# Data Processing Addendum Our obligations when processing personal data on your behalf. Last updated October 22, 2026\ --- This Data Processing Addendum (“DPA”) is between Elios Superintelligence, Inc., a Delaware corporation whose address is 136 Cheyenne Way, Wayne, NJ 07470, United States (“Elios”), and the customer that enters into an agreement for the Services (“Customer”). This DPA forms part of the [Terms of Service](https://elios.ai/legal/terms) or a separate written agreement governing Customer’s use of the Services (the “Agreement”). It applies to the extent Elios processes Customer Personal Data on Customer’s behalf. It becomes effective with the Agreement when the Agreement expressly incorporates this DPA, or when the parties separately execute it. An authorized person accepting the Agreement on Customer’s behalf also accepts this DPA when it is incorporated. The version accepted, the acceptance event and the contracting parties must be recorded. ## 1. Definitions **Applicable Data Protection Law** means privacy and data protection law that applies to a party’s processing under this DPA, including the EU General Data Protection Regulation (“EU GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and applicable US state privacy laws, in each case where applicable and as amended. **Customer Personal Data** means personal data in Customer Content and other personal data that Elios processes on Customer’s behalf to provide the Services, including associated application logs and metadata to the extent processed in that capacity. It excludes information Elios lawfully processes as an independent controller for separate purposes, as described in the [Privacy Policy](https://elios.ai/legal/privacy). Calling data “telemetry” or “metadata” does not by itself remove it from this definition. **Personal Data Breach** means a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. Unsuccessful attempts that do not compromise Customer Personal Data are not a Personal Data Breach. **Subprocessor** means a third party engaged by Elios to process Customer Personal Data on Elios’s behalf. A provider independently selected and engaged by Customer is not Elios’s Subprocessor solely because Customer connects it to the Services. **Controller**, **processor**, **personal data**, **processing** and **data subject** have their meanings under Applicable Data Protection Law. Where relevant, controller and processor include analogous roles such as business and service provider or contractor. Other capitalized terms have the meanings in the Agreement. ## 2. Roles and scope Customer acts as controller of Customer Personal Data, or as a processor acting for another controller. Elios acts as Customer’s processor or subprocessor. If Customer acts as a processor, Customer is responsible for having the authority and instructions needed to appoint Elios and give the instructions in this DPA. Each party remains responsible for obligations imposed directly on it by Applicable Data Protection Law. Customer’s responsibilities do not remove Elios’s own obligations. The processing details are in Schedule 1. The agreed technical and organizational measures are in Schedule 2. International transfer provisions are in Schedule 3. The authorized Subprocessor list is incorporated under Section 6. ## 3. Customer instructions and responsibilities Customer instructs Elios to process Customer Personal Data as reasonably necessary to provide the Services described in the Agreement, to carry out Customer’s configurations and requests, and to follow other lawful instructions documented and accepted by the parties. Instructions include authorized use of the API and account controls. They do not authorize an unrelated purpose merely because it would be useful to Elios. Customer is responsible for determining a lawful basis, providing required notices, obtaining required consents or other permissions, and ensuring that its instructions and use of the Services comply with Applicable Data Protection Law. This includes laws applicable to communications, recordings and information about children or sensitive categories where relevant. Elios will process Customer Personal Data only on documented instructions, including instructions about international transfers, except where applicable law requires otherwise. Where legally permitted, Elios will inform Customer of that requirement before the required processing. If Elios considers an instruction to infringe Applicable Data Protection Law, it will inform Customer promptly and may suspend the affected processing while the parties address the issue. Elios will not use Customer Personal Data for unrelated advertising or to train artificial intelligence or machine learning models. A separately requested feature that changes the purpose or role of processing requires clear additional terms and a lawful basis; it is not silently authorized by this DPA. ## 4. Personnel and confidentiality Elios will limit access to Customer Personal Data to authorized people who need access to perform their work. People authorized to process it will be subject to an appropriate contractual or statutory duty of confidentiality. Elios will provide guidance appropriate to their access and responsibilities. ## 5. Security Elios will implement and maintain technical and organizational measures appropriate to the risk of the processing, taking account of the state of the art, implementation costs and the nature, scope, context and purposes of processing. Where applicable, those measures will meet the requirements of Article 32 GDPR. The measures agreed for the Services are described in Schedule 2. Elios may update those measures as its systems evolve, provided the changes do not materially reduce the overall protection of Customer Personal Data during the Agreement. A materially different processing activity or data category may require additional measures and agreement before it begins. Customer is responsible for the security measures within its control, including account access, its code and applications, permissions it grants to agents, connected services, content selection and available configuration choices. These responsibilities do not excuse a failure by Elios to meet its own obligations. ## 6. Subprocessors Customer gives Elios general written authorization to use the Subprocessors identified in the [Subprocessor list](https://elios.ai/legal/subprocessors) as accepted with this DPA and to appoint replacements or additions in accordance with this section. Before a Subprocessor processes Customer Personal Data, Elios will enter into a written agreement imposing data protection obligations appropriate to its work and no less protective than the relevant obligations in this DPA. Elios remains responsible to Customer for the Subprocessor’s performance of those obligations. Elios will provide at least 60 days’ prior notice of a new or replacement Subprocessor through the notice mechanism identified in the Subprocessor list. Customer may object within 60 days of that notice on reasonable grounds concerning protection of Customer Personal Data. The parties will work in good faith to resolve the objection before the new Subprocessor processes the affected data. If no reasonable solution is available, Customer may terminate the affected Services before the change takes effect without an early termination penalty for those Services. Elios will refund prepaid fees for affected Services that will not be provided. Fees for Services already supplied remain payable. This remedy does not limit rights under mandatory law or applicable transfer clauses. If an emergency makes advance notice impracticable, Elios may use a replacement only to the extent permitted by Applicable Data Protection Law and any applicable transfer clauses. It will notify Customer promptly, explain the circumstances and preserve the objection process as far as legally and operationally possible. This sentence does not override a mandatory prior-notice requirement. ## 7. Personal Data Breaches Elios will notify Customer without undue delay after becoming aware of a Personal Data Breach. Elios will not wait for a complete investigation before providing an initial notice when the available facts establish awareness of a breach. The notice will describe the nature of the breach, the categories and approximate numbers of affected people and records where known, likely consequences, measures taken or proposed, and a contact for further information. Information may be provided in phases as it becomes available. Elios will take reasonable measures to contain and remediate the breach and will cooperate with Customer as needed for Customer’s applicable notification and response obligations. Customer decides whether to notify affected people or regulators on its behalf, except where Elios is independently required by law to do so. Notice of a breach is not an admission of fault. Customer’s incident-notice contact is the account’s administrative email address and any security contact stated in an Order. Elios’s incident contact is . ## 8. Assistance and individual rights Taking account of the nature of processing, Elios will assist Customer through appropriate technical and organizational measures, insofar as possible, with requests to exercise data subject rights. If Elios receives a request concerning Customer Personal Data, it will promptly refer it to Customer and will not respond substantively except on Customer’s instructions or as legally required. Taking account of the processing and information available to it, Elios will assist Customer with its obligations concerning security, breach notification, data protection impact assessments and prior consultation with supervisory authorities. This includes information reasonably needed to assess relevant processing and risks. The parties may agree reasonable charges in advance for extraordinary assistance beyond the Services, except where the work is required to remedy Elios’s breach or where charging is prohibited. A fee discussion will not delay legally required assistance. ## 9. Compliance information and audits Elios will make available information reasonably necessary to demonstrate compliance with this DPA and allow and contribute to audits, including inspections, by Customer or its authorized independent auditor as required by Applicable Data Protection Law. The parties will first seek to meet a request through suitable existing information, written responses and remote review. Elios is not required to provide a certification or independent audit report that it does not have. If those materials do not reasonably establish compliance, an appropriate further audit may be conducted. Routine audits will occur on reasonable advance notice, ordinarily no more than once in 12 months, during normal business hours, under confidentiality protections and in a manner that avoids unnecessary disruption or exposure of other customers’ information. These procedural limits do not restrict an audit required by a regulator, mandatory law or applicable transfer clauses, or a reasonable audit following a Personal Data Breach or material evidence of noncompliance. Auditors must be independent and appropriately qualified; Elios may object to an auditor on reasonable confidentiality or conflict grounds without preventing the audit. Each party generally bears its own costs, unless otherwise agreed. Elios bears its reasonable remediation costs and costs of an additional audit necessitated by its material breach. No audit provision limits a supervisory authority’s powers. ## 10. Return and deletion During the Agreement, Elios will provide the return and deletion options described in Schedule 1 and the applicable product documentation. On termination of the relevant Services, Elios will, at Customer’s choice, return or delete Customer Personal Data and delete remaining copies, unless applicable law requires retention. Return must be requested within the export period stated in Schedule 1. Data is then deleted from active systems and backups within the periods stated there. Backups retained temporarily will remain protected and isolated from routine use. If restored for recovery, applicable deletion instructions will be reapplied. Legally required retained data will remain protected, used only for the required purpose, and deleted when the retention duty ends. Elios will confirm completion of deletion on reasonable request. Service suspension does not create an independent right to retain Customer Personal Data indefinitely. The DPA continues to protect any retained Customer Personal Data until deletion. ## 11. Government and third-party requests If Elios receives a legally binding request for Customer Personal Data, it will notify Customer before disclosure unless prohibited by law. Where lawful and reasonable, Elios will direct the requesting party to Customer and assess whether the request is valid and appropriately scoped. Elios will disclose only what it is legally required to disclose. Additional duties under applicable transfer clauses remain in effect. Legal requests go to . ## 12. International transfers Elios will not make a restricted international transfer of Customer Personal Data unless the transfer satisfies Applicable Data Protection Law. Schedule 3 identifies the applicable contractual mechanism where one is needed and legally available. The parties will provide reasonable cooperation for the required transfer assessments and any supplementary measures. Elios is not certified under the EU-U.S. Data Privacy Framework. No reference to an adequacy decision, contractual clause or certification means that it applies to every recipient or every processing activity. The actual entities, locations, roles and transfer conditions must support the mechanism used. ## 13. US state service-provider terms To the extent Elios acts as a service provider, contractor or processor under applicable US state privacy law, it will process Customer Personal Data only for the specific business purposes and services described in the Agreement and Schedule 1, or another purpose permitted by that law. It will not sell or share Customer Personal Data, use it outside the direct business relationship, or retain, use or disclose it for another commercial purpose except as that law permits. It will not combine Customer Personal Data with information from other sources except as permitted by applicable law. Elios will provide the same level of privacy protection required of it by applicable law. Customer may take reasonable and appropriate steps to verify consistent use, and, on notice, to stop and remediate unauthorized use. Elios will notify Customer if it determines it can no longer meet its obligations. Elios will assist Customer with applicable consumer requests and provide information required to demonstrate compliance. Subprocessors must be engaged under written terms as required by the applicable law. Elios certifies that it understands the applicable restrictions and will comply with them. ## 14. Order of precedence and responsibility If documents conflict on protection of Customer Personal Data, applicable mandatory transfer clauses control, followed by this DPA, followed by the Agreement. A negotiated agreement can provide greater protection without reducing a mandatory legal requirement or a data subject’s rights. The Agreement’s limitations of liability apply between the parties to the extent lawful, but do not restrict liability or remedies that cannot be limited under Applicable Data Protection Law or the mandatory transfer clauses, or any data subject’s rights under those clauses. The Agreement’s governing-law provision does not displace the law and courts required by an applicable transfer instrument. ## Schedule 1. Description of processing | Item | Agreed description | | -------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Subject matter | Processing Customer Personal Data to provide the Services selected by Customer under the Agreement | | Nature | Receipt, transmission, hosting, storage, execution, retrieval, organization, access, export and deletion as needed for the selected Services and Customer’s instructions; communications routing, live audio streaming to Customer’s systems and recording only where the relevant features are enabled | | Purpose | Supplying and supporting Customer’s requested infrastructure and associated functionality, under Customer’s instructions | | Duration | The Agreement’s term, followed by the limited return, deletion or legally required retention periods below | | Frequency | Continuous or intermittent according to Customer’s use; recurring transfers may occur while the Services operate | | Data subjects | Customer’s authorized users, personnel, contractors, customers, prospects and other individuals whose information Customer lawfully processes; callers, recipients, contacts and participants where Phone is used | | Data types | Customer-selected identifiers, contact details, application data, files, credentials and secrets, website interactions and associated logs; phone numbers, contacts, call records, message content, attachments, live call audio and recordings where Phone is used | | Special categories and sensitive information | None authorized. The Services are not designed for health information subject to HIPAA, children’s data, payment card data or other specially regulated data, and Elios does not offer a business associate agreement | | Processing locations | Computer, its disks, templates and backups: Hetzner data centers in the European Union (Germany and Finland). Phone call servers: AWS in the United States and Hetzner in the European Union, with carrier service in the United States. Delivery and edge security: Cloudflare’s global network. Other Subprocessors: the locations on the Subprocessors page | | Production retention | Stopping a resource does not delete its data. Deleted computers, disks and templates are purged within 30 days. Each Phone keeps recordings, contacts, and call and message history within limits stated in the documentation, deleting the oldest recordings and records first when a limit is reached; message attachments expire after a stated period. Deleting a Phone deletes all of its data within 30 days. Logs are kept for 30 days | | Return method and export period | Customer can export Customer Personal Data through the console and the API at any time until its account closes | | Deletion from active systems | Within 30 days after Customer deletes the data or the resource holding it, or after the account closes | | Backup deletion | Backup copies roll off within 35 days; deletions are reapplied to any backup that is restored | | Legal retention | None for Customer Personal Data. Elios’s own billing and tax records are kept for 7 years as an independent controller under the Privacy Policy and are not Customer Personal Data | | Customer instructions and contact | Customer’s authorized account instructions and the account’s administrative email address, or a privacy or security contact stated in an Order | | Elios contact | for privacy matters and for security matters | ## Schedule 2. Technical and organizational measures The measures at [Security Measures](https://elios.ai/legal/security-measures), in the version published on the date Customer accepts this DPA, are incorporated into this DPA. The accepted version must be retained with the Agreement. Where international transfer clauses apply, those measures also supply Annex II to the relevant clauses, supplemented by any transfer-specific measures identified in Schedule 3. ## Schedule 3. International transfer terms and annexes ### A. When this schedule applies This schedule applies only to a transfer that is restricted by Applicable Data Protection Law and requires the relevant contractual safeguards. The parties must confirm that the chosen instrument is legally available for the importer, exporter and processing involved. If it is not, they must establish another valid mechanism before the transfer begins. ### B. EU standard contractual clauses Where applicable and legally available, the parties incorporate without alteration the standard contractual clauses in the Annex to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (“EU SCCs”), available from the [European Commission’s official publications page](https://commission.europa.eu/publications/publications-standard-contractual-clauses-sccs_en). Incorporation includes all operative clauses of the selected module and the completed annexes; the selections below do not replace or paraphrase those clauses. | Election | Selection | | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | Data exporter | Customer, as identified in the Agreement and Annex I.A below | | Data importer | Elios Superintelligence, Inc., as identified in Annex I.A below | | Module | Module Two where Customer is a controller; Module Three where Customer is a processor; apply the module appropriate to each transfer | | Clause 7, docking clause | Applies | | Clause 9(a), Subprocessors | Option 2, general written authorization; prior notice period of 60 days | | Clause 11, optional independent dispute resolution | Optional text does not apply | | Clause 17 | Option 1; law of Ireland, provided it permits third-party beneficiary rights, or another eligible EU member-state law expressly agreed before execution | | Clause 18(b) | Courts of Ireland, unless another eligible EU member-state court is expressly agreed consistently with Clause 17 | | Annex I | The completed Annex I below | | Annex II | The completed Security Measures schedule and any additional transfer-specific measures | | Annex III | The accepted Subprocessor list, as updated in accordance with the applicable notice and objection process | ### C. Annex I to the EU SCCs #### Annex I.A. Parties **Exporter:** Customer’s legal name, address, relevant contact person, position and contact details are those given in its account acceptance or an Order. Its role is controller or processor as specified above. Its activities relevant to the transfer are use of the Services under the Agreement. Signature and date are the recorded acceptance of the Agreement incorporating this DPA, or separate execution. **Importer:** Elios Superintelligence, Inc., 136 Cheyenne Way, Wayne, NJ 07470, United States; contact: Privacy, . Its role is processor or subprocessor as applicable. Its relevant activities are supplying the Services described in Schedule 1. Signature and date are Elios’s acceptance of the Agreement incorporating this DPA, or separate execution. #### Annex I.B. Transfer description Schedule 1 supplies the categories of data subjects and personal data, nature, purposes, frequency, duration, retention and Subprocessor processing. No sensitive data is authorized for transfer. #### Annex I.C. Competent supervisory authority The competent supervisory authority is the one Clause 13 of the EU SCCs determines for the relevant exporter and transfer: where Customer is established in an EU member state, the authority of that member state; where Customer is not established in the EU but has appointed a representative under Article 27 GDPR, the authority of the member state where the representative is established; and otherwise, the authority of a member state where the affected data subjects are located. The Irish law election does not automatically make Ireland’s authority competent. ### D. UK restricted transfers For transfers subject to the UK GDPR requiring contractual safeguards, the parties incorporate the ICO’s approved International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B.1.0, including its mandatory clauses as lawfully revised (“UK Addendum”). The official instrument and instructions are available from the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/appropriate-safeguards/what-are-standard-data-protection-clauses-the-uk-idta-and-the-addendum/). | UK Addendum table | Agreed information | | --------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | Table 1: Parties and start date | Exporter and importer details, contacts and signatures in Annex I.A; start date is the effective date of the applicable executed transfer arrangement | | Table 2: Selected EU SCCs | EU SCCs, selected module(s) and elections specified in Part B of this Schedule | | Table 3: Appendix information | Annex I in Part C; Annex II in Schedule 2; Subprocessors as stated in Part B | | Table 4: Ending the Addendum following an approved change | Both importer and exporter may exercise the relevant right in accordance with the mandatory clauses | The UK Addendum prevails where it modifies the EU SCCs for UK transfers. Its mandatory clauses are incorporated without impermissible modification. The parties will complete the required transfer risk assessment and any additional safeguards; signing a document alone does not replace that assessment. ### E. Swiss transfers Where the EU SCCs are used for a transfer restricted by Swiss law, references to the GDPR will include the relevant Swiss law to the extent required for that transfer; the Swiss Federal Data Protection and Information Commissioner will be the relevant authority where Swiss law governs that point; and references to member states will not exclude Swiss data subjects from bringing proceedings in their place of habitual residence where the instrument and applicable law require it. These adaptations must not reduce protection for data subjects or conflict with the operative EU SCCs for transfers also governed by EU law. ### F. Execution record when separately signed Customer may ask for a copy of this DPA to sign separately. The signed copy records each party’s legal name, address, authorized signatory, title, signature, date and notice email. Where the DPA is accepted through the Agreement instead, Elios retains equivalent evidence of the parties, authority, accepted version, annex information, effective date and acceptance. An anonymous page view is not treated as acceptance.