Data Processing Addendum

1. Definitions and scope

1.1 "Data Protection Law" means the UK GDPR and the Data Protection Act 2018; where applicable, Regulation (EU) 2016/679 (the "EU GDPR") and the national laws implementing or supplementing it; and any other data protection law that applies to the processing under the Agreement.

1.2 "Customer Personal Data" means personal data contained in Customer Data that Galyos processes on the Customer's behalf in providing the Service. "Controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given to them in Data Protection Law.

1.3 The Customer is the controller, and Galyos is the processor, of Customer Personal Data. The details of the processing are set out in Schedule 1.

1.4 This DPA does not apply to personal data that Galyos processes as a controller, such as account, usage, billing and support data, which is covered by the LithAI Privacy Notice.

2. Galyos's obligations

Galyos will:

• (a) process Customer Personal Data only on the Customer's documented instructions, which are the Agreement and the use of the Service's features by Authorised Users, unless the law requires otherwise, in which case Galyos will tell the Customer before processing unless the law forbids it; and tell the Customer if it believes an instruction infringes Data Protection Law;
• (b) ensure that everyone it authorises to process Customer Personal Data is bound by an obligation of confidentiality;
• (c) implement appropriate technical and organisational measures to protect Customer Personal Data, including those described in Schedule 2;
• (d) engage sub-processors only in accordance with section 3;
• (e) taking into account the nature of the processing, assist the Customer by appropriate measures in responding to requests from data subjects, and in meeting its obligations on security, personal data breach notification, data protection impact assessments and prior consultation with supervisory authorities, at the Customer's reasonable cost where the assistance is significant;
• (f) notify the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information reasonably available to help the Customer meet its own obligations;
• (g) at the end of the Agreement, delete Customer Personal Data in accordance with section 18.5 of the Terms, unless the law requires it to be kept; and
• (h) make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, as set out in section 5.

3. Sub-processors

3.1 The Customer gives Galyos general authorisation to engage sub-processors. The current sub-processors are listed in Schedule 3.

3.2 Galyos will tell the Customer about any intended addition or replacement of a sub-processor at least 14 days in advance, by email or in the Service. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the Agreement by notice, as its sole remedy.

3.3 Galyos will impose on each sub-processor data protection obligations that are substantially the same as those in this DPA, and remains responsible to the Customer for the performance of its sub-processors' obligations.

4. International transfers

4.1 Galyos may transfer Customer Personal Data, or allow it to be accessed, outside the UK and the European Economic Area, including in the United States, where the transfer is covered by adequacy regulations or an adequacy decision (including the EU-US Data Privacy Framework and its UK Extension, where the recipient is certified), or by appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses.

4.2 Transfers of Customer Personal Data from the European Economic Area to Galyos in the UK rely on the European Commission's adequacy decision for the UK. If that decision ceases to apply, the parties agree that the EU Standard Contractual Clauses (Module 2 or Module 3, as applicable) are incorporated into this DPA for those transfers.

5. Information and audits

5.1 Galyos will answer the Customer's reasonable written questions about its compliance with this DPA and provide supporting documentation.

5.2 If that information is not sufficient to demonstrate compliance, or a supervisory authority requires it, the Customer may carry out an audit, or have one carried out by an independent auditor bound by confidentiality: no more than once in any 12-month period, on at least 30 days' notice, during business hours, at the Customer's cost, and without access to other customers' data or to Galyos's confidential security information.

6. Customer obligations and Training Data

6.1 The Customer will ensure that it has a lawful basis for the processing of Customer Personal Data, that it has given any notices required, that its instructions comply with Data Protection Law, and that it does not upload more personal data than the Service needs. The Customer must not upload special category data or data relating to criminal convictions.

6.2 Before using any Customer Data as Training Data under section 7.4 of the Terms, Galyos will remove or anonymise any personal data in it. Anonymised data is not personal data and is outside the scope of this DPA.

7. Liability and order of precedence

7.1 Each party's liability under or in connection with this DPA is subject to section 16 of the Terms, to the extent permitted by Data Protection Law.

7.2 If this DPA and the Terms conflict on a matter relating to personal data, this DPA prevails.

Schedule 1: Details of the processing

• Subject matter: the provision of the LithAI Service to the Customer.
• Duration: the term of the Agreement, plus the deletion period in section 18.5 of the Terms.
• Nature of the processing: hosting, storage, image processing (slab segmentation and rectification), piece detection, packing, rendering, export, back-up and support.
• Purpose: to provide the Service to the Customer in accordance with the Agreement.
• Categories of data subjects: individuals named or shown in Inputs, such as architects, designers, engineers, contractors, the Customer's clients and staff, and any individuals incidentally visible in slab photographs.
• Types of personal data: names, job titles, company names, contact details, signatures and project references appearing in drawings and title blocks; project or site addresses; images of individuals incidentally captured in photographs; and any other personal data the Customer chooses to include in Inputs.
• Special category data: none intended. The Customer must not upload any.

Schedule 2: Security measures

• Encryption in transit (HTTPS/TLS) for all traffic between the browser, the web application and the processing backend.
• Encryption at rest of the database and file storage, provided by the hosting provider.
• Personal logins for every Authorised User. No self-service sign-up: each login is created individually by Galyos.
• Every request to the processing backend must carry a valid signed session token, verified on each request.
• Account isolation enforced in the database by row-level security, so that users can only access the projects and files of their own account.
• Administrative access limited to Galyos personnel who need it. Service credentials are held in secret stores and are never exposed to the browser.
• Slab processing, packing and rendering run in isolated cloud containers for the duration of each request.
• Back-ups managed by the database provider.
• Usage logging of backend operations, for security and billing.
• A personal data breach response process: assess, contain, and notify the Customer in accordance with section 2(f).

Schedule 3: Sub-processors