DATA PROCESSING AGREEMENT

Data Processing Agreement

Effective 6 October 2026 · Version 3.1

This Data Processing Agreement (“DPA”) is between Seleya Labs Inc., a Delaware corporation (file number 10004407), mailing address 1111B S Governors Ave STE 56751, Dover, DE 19904, USA, which operates Spock (“Seleya”), and the customer that uses Spock (“Customer”).

It applies in one of two ways:

• Self-service plans: it forms part of the Terms of Service the Customer accepts when it signs up.
• Enterprise: the Customer and Seleya sign it directly, with a completed Customer Schedule. This applies whether the Customer buys Spock from Seleya or from Seleya’s South African reseller, TTL Technologies (Pty) Ltd. Seleya is bound by this DPA directly.

1. Definitions

• “Agreement” means the Customer’s agreement for the Service: the Terms, or the Customer’s signed service agreement with Seleya or TTL.
• “Applicable Data Protection Law” means the Protection of Personal Information Act, 2013 (“POPIA”) and, where they apply to the processing, the EU General Data Protection Regulation (“GDPR”), the UK GDPR and other data protection laws.
• “Customer Content” means everything the Customer or its users submit to or create in the Service: prompts, conversations, files, data from connected sources, memory, agent work and outputs, and the indexes and other data the Service derives from them.
• “Personal Information” means information about an identifiable, living natural person or an identifiable, existing juristic person, as defined in POPIA, and “personal data” as defined in the GDPR where it applies. It includes Personal Information within Customer Content.
• “Process” has its meaning in Applicable Data Protection Law.
• “Security Incident” means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Information, or reasonable grounds to believe it has been accessed or acquired by an unauthorised person.
• “Service” means Spock as supplied under the Agreement.
• “Sub-processor” means a third party Seleya engages to Process Customer Personal Information.
• “Customer Schedule” means the Enterprise schedule that records the Customer’s contacts, enabled features and any agreed restrictions.

2. Roles

The Customer is the responsible party (controller). Where the Customer processes information on behalf of its own clients, it acts as their operator (processor), and Seleya acts as the Customer’s sub-processor. The Customer is then responsible for having its clients’ authority for the processing.

Seleya is the operator (processor). It Processes Customer Personal Information only to provide the Service.

Seleya is a responsible party in its own right for account, billing, security and support administration, as described in the Privacy Policy. That processing is outside this DPA.

3. Instructions

Seleya Processes Customer Personal Information only on the Customer’s documented instructions. These are the Agreement, this DPA, the Customer Schedule, and the Customer’s use of the Service’s features by its authorised users. This includes instructions about transfers.

If the law requires other Processing, Seleya will tell the Customer first, unless the law forbids it. If Seleya believes an instruction breaks the law, it will tell the Customer promptly and need not follow it until it is resolved.

4. Customer responsibilities

The Customer is responsible for having a lawful basis, giving any required notices, and having authority over the sources it connects.

The Customer must not submit special personal information, children’s information or information about criminal behaviour unless the Customer Schedule permits it and the Customer has met the legal requirements for that processing.

5. People

Seleya’s personnel work in South Africa. Only those who need access to provide, support or secure the Service have it. Seleya ensures that each is bound by written confidentiality obligations and acts only on Seleya’s instructions. This covers personnel engaged through TTL, who act as Seleya’s sub-processor (Annex B). Access is removed when it is no longer needed.

6. Security

Seleya maintains the technical and organisational measures in Annex C, and the security safeguards required by section 19 of POPIA and Article 32 of the GDPR. It reviews them as the Service changes, and will not reduce the overall level of protection during the Agreement.

7. Sub-processors

The Customer authorises the Sub-processors listed in Annex B.

Seleya binds each Sub-processor in writing to data protection obligations at least as protective as this DPA, including confidentiality, security, prompt incident notice, deletion and protection on onward transfer. Seleya remains liable to the Customer for its Sub-processors’ performance.

Seleya will give the Customer’s notice contact at least 30 days’ notice by email before adding or replacing a Sub-processor. The notice will state the Sub-processor’s name, purpose and location. Updating a web page is not notice. The Customer may object on reasonable data protection grounds within that period. The parties will then work in good faith on a solution, such as an alternative or switching off the affected feature for the Customer. If none is found, the Customer may end the affected part of the Service, and receive a refund of any prepaid fees for the period after it ends. Where an urgent change is needed for security or legal reasons, Seleya will give as much notice as it can and explain why.

8. No training

Seleya will not use Customer Content to train, fine-tune or otherwise develop any AI model, and will not allow its Sub-processors to do so. The only exception is a model the Customer instructs Seleya in writing to train or tune on its own Customer Content, used only for that Customer and never made available to anyone else. Seleya uses provider services and settings that support this. Indexing, retrieval and memory used only to serve the Customer are not training.

If Seleya breaches this section, the Customer may end the Agreement immediately and receive a refund of all fees paid in the 12 months before the breach. This is in addition to the Customer’s other rights.

9. Security Incidents

Seleya will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident. Where section 21 of POPIA applies, Seleya will notify the Customer immediately once it has reasonable grounds to believe Customer Personal Information has been accessed or acquired by an unauthorised person.

The notice will give what is known at the time: what happened, the categories and approximate number of people and records affected, the likely consequences, the measures taken or proposed, and a contact. Seleya will add detail as it learns more, contain the incident, preserve evidence, and help the Customer meet its own obligations to notify the Information Regulator, other regulators or affected people.

10. Assistance

Seleya will help the Customer, through appropriate measures, to respond to requests from people exercising their rights: access, correction, deletion, objection, restriction and portability. If Seleya receives such a request directly about Customer Content, it will pass it to the Customer and not answer it, unless the law requires otherwise.

Seleya will give the Customer the information it reasonably needs for impact assessments, prior authorisation applications and dealings with regulators.

11. Deletion and return

During the Agreement. The Customer may ask Seleya to delete specific Customer Personal Information. Seleya will delete it without undue delay and in any event within 30 days, and confirm on request. Deletion covers the stored files and their search indexes and derived data. It also covers conversations and memory notes containing the information that the Customer identifies, or asks Seleya to find. For files synced from a connected source, the Customer should also delete them at the source or remove them from the synced folder; otherwise a later sync can bring them back.

At the end of the Agreement. At the Customer’s choice, Seleya will return Customer Content in a commonly used, machine-readable format and then delete it, or delete it. Export is available on request made within 30 days after the Agreement ends. Seleya deletes the remaining Customer Content within 30 days after the export is delivered, or after that request period ends.

Backups and providers. Backups expire on a rolling basis within 30 days and are never restored into use with deleted data in them. Copies held by Sub-processors are deleted according to the periods in Annex B.

Seleya may keep information only where the law requires it. It will then keep only what is required, use it for nothing else, and delete it when the requirement ends.

12. Information and audits

Seleya will make available the information reasonably needed to show compliance with this DPA, including written answers to security questionnaires.

Where that information is not enough, the Customer, or an independent auditor bound by confidentiality, may audit Seleya’s compliance once a year on 30 days’ written notice, during business hours. The Customer may also audit after a Security Incident, or where a regulator requires it. Each party bears its own audit costs. Seleya does not hold a SOC 2 or ISO 27001 certification. A Sub-processor’s certification covers only that Sub-processor.

13. International transfers

The Customer’s Personal Information is stored in Europe and processed in the United States and South Africa, as set out in Annex B.

POPIA. Seleya transfers Personal Information out of South Africa only under binding agreements that provide adequate protection under section 72(1)(a) of POPIA. These agreements give substantially similar protection, including for juristic-person information and for onward transfers. This DPA is one of those agreements; Seleya’s agreements with its Sub-processors are the others.

GDPR. The EU Standard Contractual Clauses do not apply between the parties unless the GDPR applies to the Customer’s Personal Information and the Processing involves a restricted transfer. If it does, the parties will sign the applicable module with completed annexes before that Processing begins. Seleya relies on its Sub-processors’ own transfer terms for their processing.

14. Liability and precedence

Each party’s liability under this DPA is subject to the limits in the Agreement, except where Applicable Data Protection Law does not allow a limit. Where the Customer’s Agreement is with TTL, Seleya’s liability under this DPA and TTL’s liability under the Agreement share the single limit in that Agreement, and the Customer cannot recover the same loss twice.

This DPA prevails over the Agreement only on the Processing of Personal Information. On everything else, including liability, the Agreement prevails. Signed Standard Contractual Clauses prevail where the law requires.

15. Law, term and changes

This DPA follows the governing law and dispute process of the Agreement, except where signed Standard Contractual Clauses require otherwise.

It lasts as long as Seleya Processes Customer Personal Information. Sections 8, 11 and 14 survive it.

A signed DPA changes only in writing signed by both parties. A new version of this page does not change a signed DPA. Earlier published versions are kept in the legal archive.

Annex A: Processing

Annex B: Sub-processors

Not every Sub-processor is used for every customer. Those marked “when used” receive Customer Content only when the related feature is used. Locations are where the processing happens.

Customer-connected services (for example Microsoft 365, Google Workspace, WhatsApp or other apps the Customer connects) act under the Customer’s own accounts and terms. They are not Seleya’s Sub-processors.

Annex C: Security measures

• Data is encrypted in transit with TLS (version 1.2 or higher).
• The database (DigitalOcean), file storage (AWS S3, AES-256, unencrypted uploads refused) and search index storage (Cloudflare R2) encrypt data at rest. File storage keeps no old versions, so deleted files are gone.
• Passwords are stored hashed, and connected-account tokens are encrypted at rest.
• Access to production systems is limited to named Seleya personnel who need it, and removed when no longer needed.
• Customer Content is separated by organisation and workspace, and every file read is permission-checked, including for content synced from connected sources.
• Hosted computers are isolated from other customers and deleted after 30 days.
• Diagnostic copies of AI requests are kept for up to 30 days, then reduced to non-content records.
• Security Incidents are handled under a documented procedure (section 9).
• Deleted data is removed from active systems promptly; backups expire within 30 days.

Customer Schedule (Enterprise)

Signed for the Customer: [name, title, signature, date]

Signed for Seleya Labs Inc.: [name, title, signature, date]