Data Processing Agreement

Draft — pending legal approval. This placeholder is provided for product integration and review only. It contains unresolved bracketed fields and is not a final or legally approved version. Do not rely on it as legal advice or as the final terms governing the service.

These annexes form part of the Xailon Token Factory Terms of Use. Capitalised terms have the meanings given in the Terms.

Annex B — Data Processing Addendum

B.1 Scope and roles

B.1.1 This Data Processing Addendum ("DPA") forms part of the Agreement and applies to the extent Infinia processes Personal Data on behalf of the Customer in providing the Service. In respect of Personal Data contained in Customer Content, the Customer is the controller (or a processor acting for its own controller) and Infinia is the processor. In respect of account, billing, identity-verification and Usage Data that Infinia processes for its own purposes, including to administer the relationship, meter and bill, detect abuse, comply with law and improve the Service, Infinia is an independent controller and the Privacy Notice applies.

B.1.2 Definitions. "Personal Data", "controller", "processor", "data subject", "processing", "special categories" and "supervisory authority" have the meanings given in the applicable Data Protection Law and, where none is given, in the GDPR. "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data processed by Infinia on the Customer's behalf. "Sub-processor" means a third party engaged by Infinia to process Customer Personal Data.

B.1.3 Details of processing. The subject matter of processing is the provision of the Service. The duration is the Term plus the deletion period in B.9. The nature of processing is transient computation of Inputs to generate Outputs, and storage where the Customer uses a storage feature. The purpose is to provide the Service in accordance with the Customer's instructions. The types of Personal Data and categories of data subjects are determined by the Customer and may include any type or category the Customer chooses to submit, including special categories, subject to Section 8.5 of the Terms.

B.2 Customer's instructions and obligations

B.2.1 Infinia will process Customer Personal Data only on the Customer's documented instructions, which are: the Agreement; the Customer's configuration of the Service, including Region Scope, Service Mode, Model selection and storage settings; each API request; and any further written instruction agreed between the parties. Infinia will inform the Customer if, in its opinion, an instruction infringes Data Protection Law, without obligation to carry out a legal review.

B.2.2 The Customer is responsible for the lawfulness of the Personal Data it submits, for having a legal basis and any consents required, for providing notices to data subjects, for conducting any data-protection impact assessment its use requires, for selecting a Sovereign Zone and configuration appropriate to the data, and for responding to data subjects.

B.3 Confidentiality of personnel

B.3.1 Infinia will ensure that persons authorised to process Customer Personal Data are bound by written confidentiality obligations or an appropriate statutory duty, receive appropriate training, and have access only on a need-to-know basis in accordance with Section 6.7 of the Terms.

B.4 Security

B.4.1 Infinia will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against Security Incidents, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of processing, including the measures described in B.12. Infinia may update those measures provided the overall level of protection is not materially reduced.

B.4.2 Zero retention as a security measure. Because Inputs and Outputs are not retained and are not inspected (Section 6.3 of the Terms), the only Personal Data that Infinia holds at rest on the Customer's behalf is that contained in Stored Objects. The Customer acknowledges that the zero-retention design also means Infinia cannot retrieve, correct, produce or review an Input or Output after a request has completed, and cannot assist with a data-subject request that relates to one. The two integrity controls in Section 6.10 of the Terms are applied to Stored Objects as a security and child-protection measure; neither reads the substantive content of a Stored Object, and neither is applied to Inputs or Outputs.

B.5 Sub-processors

B.5.1 The Customer gives general authorisation for Infinia to engage Sub-processors, including Zone Operators, compute partners and the providers of payment, identity-verification, notification and support tooling. The Sub-processors engaged as at the effective date of these Terms are listed in Annex D, which states for each its role, the Personal Data it processes, its place of processing and the Sovereign Zones for which it is used. The current list is also published at [Sub-processor URL], and the Customer may subscribe there to notifications of changes.

B.5.2 Infinia will give the Customer not less than thirty days' notice by email or portal notification before authorising a new Sub-processor to process Customer Personal Data. The Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection within thirty days, the Customer may terminate the affected part of the Service on notice and receive a refund of prepaid Fees for the unperformed period as its sole remedy.

B.5.3 Infinia will impose on each Sub-processor, by written contract, data-protection obligations no less protective than this DPA, and remains liable to the Customer for the Sub-processor's performance. No Sub-processor is permitted to process Inputs or Outputs outside the Region Scope, or to use Customer Content for training or any purpose other than providing the Service.

B.6 No international transfers outside the Region Scope

B.6.1 Infinia will not transfer, and will not permit any Sub-processor to transfer, Customer Personal Data contained in Customer Content outside the Region Scope. Where the Customer's Region Scope comprises more than one Sovereign Zone in different jurisdictions, the Customer's selection constitutes its instruction that Personal Data may be processed in any of them, and the Customer is responsible for any transfer mechanism its own law requires between them.

B.6.2 Account, billing and support Personal Data for which Infinia is a controller may be processed in the locations stated in the Privacy Notice, subject to appropriate safeguards under Data Protection Law, including standard contractual clauses or adequacy decisions where required.

B.7 Assistance

B.7.1 Taking into account the nature of processing and the information available to it, Infinia will assist the Customer by appropriate technical and organisational measures in responding to requests from data subjects, and in meeting the Customer's obligations regarding security, Security Incident notification, impact assessments and prior consultation with supervisory authorities. Because Inputs and Outputs are not retained, Infinia's assistance with data-subject requests relating to them will ordinarily be limited to confirming that they are not held. Infinia may charge reasonable fees for assistance that exceeds what the Service and Documentation provide by default.

B.7.2 If Infinia receives a request directly from a data subject relating to Customer Personal Data, it will, to the extent legally permitted, redirect the data subject to the Customer and not respond substantively except on the Customer's instruction or as required by law.

B.8 Security Incident notification

B.8.1 Infinia will notify the Customer without undue delay, and in any event within twenty-four hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notification will describe, to the extent then known, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a point of contact, and Infinia will supplement it as further information becomes available. Notification is not an acknowledgement of fault. The Customer is responsible for any notification to supervisory authorities and data subjects that its law requires, and Infinia will provide reasonable cooperation.

B.8.2 Accelerated notification for regulated financial customers. Where the Customer has identified itself under Section 24.4 of the Terms as subject to Regulation (EU) 2022/2554 (DORA) or to an equivalent regime, Infinia will, in addition to Section B.8.1, provide an initial notification of any incident capable of being a major ICT-related incident for the Customer within four hours of becoming aware of it, by the escalation channel recorded against the Customer's Organisation, together with the information then available and a named contact who can be reached continuously until the incident is closed. The initial notification may be provisional and may be corrected. Infinia will thereafter provide intermediate and final reports at the intervals the Customer reasonably requires in order to meet its own regulatory deadlines, and will not treat the fact of an incident as Confidential Information to the extent the Customer must disclose it to its regulator.

B.9 Deletion and return

B.9.1 Inputs and Outputs are deleted on completion of each request under Section 6.3 of the Terms. A Stored Object is deleted when the Customer deletes it or, at the latest, within thirty days after the export period in Section 21.6(e) of the Terms ends, and Customer Models and Fine-Tuned Models are deleted in the same period. Annex C states the retention period for each category of data and the backup cycle within which residual encrypted copies are overwritten. Infinia will certify deletion on written request. Infinia may retain Personal Data to the extent required by Applicable Law, including the preservation required by Section A.3(b) of Annex A, in which case it will protect it in accordance with this DPA and process it only for that purpose.

B.10 Audit and information

B.10.1 Infinia will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, including its then-current third-party audit reports and certifications listed in the Trust Centre, responses to reasonable written security questionnaires not more than once per year, and the residency and attestation evidence available through the Service.

B.10.2 Where the information in B.10.1 is insufficient to satisfy a requirement of Data Protection Law or a supervisory authority, the Customer or an independent auditor bound by confidentiality and reasonably acceptable to Infinia may conduct an audit, not more than once in any twelve-month period except following a Security Incident or where required by a supervisory authority, on not less than thirty days' notice, during business hours, in a manner that does not disrupt the Service or compromise the security or confidentiality of other customers, and at the Customer's cost. Infinia may require the audit to be conducted by its own independent auditor where physical access to a Sovereign Zone is requested. The Customer will share the audit findings with Infinia and treat them as Infinia's Confidential Information.

B.11 Jurisdiction-specific terms

B.11.1 GDPR and UK GDPR. Where the GDPR or UK GDPR applies to the Customer's processing, this DPA constitutes the contract required by Article 28(3), the parties agree that Infinia's obligations under B.2 to B.10 satisfy the requirements of Article 28(3)(a) to (h), and Infinia will make available the information necessary to demonstrate compliance under Article 28(3)(h). The Customer acknowledges that Infinia's processing of Inputs and Outputs within an EU Sovereign Zone involves no transfer to a third country, because Section 6.1 of the Terms confines them to the Region Scope and Section 6.2 refuses any request that cannot be served within it. For the account, billing, identity-verification, support and website Personal Data described in Section B.6.2 — which is transferred to the Abu Dhabi Global Market, in respect of which the European Commission has made no adequacy decision — the parties incorporate the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, Module Two where the Customer is a controller and Module Three where the Customer is itself a processor, and the UK International Data Transfer Addendum where the UK GDPR applies. The clauses are incorporated with the options selected and the annexes completed as set out in Annex E, and Infinia has performed and will maintain the transfer impact assessment described in Annex E, Part 4, which it will make available to the Customer on request.

B.11.2 ADGM Data Protection Regulations 2021 and UAE Federal Decree-Law No. 45 of 2021. Where those laws apply, this DPA constitutes the written processing contract they require, Infinia will assist the Customer with any registration, notification or breach-reporting obligation under them, and the Customer acknowledges that processing within a UAE Sovereign Zone involves no cross-border transfer for the purposes of those laws.

B.11.3 Indian Digital Personal Data Protection Act 2023. Where that Act applies, the Customer is the Data Fiduciary and Infinia the Data Processor. Infinia will process personal data only under this DPA and the Customer's instructions, will implement reasonable security safeguards, will notify the Customer of personal data breaches under B.8 so that the Customer can notify the Data Protection Board and affected Data Principals, and will erase personal data on completion of the purpose or on the Customer's instruction under B.9. Processing within an Indian Sovereign Zone involves no transfer outside India.

B.11.4 Other laws. Where another Data Protection Law applies, the parties will comply with its requirements for processor contracts to the extent they are not already satisfied by this DPA and will, on either party's reasonable request, document any additional terms required.

B.12 Technical and organisational measures

B.12.1 Infinia maintains, and will maintain during the Term, measures including: (a) residency controls that bind each API Credential to a Region Scope and refuse requests that cannot be served within it; (b) zero retention of Inputs and Outputs, with logging limited to Usage Data; (c) encryption of Customer Content in transit using current industry-standard protocols and of stored objects at rest, with keys managed within the Sovereign Zone; (d) where offered for a Zone, confidential-computing execution with per-request attestation; (e) logical tenant isolation in shared Service Modes and physical or virtualised isolation in Dedicated Model Inference and GPU Clusters; (f) identity and access management with federated authentication, role-based access control and re-authentication for sensitive actions; (g) an immutable audit log of administrative and configuration changes, with signed residency exports available to the Customer; (h) least-privilege, logged and periodically reviewed access for Infinia personnel, restricted to the Zone for which they are authorised; (i) vulnerability management, secure development practices and independent penetration testing at least annually; (j) malware and unsafe-format scanning of Customer Models and uploaded files; (k) business-continuity and disaster-recovery arrangements appropriate to each Service Mode as described in the SLA; (l) security-incident response procedures with defined escalation and notification; (m) background verification of personnel to the extent permitted by local law; and (n) independent certification of its information-security and AI-management systems as listed in the Trust Centre.

B.13 Liability and precedence

B.13.1 Each party's liability under this DPA is subject to Section 20 of the Terms, including Section 20.4. In the event of conflict between this DPA and any other part of the Agreement in respect of the processing of Personal Data, this DPA prevails, and in the event of conflict between this DPA and the Standard Contractual Clauses or other mandatory transfer mechanism, that mechanism prevails to the extent of the conflict.

B.13.2 This DPA survives termination of the Agreement for as long as Infinia processes Customer Personal Data.

B.14 Personal Data for which Infinia is a controller

B.14.1 This DPA governs Infinia's processing of Personal Data on the Customer's behalf. Infinia separately processes Personal Data as a controller in its own right, as described in Section 6.11 of the Terms and in the Privacy Notice. That data comprises account and Organisation records, Authorised User identity and role records, billing and tax records, identity-verification and sanctions-screening records, support correspondence, security and audit logs, Usage Data and website and portal data. It does not include Inputs or Outputs, which Infinia does not retain, and it does not include the content of Stored Objects.

B.14.2 Section B.7.2 requires Infinia to redirect a data subject to the Customer. That requirement applies only to Customer Personal Data. Where an individual asks Infinia to exercise a right in respect of Personal Data for which Infinia is the controller under B.14.1 — for example an Authorised User asking for a copy of their own identity-verification record, or asking Infinia to correct it — Infinia will handle the request itself, will verify the requester's identity before doing so, and will respond within the period Data Protection Law allows. Requests are made to [privacy@●]. The Privacy Notice describes the available rights, the verification step and the limited grounds on which a request may be refused.

B.14.3 Where an automated decision is taken about an individual in the course of that controller-side processing — namely identity and ownership verification under Section 3.7 of the Terms, sanctions and restricted-party screening under Section 23.3, and the credit assessment under Section 10.12 — Infinia will disclose the decision in the Privacy Notice, will not treat the output of the screening system as determinative without human review where the decision would prevent the Customer or an Authorised User from using the Service, and will provide a named route by which a decision may be contested. Nothing in this B.14.3 requires Infinia to disclose information whose disclosure would breach Applicable Law, including sanctions and anti-money-laundering law, or would prejudice the prevention or detection of crime.

Annex D — Sub-processor List

This Annex is the list referred to in Section B.5.1 and forms part of the Agreement. The current version is also published at [Sub-processor URL], where the Customer may subscribe to change notifications. Infinia will give not less than thirty days' notice before authorising a new Sub-processor, and the Customer may object on reasonable data-protection grounds under Section B.5.2.

No Sub-processor listed below receives, processes or has access to Inputs or Outputs, because Inputs and Outputs are not retained and do not leave the serving Zone. A Sub-processor that processes Stored Objects does so only within the Region Scope, and is contractually prohibited from using Customer Content for training or for any purpose other than providing the Service (Section B.5.3).

D.1 Zone Operators and compute partners

D.2 Control-plane and corporate Sub-processors

Annex E — Standard Contractual Clauses: options and completed annexes

This Annex completes the Standard Contractual Clauses incorporated by Section B.11.1. It applies only to the account, billing, identity-verification, support and website Personal Data described in Section B.6.2 for which Infinia is a data importer. It does not apply to Inputs, Outputs or Stored Objects, which never leave the Region Scope and are therefore not the subject of a restricted transfer (Sections 6.1, 6.2 and B.6.1).

E.1 Options selected

E.2 Annex I — Parties, transfer and supervisory authority

E.3 Annex II — Technical and organisational measures

The measures required by Clause 8.6 and Annex II are those set out in Section B.12 of the Data Processing Addendum, which is incorporated into this Annex E in full. The measures that bear specifically on the transferred data are: encryption in transit and at rest with keys managed within the relevant jurisdiction; federated authentication with role-based access control and re-authentication for sensitive actions; least-privilege, logged and periodically reviewed personnel access, restricted to the function for which it is authorised; segregation of identity-verification records from operational systems; an immutable audit log of administrative access; annual independent penetration testing; and the incident-response and notification procedures in Section B.8. The measures applicable to a Sub-processor are those imposed under Section B.5.3, which must be no less protective than these.

E.4 Annex III — Sub-processors, and the transfer impact assessment

The sub-processors authorised under Clause 9, Option 2 are those listed in Annex D, section D.2, together with their roles, the data they process and their places of processing.

Assessment under Clause 14. Infinia has assessed, and will keep under review, whether the law and practice of the Abu Dhabi Global Market prevent it from meeting its obligations under these clauses. The assessment records the following, and is available to the Customer on request under Section B.10.1.