Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Twixium AI Terms of Service between Twixium AI Inc. ("Processor," "Twixium AI") and the business customer ("Customer," "Controller"). It applies whenever Twixium AI processes personal data on the Customer's behalf, including data subject to the EU GDPR, the UK GDPR or the Swiss FADP. Customers accept it by accepting the Terms. A countersigned copy is available on request from support@twixium.ai.

The Customer is the controller, and Twixium AI is the processor, of End Customer Data: the personal data of the Customer's customers, guests, patients, leads and staff that is processed through LUNA and the platform. Annex I describes the processing.

Twixium AI processes End Customer Data only on the Customer's documented instructions. These are the Terms, this DPA and the Customer's configuration of the service. The only exception is where the law requires otherwise, in which case Twixium AI will inform the Customer unless the law prohibits it. Twixium AI will tell the Customer if it believes an instruction infringes data protection law.

Everyone Twixium AI authorizes to process End Customer Data is bound by confidentiality.

Twixium AI maintains the technical and organizational measures in Annex II. It may update them, as long as the overall level of protection does not decrease.

The Customer gives general authorization for Twixium AI to use subprocessors. Our current list of subprocessors is available to customers and prospective customers on request by emailing support@twixium.ai with the subject "Subprocessor list".

• Twixium AI will give at least 30 days' notice before adding a new subprocessor of End Customer Data, by email to account owners who have asked to receive these notices.
• The Customer may object on reasonable data protection grounds. If the parties cannot resolve the objection, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees.
• Twixium AI imposes data protection obligations on its subprocessors that are no less protective than this DPA, and remains responsible for them.

Taking into account the nature of the processing, Twixium AI will help the Customer respond to requests from individuals (access, deletion, correction, portability, restriction, objection). If Twixium AI receives such a request directly, it will forward it to the Customer and will not respond itself unless the Customer instructs it to.

Twixium AI will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting End Customer Data. The notice will include the information then available, so the Customer can meet its obligations under Articles 33 and 34 GDPR.

Twixium AI will provide reasonable help with data protection impact assessments and prior consultations with supervisory authorities.

When the service ends, Twixium AI will delete End Customer Data within 30 days, unless the law requires it to be kept. Before closing the account, the Customer can export its data or ask for an export.

Twixium AI will make available the information needed to demonstrate compliance with Article 28 GDPR.

• It will allow an audit, at most once a year, with 30 days' notice, during business hours, at the Customer's cost and subject to confidentiality.
• The audit may be carried out by the Customer or by an independent auditor bound by confidentiality.
• Written answers and documentation will be used first where they are enough.

Where End Customer Data is transferred from the EEA to Twixium AI in the United States, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated by reference, with these choices:

• Module Two (controller to processor), with the Customer as data exporter and Twixium AI as data importer;
• Clause 7 (docking) applies;
• Clause 9: option 2 (general authorization), with the notice period in section 5;
• Clause 11: the optional language does not apply;
• Clause 13: the supervisory authority of the Customer's EU establishment or representative;
• Clauses 17 and 18: the law and courts of Ireland.

The Annexes to this DPA complete the SCC Annexes. For the UK, the ICO International Data Transfer Addendum (version B1.0) applies, completed with the information in this DPA. For Switzerland, the SCCs apply with the FADP as governing law for Swiss transfers and the FDPIC as the competent authority.

The Customer is responsible for:

• having a lawful basis for the End Customer Data it collects through LUNA, including WhatsApp opt-in where Meta's policies require it;
• giving End Customers the privacy information the law requires;
• making sure End Customers are told they are interacting with an AI system where the law requires it (including Article 50 of the EU AI Act), and not configuring LUNA to claim to be human;
• not using LUNA to intentionally collect special categories of data unless it has a valid legal basis.

Each party's liability under this DPA is subject to the limitations in the Terms, except where the SCCs or applicable law do not allow limitation. If this DPA conflicts with the Terms, this DPA prevails. If the SCCs conflict with anything else, the SCCs prevail.

Data exporter

the Customer (identified in its account).

Data importer

Twixium AI Inc., 221 W 9th St PMB 955, Wilmington, DE 19801, USA; support@twixium.ai.

Data subjects

the Customer's customers, guests, patients, leads, reviewers and staff who interact with LUNA or are entered into the platform.

Categories of data

names, phone numbers and WhatsApp IDs, email addresses, message content, booking and reservation details (party size, preferences, notes), reviews and feedback, and short memories LUNA keeps about returning customers.

Special categories

not intended. End Customers may volunteer them (for example, health information when booking a dental appointment). When they do, the same safeguards apply.

Frequency

continuous.

Nature and purpose

hosting and storing the data; using AI models to understand messages and draft replies; sending messages, confirmations and reminders; managing bookings and reviews; analytics for the Customer's dashboard.

Duration

the term of the service, plus up to 30 days for deletion.

• Encryption in transit (TLS 1.2+) and at rest (AES-256, provided by the hosting provider).
• Tenant isolation through database row-level security; service-role keys are used only server-side.
• Least-privilege administrative access, removed promptly when people leave.
• Access tokens for connected services are stored server-side in access-restricted tables and are never written to logs.
• Rate limiting and input validation on public endpoints.
• Daily managed backups on the hosting provider.
• AI providers are accessed through an API gateway, under terms that prohibit training on customer data.
• Logging and monitoring of the platform, and an incident-response procedure with breach notification as described in section 7.
• Data minimization: LUNA reads only calendar free/busy data, not the content of events.

Available on request from support@twixium.ai.