Subject to any mandatory provisions in the SCCs, this DPA and any dispute arising under it shall be governed by the laws of the Republic of Moldova, and the parties submit to the exclusive jurisdiction of the courts of Chisinau, Moldova.

Schedule 1: Details of Processing

A. Subject Matter and Duration of Processing

The subject matter of the Processing is the provision of AI‑driven workflow automation services as described in the Principal Agreement. The Processing will last for the term of the Principal Agreement plus the period until all Customer Personal Data is returned or deleted according to Section 9.

B. Categories of Data Subjects

Individuals whose communications are processed through the Customer’s authorised integrations, including employees, contractors, clients, and other participants in conversation channels.

C. Categories of Personal Data Processed

Account Information: Names, email addresses, job titles and contact details of users and administrators.
Communication Content: Chat messages, call and meeting transcripts, prompts, attachments, files, AI prompts, AI outputs and contextual task information processed by the Services.
Task and Workflow Data: Extracted commitments, assigned responsibilities, deadlines, follow‑up statuses and related metadata.
Technical & Usage Data: IP addresses, device identifiers, browser types, usage logs and other telemetry used for security, monitoring and optimization

D. Special Categories of Personal Data

The Data Processor does not intentionally collect or process special categories of Personal Data (e.g., health data or political opinions). However, because the Services analyse unstructured communication channels, special categories of data may be incidentally processed if submitted by Data Subjects. The Customer remains responsible for ensuring that a valid legal basis exists for such processing and for configuring appropriate filters within integrations.

E. Customer’s Obligations and Rights

The Customer determines the purposes and means of the Processing. The Customer is responsible for ensuring that:

Customer Personal Data is collected and processed lawfully;
appropriate notices and consents are obtained;
the Customer’s instructions to the Data Processor comply with Data Protection Laws; and
transfers to the Data Processor comply with Chapter V of the GDPR and other applicable laws.

Schedule 2: Technical and Organizational Measures

This schedule outlines the Data Processor’s security controls implemented to protect Customer Personal Data. These controls are subject to technological evolution and may be updated, provided the level of security is not reduced:

Encryption and Key Management: Data is encrypted at rest and in transit using AES‑256 and TLS 1.3. Encryption keys are managed via a dedicated key management service with strict access controls.
Access Control and Identity Management: Access to systems is governed by RBAC and enforced via identity and access management solutions with multi‑factor authentication. Privileged access is limited and regularly reviewed.
Network and Infrastructure Security: The platform is hosted in secure data centres with physical security controls. Network traffic is segmented and protected by firewalls, intrusion detection and prevention systems, and DDoS mitigation.
Application Security: Secure coding practices, static and dynamic security testing, dependency vulnerability scans, and regular third‑party penetration tests are used to identify and remediate vulnerabilities. AI components undergo adversarial and robustness testing.
Operational Security: System logs are collected, monitored and retained to detect anomalous activities and support forensic analysis. AI model outputs are monitored for drift, bias and hallucinations, with mechanisms to suspend or retrain models if significant issues are detected.
Data Minimization and Retention: Customer Personal Data is retained only for as long as necessary to provide the Services. Data is pseudonymised or anonymised where feasible for analytics and system improvement.
Business Continuity and Disaster Recovery: Business continuity and disaster recovery plans ensure resilience of the Services. Backups are encrypted and stored in geographically separate regions.
Vendor and Subprocessor Management: Subprocessors are vetted for security capabilities and contractual commitments, including compliance with the SCCs. Continuous oversight is maintained through security assessments and monitoring.
Staff Training and Awareness: All employees and contractors receive regular training on data protection, information security, AI governance, and relevant compliance obligations.
Incident Management: A formal incident response plan is maintained, including procedures for identifying, reporting, investigating and remediating incidents. Post‑incident reviews are performed to prevent recurrence.

Schedule 3: Subprocessor List

The Data Processor utilizes the following categories of Subprocessors to provide the Services. An up‑to‑date list of specific Subprocessors is available at https://ligoflow.ai/subprocessors. Typical categories include:

Cloud Infrastructure Providers (e.g., IaaS providers for computing, storage, networking)
AI Model and Natural Language Processing Providers (e.g., GPU or inference infrastructure)
Communication Platform Integrations (e.g., Slack, Microsoft Teams, Discord, Zoom)
Productivity and Ticketing Integrations (e.g., Jira, Asana, Trello, Notion)
Analytics and Monitoring Tools
Customer Support Platforms
Security and Email Delivery Providers

Before engaging any new Subprocessor, the Data Processor will notify the Customer pursuant to Section 5 and provide an opportunity to object. The Customer can subscribe to updates regarding Subprocessors or request a copy of the current list at any time.

Schedule 4: Standard Contractual Clauses (SCC) Summary

This schedule summarizes how the parties comply with the 2021 Standard Contractual Clauses (SCCs) for international transfers:

Modules Applied: Module 2 (Controller–Processor) for Customer Personal Data processed by the Data Processor, and Module 3 (Processor–Processor) where the Data Processor engages Subprocessors. The parties agree that, for each transfer, the appropriate module is deemed selected and completed.
Appendix I: Parties’ details, description of transfer, categories of data, frequency, and recipients, correspond to the information in Schedule 1 of this DPA.
Appendix II: Technical and organizational measures correspond to Schedule 2 of this DPA.
Governing Law and Choice of Courts: For Module 2 and Module 3, Clause 17 and Clause 18 are set to the law and courts of an EU Member State (default: Ireland) to ensure enforceability of third‑party beneficiary rights. The parties may elect another EU jurisdiction by mutual agreement.
Optional Docking Clause: The parties agree that additional controllers and processors may accede to the SCCs using Clause 7 as required to reflect multi‑party transfers.
Local Law Assessments: The Data Processor has conducted a transfer impact assessment evaluating the laws and practices of Moldova and, as of the date of this DPA, confirms that there are no laws that would compel disclosure of Customer Personal Data in a manner contrary to the SCCs without appropriate safeguards. The Data Processor commits to notifying the Customer if this assessment changes.

Schedule 5: AI Governance Addendum

A. Applicability of the EU Artificial Intelligence Act

Regulation (EU) 2024/1689, commonly referred to as the “AI Act”, entered into force on 1 August 2024, with most obligations applying in phases and the majority taking effect on 2 August 2026. The AI Act introduces a risk‑based regulatory framework for AI systems, prohibiting certain harmful uses and imposing obligations on providers of high‑risk systems. The Data Processor’s AI Systems focus on workflow automation and are not used in high‑risk domains such as employment, credit scoring, education, healthcare, or law enforcement. Accordingly, the Data Processor considers its AI Systems to fall within the limited or minimal‑risk categories. Nonetheless, the Data Processor commits to the following governance measures:

B. Risk Assessment and Management

Identify and document AI System use cases, data sources, and decision pathways.
Conduct regular risk assessments evaluating fairness, transparency, accuracy, bias and potential harm.
Implement mitigation measures, including human‑in‑the‑loop review for significant AI decisions.

C. Prohibited Practices

The Data Processor does not engage in prohibited practices under the AI Act, including social scoring, emotion recognition in workplaces, or untargeted scraping of facial images. If the Customer attempts to use the Services for such purposes, the Data Processor reserves the right to suspend or terminate the Services.

D. Transparency and Explainability

Provide clear documentation of AI features and limitations and, where possible, explanations of AI‑generated outputs and recommendations.
Label AI‑generated tasks, reminders or escalations so users can distinguish them from manually created content.

E. Data Governance

Ensure training and evaluation datasets are representative and minimised, and exclude sensitive or special‑category data unless strictly necessary.
Apply data minimisation and pseudonymisation techniques to reduce privacy risks.

F. Human Oversight

Maintain human oversight for all AI decisions that could materially affect individuals (e.g., assignment of work tasks). Provide controls for users to review, adjust or override AI‑suggested actions.

G. Model Monitoring and Updates

Monitor AI model performance for drift, bias and hallucinations, and implement mechanisms to update or retrain models as needed without exposing Customer Personal Data.

H. Customer Responsibilities

Customers are responsible for determining whether their use of the Services is subject to the AI Act or other AI‑related laws and for implementing additional compliance measures where required.

Schedule 6: Breach Notification Template

If a Personal Data Breach occurs, the Data Processor will provide a written notification containing at least the following information (template to be adjusted depending on the breach):

Incident Overview: Date and time of the breach discovery, summary of the incident and affected systems.
Data Involved: Categories of Customer Personal Data affected and estimated number of Data Subjects.
Impact Assessment: Potential consequences for Data Subjects and the Services.
Measures Taken: Immediate actions taken to contain the incident, mitigate adverse effects and prevent recurrence.
Recommendations: Guidance for the Customer on steps to protect Data Subjects (e.g., reset passwords, monitor accounts).
Contact Information: Name and contact details of the Data Processor’s incident response contact.
Regulatory Notifications: If applicable, confirmation of notification to relevant supervisory authorities and cooperation details.

Schedule 7: Privacy Policy Alignment Checklist

The Customer’s public privacy notice (and the Data Processor’s own privacy policy) should be aligned with the processing described in this DPA. Key items to address include:

Data Collected: Describe the types of personal data collected via LigoFlow.ai integrations, including communication content and derived action items.
Purposes and Legal Bases: Clearly explain the purposes of processing (e.g., task automation, accountability, analytics) and the lawful bases relied upon.
AI Use and Logic: Disclose the use of AI Systems, including the logic involved, its significance and foreseeable consequences for data subjects, in accordance with Articles 13 and 14 of the GDPR and transparency requirements in the AI Act.
Data Sharing: Identify categories of recipients (e.g., Subprocessors, third‑party integrations) and cross‑border transfer mechanisms (e.g., SCCs, UK Addendum, Swiss clauses).
Retention: Specify retention periods or criteria used to determine retention, and describe archiving and deletion practices.
Rights and Choices: Outline data subject rights (access, rectification, erasure, restriction, portability, objection, and rights under the CCPA/CPRA) and how to exercise them.
Security Measures: Provide high‑level information about technical and organisational security measures without revealing confidential details.
Contact Information: Provide contact details for data protection inquiries, including any required EU/UK representative or Data Protection Officer, and reference this DPA for further details.
Updates: State how privacy notices will be updated and how users will be informed of material changes.

Data Processing Agreement

1. Introduction

2. Definitions and Interpretation

3. Processing of Customer Personal Data

4. Processor Personnel and Confidentiality

5. Security Measures

6. Subprocessing

7. Data Subject Rights

8. Personal Data Breach

9. Data Protection Impact Assessments (DPIAs)

10. Return or Deletion of Data

11. International Data Transfers

12. Audits and Inspections

13. Governing Law and Jurisdiction