Data Processing Addendum

This Data Processing Addendum, or DPA, forms part of the applicable agreement between Avvi AI LLC, or Avvi, and the customer organization that uses the Services, or Customer. It applies only when Avvi processes Personal Data on Customer’s behalf in its role as a processor.

1. Roles and instructions

Customer is the controller and Avvi is the processor for Personal Data processed through the Services, unless applicable law requires a different allocation. Avvi will process Personal Data only on Customer’s documented instructions, including the agreement and use of the Services, unless applicable law requires otherwise.

2. Processing details

Subject matter and purpose: providing, securing, supporting, and improving the Microsoft 365 administration services requested by Customer. Duration: the term of the applicable agreement and any period required to return or delete data under this DPA. Data subjects: Customer personnel, Customer client-tenant personnel, and other individuals whose data is included in an authorized request. Data: account and identity data, tenant and Microsoft 365 configuration data, authorized prompts and responses, audit and security records, and support information. Operations: collection, storage, consultation, transmission, alteration, restriction, deletion, and other processing needed to provide the Services.

3. Confidentiality and security

Avvi will ensure that personnel authorized to process Personal Data are bound by confidentiality obligations. Avvi will implement appropriate technical and organizational measures, taking account of the nature of processing and the risks involved, including access controls, tenant isolation, authentication, logging, and security monitoring appropriate to the Services.

4. Subprocessors

Customer gives Avvi general authorization to use subprocessors that are necessary to provide the Services. Avvi will impose written data-protection obligations on subprocessors that are appropriate to the processing they perform. Current information about material service providers is available at Subprocessors. Avvi will make information about intended material changes available as required by applicable law or the applicable agreement.

5. Assistance

Taking account of the nature of processing, Avvi will provide reasonable assistance to Customer with requests from data subjects and with Customer’s obligations concerning security, breach notification, data protection impact assessments, and consultations with supervisory authorities, where applicable.

6. Personal Data Incidents

Avvi will notify Customer without undue delay after becoming aware of a Personal Data Incident affecting Personal Data processed under this DPA. The notice will contain available information reasonably needed for Customer to assess and respond to the incident.

7. International transfers

Avvi will not transfer Personal Data outside the applicable jurisdiction except on Customer’s documented instructions or where permitted or required by applicable law. Where a transfer mechanism is required, the parties will cooperate in good faith to implement an appropriate lawful mechanism.

8. Return or deletion

At the end of the Services, Avvi will return or delete Personal Data at Customer’s choice, unless applicable law requires retention. This does not require deletion of information that Avvi must retain for legal, security, or evidentiary purposes, provided that it remains protected and is not used for unrelated purposes.

9. Information and audits

Avvi will make available information reasonably necessary to demonstrate compliance with this DPA. Customer may audit Avvi’s compliance on reasonable written notice, during normal business hours, and in a manner that does not unreasonably disrupt the Services or expose another customer’s confidential information.

10. Priority and contact

For processing of Personal Data, this DPA controls to the extent it conflicts with the applicable agreement. Questions or requests concerning this DPA can be sent to info@avvi.cloud.