other countries. For transfers of Customer Personal Data from the European Economic Area to a country without an adequacy decision, the parties incorporate the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 ("SCCs"): Module 2 where Customer is a controller and Module 3 where Customer is a processor. For those SCCs: the optional docking clause in Clause 7 applies; Option 2 (general authorization) applies under Clause 9, with the notice period in Section 6 above; the optional language in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Ireland; and the details of processing are those in Section 2 and the security measures those in Section 5.

Annexes. For the SCCs and the UK Addendum: Annex I.A (the parties) is Customer, as identified by its GenX Pro account details, as data exporter, and GenX Pro LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States, contact support@genx.pro, as data importer, each signing by accepting the Agreement; Annex I.B (description of the transfer) is Section 2, with transfers made on a continuous basis for the duration of the Agreement; Annex I.C (competent supervisory authority) is the authority determined under Clause 13; Annex II (technical and organizational measures) is Section 5; and Annex III (subprocessors) is our Subprocessors page. In Table 4 of the UK Addendum, either party may end the Addendum as set out in its Section 19.

For transfers from the United Kingdom, the UK International Data Transfer Addendum to the SCCs (version B1.0) applies. For transfers governed by Swiss law, the SCCs also protect Swiss personal data, references to the GDPR include the Swiss Federal Act on Data Protection where applicable, and the Swiss Federal Data Protection and Information Commissioner is the competent authority for Swiss transfers. These adaptations do not remove protections that apply to EU or UK data. GenX Pro may rely on another lawful transfer mechanism if available and will notify Customer.

12.Liability and term

Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where Data Protection Laws or the SCCs do not allow it. This DPA lasts as long as GenX Pro processes Customer Personal Data.