Data Processing Agreement

1. Parties

This Data Processing Agreement (“DPA”) is entered into between:

• Customer (“Controller”) — the entity using Octabiz services.
• Octasys LLC (“Processor”, “Octabiz”), a Kentucky limited liability company located in Louisville, Kentucky, USA.

2. Scope and Purpose

This DPA governs the processing of Personal Data by Octabiz on behalf of the Customer in connection with the use of octabiz.ai, Octabiz applications, and related services (the “Service”).

3. Definitions

• Personal Data — any information relating to an identified or identifiable natural person.
• Processing — any operation performed on Personal Data.
• Subprocessor — any third party engaged by Octabiz to process Personal Data.
• Data Subject — the individual to whom the Personal Data relates.

4. Roles of the Parties

The Customer acts as the Controller of Personal Data. Octabiz acts as the Processor, processing Personal Data only on documented instructions from the Customer.

5. Customer Instructions

Octabiz will process Personal Data only as necessary to provide the Service, as configured by the Customer through the platform, and in accordance with this DPA, the Terms of Service, and applicable law.

6. Categories of Data and Data Subjects

Categories of Personal Data may include:

• Account and contact information (name, email, phone)
• Authentication and credentials
• Customer, vendor, and employee records
• Transactional, financial, and inventory data
• Usage and device data

Data Subjects may include the Customer's employees, customers, vendors, and other contacts.

7. Confidentiality

Octabiz ensures that personnel authorized to process Personal Data are bound by appropriate confidentiality obligations.

8. Security Measures

Octabiz implements appropriate technical and organizational measures to protect Personal Data, including:

• Encryption in transit and at rest
• Role-based access controls and least-privilege principles
• Multi-tenant data isolation
• Logging, monitoring, and audit trails
• Regular backups and disaster recovery procedures
• Vulnerability management and security testing

9. Subprocessors

The Customer authorizes Octabiz to engage Subprocessors to provide the Service. Octabiz will:

• Bind each Subprocessor to data protection obligations no less protective than this DPA
• Remain liable for the acts and omissions of its Subprocessors
• Maintain a current list of Subprocessors (see Privacy Policy)

Octabiz’s Subprocessors include PostHog, Inc. (United States), which Octabiz uses for product analytics and to monitor AI features. When the Customer’s users use an AI feature, PostHog stores the prompt sent to the AI model and the reply it returns, which may contain Personal Data, so that Octabiz can monitor cost, errors, and quality. The Privacy Policy lists all current Subprocessors.

10. International Data Transfers

Where Personal Data is transferred across borders, Octabiz relies on appropriate safeguards such as Standard Contractual Clauses (SCCs), the UK IDTA, or other lawful transfer mechanisms.

11. Data Subject Rights

Octabiz will assist the Customer, by appropriate technical and organizational measures, in fulfilling its obligations to respond to Data Subject requests, including:

• Access, rectification, erasure
• Restriction and objection
• Data portability

12. Personal Data Breach Notification

Octabiz will notify the Customer without undue delay after becoming aware of a Personal Data breach affecting Customer Data, and will provide reasonable information to support the Customer's notification obligations.

13. Data Protection Impact Assessments

Octabiz will provide reasonable assistance to the Customer in carrying out Data Protection Impact Assessments (DPIAs) and prior consultations with supervisory authorities, where required by applicable law.

14. Return or Deletion of Data

Upon termination of the Service, and at the Customer's choice, Octabiz will return or delete Customer Personal Data, subject to:

• Legal retention obligations
• Backup retention cycles
• Aggregated or de-identified data that no longer identifies a Data Subject

15. Audits

Octabiz will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, including third-party audit reports or certifications, where available.

16. AI Processing Clause

• AI features process data only as part of Service functionality.
• No training of public or general-purpose AI models using Customer Data.
• Where data is used for Service improvement, it is aggregated or de-identified where possible.

17. Governing Law

This DPA is governed by the same law as the Terms of Service: the laws of the State of Kentucky, USA.

18. Contact

For data protection inquiries:

Octasys LLC
Louisville, Kentucky, USA
Email: support@octabiz.ai