Data Processing Addendum

Last updated: September 26, 2026

This Data Processing Addendum (“DPA”) is between the organization that holds a BEVEL workspace (“Customer”) and Earthena, Inc. (“Processor”). It applies when Processor processes Customer Personal Data on Customer’s behalf to provide the Service, and forms part of the Terms of Service.

1. Roles

Customer is the controller (or a processor acting for its own controller) of workspace content, membership, and messages. Processor processes that Customer Personal Data only on documented instructions: to host channels, deliver agents Customer enables, authenticate members, and secure the tenant. Processor is the independent controller of its own account, billing, and platform telemetry, as described in the Privacy Policy.

2. Details of processing

• Subject matter: hosting Customer’s BEVEL workspace.
• Duration: the term of the Agreement plus deletion or return as below.
• Nature: storage, transmission, display, backup, and support.
• Types of data: names, emails, messages, files, agent transcripts, and related metadata Customer or its users submit.
• Data subjects: Customer’s employees, contractors, and other people Customer invites.

3. Processor obligations

Processor will: process only on Customer’s instructions; ensure people who handle Customer Personal Data are bound to confidentiality; implement the security measures on our Security page; assist with data-subject requests that Customer cannot fulfill alone; notify Customer without undue delay after becoming aware of a personal-data breach; and delete or return Customer Personal Data at the end of the Service, unless law requires storage.

4. Subprocessors

Customer authorizes Processor to use the subprocessors listed in the Privacy Policy (currently Google, Apple, Microsoft, Twilio, SendGrid, and Amazon Web Services) for the purposes stated there. Processor remains responsible for their performance. Processor will post material subprocessor changes on this page and give Customer a reasonable opportunity to object before they process Customer Personal Data.

5. International transfers

Where Customer Personal Data is transferred from the EEA or UK to a country without an adequacy decision, the parties incorporate the Standard Contractual Clauses (and UK Addendum as applicable), with Customer as data exporter and Processor as data importer, module two (controller to processor) unless Customer is itself a processor, in which case module three applies.

6. Audits

Processor will make available information reasonably necessary to demonstrate compliance with this DPA. On 30 days’ written notice, not more than once per year (unless a confirmed breach), Customer may audit Processor’s relevant controls, or accept a current independent report in lieu of an on-site audit.

7. Governing law

This DPA follows the governing law of the Agreement (the State of California), except that the SCCs follow their own governing-law clauses. Questions: hello@bevel.is.