Parter App Data Processing Addendum

Last updated: November 1, 2026

This Data Processing Addendum applies to customers of the Parter application and is incorporated into the Parter App Terms of Service.

Effective date: 1 November 2026 · Version: 1.0 · Incorporated by reference into the Parter Terms of Service

1. Parties and scope

1.1 This Data Processing Addendum ("DPA") is between Parter Inc., 1412 Broadway, New York, NY 10018, USA ("Parter") and the customer that accepted the Parter Terms of Service ("Customer"). It is part of the Terms and needs no separate signature. Customers who need a signed copy may request one at support@parter.ai.

1.2 The DPA applies when Parter processes Personal Data contained in Customer Content on Customer's behalf. It does not apply to account, billing or usage data, which Parter processes as a controller under its Privacy Policy.

1.3 On personal data, the DPA overrides the Terms where the two conflict. Where the Standard Contractual Clauses apply, they override the DPA where the two conflict.

2. Roles and definitions

2.1 Customer is the controller (or a processor acting for its own controller) and Parter is the processor of Personal Data in Customer Content.

2.2 "Data Protection Law" means all laws that apply to the processing of Personal Data under this DPA, including the GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, and US state privacy laws such as the CCPA/CPRA.

2.3 "Personal Data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings in the GDPR. "Sub-processor" means a third party Parter engages to process Personal Data in Customer Content. "SCCs" means the EU Standard Contractual Clauses (Decision 2021/914), Module 2 (controller to processor) and, where Customer is a processor, Module 3. "UK Addendum" means the UK ICO International Data Transfer Addendum to the SCCs.

2.4 Annex I describes the processing. Annex II lists Parter's security measures. Annex III lists the Sub-processors.

3. Parter's obligations as processor

3.1 Instructions. Parter processes Personal Data only on Customer's documented instructions. The Terms, this DPA and Customer's use of the Service's features are those instructions. If law requires Parter to process otherwise, Parter tells Customer first unless the law forbids it. Parter tells Customer if it believes an instruction breaks Data Protection Law.

3.2 Confidentiality. Parter staff with access to Personal Data are bound by confidentiality and receive privacy training.

3.3 Security. Parter maintains the technical and organizational measures in Annex II and may update them, but not in a way that lowers overall protection during the term.

3.4 Sub-processors. Customer authorizes the Sub-processors in Annex III and the engagement of new ones under this clause. Parter gives at least 30 days' notice of a new Sub-processor by email to customers who ask to be notified at support@parter.ai. Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, Customer may end the affected Service and receive a pro-rata refund of unused prepaid fees. Parter binds each Sub-processor to data-protection terms no less protective than this DPA and remains liable for its Sub-processors.

3.5 Data subject requests. Parter forwards to Customer, without undue delay, any request from a data subject about Personal Data in Customer Content, and helps Customer respond through the Service's features (search, export, delete). Parter does not answer the data subject directly unless Customer asks or law requires.

3.6 Assistance. Parter helps Customer with data-protection impact assessments and consultations with authorities where they relate to the Service, taking into account the information available to Parter. Parter may charge reasonable fees for assistance beyond what the Service provides.

3.7 Personal data breach. Parter notifies Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Personal Data in Customer Content. The notice describes the nature of the breach, the likely consequences, the measures taken, and a contact point, and is updated as the investigation proceeds. Parter does not notify data subjects or authorities on Customer's behalf unless Customer asks or law requires.

3.8 Return and deletion. Customer can export Personal Data at any time through the Service. After the export window in the Terms (clause 16.4) closes, Parter deletes Personal Data in Customer Content within 60 days, except in backups that are overwritten on a rolling cycle and where law requires retention. Parter certifies deletion in writing on request.

3.9 Audits. Parter provides, on request and no more than once a year, the information needed to show compliance with this DPA: the current SOC 2 Type II report (under NDA), completed security questionnaires, and summaries of penetration tests. If those do not reasonably answer Customer's question, Customer may conduct an audit at its own cost, on 30 days' notice, during business hours, under confidentiality, and without disrupting Parter's operations or other customers' data.

4. Customer's obligations

4.1 Customer has a lawful basis for the Personal Data it uploads, gives any notices and obtains any consents the law requires, and does not upload sensitive personal data or data about children.

4.2 Customer's instructions comply with Data Protection Law. Customer is responsible for the accuracy and legality of Customer Content and for its users' handling of Personal Data in the Service.

5. International transfers

5.1 Parter processes Personal Data in the United States and in the countries listed in Annex III.

5.2 For Personal Data protected by the GDPR, the SCCs are incorporated into this DPA with Customer as data exporter and Parter as data importer. Module 2 applies where Customer is a controller; Module 3 where Customer is a processor. Clause 7 (docking) is included; Clause 9 option 2 (general authorization) applies with the notice period in 3.4; Clause 11 optional language does not apply; Clause 13 and Clause 17 use the law of Ireland; Clause 18 uses the courts of Ireland. Annexes I, II and III of this DPA serve as the SCC annexes.

5.3 For Personal Data protected by UK law, the UK Addendum applies to the SCCs, with the tables completed by the information in this DPA. For Swiss data, the SCCs apply with the adjustments the Swiss FDPIC requires.

5.4 If a lawful transfer mechanism Parter relies on becomes invalid, Parter adopts an alternative mechanism without undue delay.

6. US state privacy laws

6.1 Where the CCPA/CPRA or another US state privacy law applies, Parter acts as a "service provider" or "processor" and Customer as a "business" or "controller". Parter:

processes Personal Data only for the business purpose of providing the Service described in Annex I;
does not sell or share Personal Data, retain, use or disclose it outside the direct business relationship with Customer, or combine it with Personal Data from other sources except as the law permits for service providers;
complies with applicable obligations under those laws and provides the same level of privacy protection they require;
notifies Customer if it can no longer meet these obligations, and allows Customer to take reasonable steps to stop and remediate unauthorized use;
grants Customer the right to verify compliance under clause 3.9;
assists with consumer requests under clause 3.5;
flows these terms down to Sub-processors.

6.2 Parter certifies that it understands and will comply with these restrictions.

7. Liability, term and precedence

7.1 Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, except where the SCCs provide otherwise for the parties to the SCCs.

7.2 This DPA lasts as long as Parter processes Personal Data in Customer Content.

7.3 Parter may update this DPA to reflect changes in Data Protection Law or the Service by giving notice under the Terms (clause 17). Updates do not reduce the protection of Personal Data during the term.

7.4 Order of precedence on Personal Data: SCCs and UK Addendum, then this DPA, then the Terms.

Annex I — Details of processing

Data exporter: Customer, as controller (or processor). Contact: Customer's account owner email.
Data importer: Parter Inc., as processor. Contact: support@parter.ai.
Subject matter: hosting and analysing Customer Content (BOMs, part lists, files, notes) to provide BOM risk, lifecycle, alternatives and related features.
Duration: the term of the Terms plus the export and deletion periods in clause 3.8.
Nature and purpose: storage, parsing, matching, analysis, alerting, export and display within the Service, on Customer's instructions.
Categories of data subjects: Customer's employees and contractors who use the Service; supplier, manufacturer or customer contacts whose details Customer includes in Customer Content.
Categories of Personal Data: names, business email addresses, phone numbers, job titles, company names, and any other personal data Customer chooses to include in Customer Content. No sensitive data.
Frequency: continuous while the account is active.
Retention: as in clause 3.8.
Transfers to Sub-processors: as in Annex III, for the purposes listed there.
Competent supervisory authority (SCCs): the authority of the EU member state where Customer is established, or where its EU representative is established; otherwise Ireland.

Annex II — Security measures

Encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent) for all Customer Content.
Hosting in a major cloud provider's certified data centres, with network segmentation and firewalls.
Access control: single sign-on and multi-factor authentication for staff; role-based access limited to what each role needs; access to production data logged and reviewed.
Tenant isolation: Customer Content is logically separated per organization.
Secure development: code review, dependency scanning, and separation of development, staging and production environments.
Monitoring and logging: centralized logs, alerting on anomalies, retention of security logs for at least 12 months.
Backups: encrypted, taken daily, stored with restricted access; deletions made after a backup are re-applied if that backup is restored.
Vulnerability management: regular scanning and patching; penetration test at least annually.
Incident response: documented process, named owner, 72-hour customer notification per clause 3.7.
Personnel: confidentiality agreements, background checks where law allows, privacy and security training on joining and annually.
Data deletion: secure deletion at end of retention; certified on request.
Business continuity: multi-availability-zone deployment and documented disaster-recovery procedure.
Independent assurance: Parter maintains SOC 2 Type II certification; the current report is available to customers under NDA on request.

Annex III — Sub-processors (as of 1 November 2026)

Sub-processor | Purpose | Location

Amazon Web Services, Inc. — Cloud hosting, storage, backups, transactional email (SES), sandboxed code execution (Bedrock AgentCore) — United States
Google LLC — AI models (Gemini API, paid tier) that generate Outputs; not used to improve Google's products; retained up to 55 days for abuse monitoring — United States
Tavily, Inc. — Web search for datasheets and alternatives; receives short part queries only, never Customer Content files — United States
Stripe, Inc. — Payment processing (controller-side data; listed for transparency) — United States
Frontegg, Inc. — Authentication and user management — United States
PostHog, Inc. — Product analytics (usage data) — United States
HubSpot, Inc. — CRM and customer communications (account contacts) — United States
Loops Technologies, Inc. — Marketing and lifecycle email to account holders who opt in — United States
Parter Inc. — Technical and operational support — United States

Parter updates this list under clause 3.4. To receive change notices, email support@parter.ai.