Master Terms of Service Corti Models
As of June 2026
These Master Terms of Service ("Terms") are entered into as of the Effective Date between Corti ApS, a corporation organized and existing under the laws of Denmark, having its principal office at Kuglegårdsvej 2, 2nd floor, 1434 Copenhagen K, Denmark, with company registration number 35669825 (together with its Affiliates, "Corti") and Customer (as defined below) ("Customer", "you", or "your"). The Terms govern Customer's use of the Corti Services (as such term is defined below).
Acknowledgment
PLEASE READ THESE TERMS CAREFULLY. BY ACCESSING AND/OR USING THE PLATFORM, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE LEGALLY BOUND BY THESE TERMS, AND THE TERMS AND CONDITIONS OF OUR PRIVACY POLICY (THE "PRIVACY POLICY"), WHICH IS HEREBY INCORPORATED INTO THESE TERMS BY REFERENCE (COLLECTIVELY, WITH THE ORDER FORM, THE "AGREEMENT").
If you are entering into these Terms on behalf of an organization, you represent that you have the authority to bind that entity.
You acknowledge that no term in any Order entered into via a reseller will be deemed to modify the Agreement unless pre-authorized in writing by Corti.
You acknowledge that Corti will not use Customer Data (including Personal Information) to train or improve AI models provided to other customers unless you have expressly opted in through a separate Model Training and Improvement Addendum. This commitment ensures your data remains exclusively for your use while providing the Corti Services, maintaining security and integrity of the Platform, and troubleshooting incidents in accordance with the applicable DPA.
Background
Corti provides an artificial intelligence infrastructure platform ("Platform") that enables its customers to deploy and scale AI offerings. The Platform offers foundation models, APIs, and developer tools for integrating AI into software solutions.
For purposes of this Agreement, "Corti" means the Corti group entity identified below that corresponds to the Customer's principal place of business (or, if the Customer is an individual, their country of residence):
(A) the United States, Corti America Inc., a corporation organized and existing under the laws of the State of Florida and having a place of business at 390 NE 191st St STE 17295 Miami, FL 33179, USA;
(B) the European Economic Area or Switzerland, Corti ApS, a corporation organized and existing under the laws of Denmark, having its principal office at Kuglegårdsvej 2, 2nd floor, 1434 Copenhagen K, Denmark, with company registration number 35669825;
(C) the United Kingdom, Corti AI UK Limited, a company incorporated under English law (company number 15562479), having its registered office at 86-90 Paul Street, 3rd Floor, London, United Kingdom, EC2A 4NE; or
(D) any other jurisdiction, the Corti entity expressly named as the contracting entity on the applicable Order Form.
The relevant Corti entity shall be the contracting party under this Agreement and the issuer of the applicable Order Form. The following Terms shall apply to your use of the Platform and the Corti Services.
1. DEFINITIONS
1.1. In this Agreement, the following definitions apply:
"Activation Support" means onboarding, implementation support, enhanced technical assistance, integration assistance, specialized consulting, custom development, training, and advanced technical services provided by Corti to help Customer deploy, configure, and optimize the Platform. Additional Activation Support may be purchased using API Credits as specified in an Order Form or through the Platform console and is billed based on the scope of work set forth in the applicable Statement of Work or service description. For Order Forms structured with a Pricing Envelope, API Credits committed under the Pricing Envelope may be used for both Platform Services consumption and Activation Support services, unless otherwise specified in the Order Form;
"Administrator" means one or more individuals who are employees of the Customer, having responsibility for the administration of the Platform on the Customer's side;
"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with a party;
"API" means the application programming interfaces made available by Corti as part of the Platform, which allow Customer's systems, applications, or services to communicate and interact with the Platform;
"API Credits" or "Credits" means the metered units of consumption, with 1 API Credit being equal to one U.S. dollar (USD $1.00) worth of tokenized API consumption, that is allocated to Customer for use of the Platform Services and Activation Support. API Credits are fungible and may be used for any Corti Service, including Platform Services and Activation Support, unless otherwise specified in an Order Form. For Enterprise Order Form Customers, API Credits may be structured as a "Pricing Envelope", a committed annual quantity of Credits that serves as both a spending floor and a consumption ceiling, with pricing and any applicable credit-to-user conversion rates locked for the full term of the Order Form. Volume-based discount tiers may apply based on annual commitment levels, as specified in the applicable Order Form. Corti will calculate API Credit usage based on its system logs and metering infrastructure, which shall serve as the authoritative record for billing purposes;
"API Rate Limits" means the maximum number of API requests, volume of data processed, or computational resources that Customer may consume within a specified time period, as defined in the applicable Order Form, the Documentation, or Corti's then-current usage or service policies;
"Authorized User" means employees or computerized systems of Customer or its Affiliates authorized to access the Platform;
"Beta Service" means any feature of the Platform that is clearly designated as "beta", "experimental", "preview" or similar, that is provided prior to general commercial release, and that Corti, at its sole discretion, offers to Customer, and Customer at its sole discretion elects to use;
"Business Days" means Monday through Friday, excluding public holidays observed in the jurisdiction of the Corti contracting entity identified in the Background section of this Agreement;
"Confidential Information" has the meaning given in clause 4.1;
"Corti IP Rights" means copyrights, designs, patents, trademark rights, domain names, and any other proprietary intellectual property rights and know-how to the Platform, including the software, any Enhancements, and the Documentation;
"Corti Products" means software applications developed, owned, and operated by Corti that are built on the Platform Infrastructure and offered to customers as distinct products with their own intended use, including without limitation Corti Assistant. Corti Products may be offered as standalone services or via API integration with Customer's systems and shall be available through Order Form only;
"Corti Services" means the (a) "Platform Services", which include hosting and operating the Platform, providing API access, executing AI model inference and processing requests, generating Output, and related technical services; (b) "Support Services"; (c) "Activation Support"; and (d) "Corti Products", to the extent ordered by Customer under an applicable Order Form;
"Customer" means the person or entity seeking to use the Platform pursuant to these Terms;
"Customer Data" means any data, content, or information (including Personal Information) that (a) Customer or its Authorized Users submit to or transmit through the Platform in connection with use of the Corti Services; or (b) data generated by the Platform solely for Customer's use and contains or is derived directly from Customer's submitted content; for clarity, Customer Data includes all inputs and outputs associated with Customer's accounts except for Usage Data;
"Data Processing Agreement" or "DPA" means the applicable data processing, data protection, or privacy agreement governing Corti's processing of Personal Information under applicable law, which may include: (a) for the European Economic Area, United Kingdom, or Switzerland: the Corti Data Processing Agreement; or (b) for other jurisdictions: equivalent data protection addenda as required by applicable law. If the parties have executed a separate DPA, that executed version shall apply. Otherwise, the Corti standard agreement for the applicable jurisdiction is incorporated into this Agreement by reference;
"Documentation" means any user guidelines, tutorials, manuals, or other documentation that may be provided by Corti from time to time regarding the Platform;
"Effective Date" means the date upon which Customer accepts these Terms;
"Enhancements" means updates, upgrades, modifications, improvements, developments, new features, or other enhancements related to the Platform;
"Excluded Claims" means claims arising from (a) personal injury or death caused by the gross negligence or wilful misconduct of a party, its employees or agents; (b) fraud or fraudulent misrepresentation; and (c) any other liability that cannot be excluded or limited as a matter of applicable law;
"Monthly Subscription" means a recurring monthly subscription package for a fixed allotment of API Credits at a specified monthly fee, billed monthly in advance on a take-or-pay basis and non-cancellable during the monthly term;
"Order" means a request for Corti Services made through an executed Order Form, referencing this Agreement;
"Order Form" means the written or electronic document that serves as the vehicle for Orders and becomes binding when accepted by both parties, including references to applicable Statements of Work;
"Order Form Customers" means customers who have entered into a contractual agreement with Corti by executing an Order Form;
"Output" means any results, responses, analyses, transcriptions, summaries, recommendations, or other content generated by the Platform in response to Customer Data or other inputs provided by or on behalf of Customer, but does not include Usage Data;
"Pay-As-You-Go Wallet" or "PAYG Wallet" means a prepaid credit balance that Customer may load into their Platform account and draw down based on actual usage of Corti Services;
"PAYG Wallet Customers" means customers who purchase and use Corti Services through a prepaid wallet balance on the Platform;
"Personal Information" means any information submitted by or on behalf of Customer to the Platform relating to an identified or an identifiable natural person;
"Platform Infrastructure" means Corti's general-purpose artificial intelligence infrastructure, including foundation models, APIs, SDKs, developer tools, and related technical services, that enables customers to build, deploy, and operate their own applications, products, or services. Products, applications, or services developed by Customer or third parties, and not Corti, are solely responsible unless otherwise expressly agreed in writing;
"Platform Services" means the hosted AI platform capabilities, API access, model inference, data processing, and related technical services provided by Corti to deliver the Platform functionality;
"Service Disruption" means any unplanned interruption, degradation, or unavailability of the Platform Services that materially impairs Customer's ability to access or use the APIs, excluding disruptions caused by Customer's infrastructure, internet connectivity, or third-party services not controlled by Corti;
"SLA" means the Service Level Agreement that describes the service performance standards and support levels applicable to the Corti Services;
"SOW" means a Statement of Work executed by both parties that describes specific professional services, deliverables, timelines, and any associated fees or responsibilities;
"Support Services" means the software support operated and made available by Corti as further described in the SLA;
"System" means any application, computing or storage device, or network;
"Transaction" means any self-service purchase, subscription, activation, or usage event initiated by Customer through the Platform console, developer portal, or API interface, including PAYG Wallet credit purchases, Monthly Subscription, Activation Support or trial registrations;
"Usage Data" means technical and operational data generated in connection with Customer's use of the Platform that relates to the performance, operation, and utilization of the Corti Services, including API call metadata, technical logs, telemetry data, performance metrics, and aggregated statistical information. Usage Data does not include Customer Data, the substantive content of inputs or outputs processed through the Platform, or any information that directly identifies Customer's specific personnel or proprietary business information. If Usage Data initially contains or could be used to re-identify any Personal Information, Corti will either de-identify such data in accordance with applicable standards or handle such data in accordance with the DPA; and
"Wallet" means the Customer's credit balance maintained by Corti, which records the amount of prepaid API Credits purchased by Customer and the deductions made based on consumption. The Wallet is an accounting mechanism only and does not create a separate account, escrow, or property interest in favour of Customer.
2. USE OF THE PLATFORM SERVICES
2.1 Revenue Arrangement Frameworks. Customer may engage with Corti through one of three payment models:
a. Pay-As-You-Go (PAYG) Wallet. Customer loads prepaid API Credits into a wallet balance and credits are consumed based on actual usage. For clarity, Corti Products are not available through the PAYG Wallet and require an executed Order Form;
b. Monthly Subscription. Customer subscribes to automatic monthly billing of a fixed fee for a predetermined allotment of API Credits. For clarity, Corti Products are not available through Monthly Subscriptions and require an executed Order Form; and
c. Commitments (Order Form only). Customer commits to a specified dollar amount of API Credits to be consumed within a fixed period as specified in an Order Form. At the end of the commitment period, Corti will invoice Customer for the difference between the committed amount and actual consumption, and remaining Credits then lapse.
2.2 Customer Acknowledgments Regarding AI Output. Customer acknowledges and agrees that:
a. Output is probabilistic and may be inaccurate. Output generated by the Platform (including transcripts, summaries, or analyses) is not a substitute for professional judgment, advice, or decision-making;
b. Human validation is required. Customer is responsible for evaluating all Output for accuracy, completeness, and suitability before relying on it, sharing it, or incorporating it into any workflow. Where Output may influence operational or other high-impact decisions, Customer must implement appropriate oversight and review consistent with applicable laws, regulations, and professional standards. Such oversight may take the form of human review or, where appropriate to the nature of the deployment (including autonomous or agentic implementations), automated or programmatic validation, monitoring, and control measures reasonably designed to detect and correct inaccurate or unexpected Output; and
c. Restrictions on use involving individuals. Customer must not use any Output about an identified or identifiable person for any purpose that could have a legal or material impact on that person, including making or influencing decisions about their insurance coverage, credit, education, housing, employment, or legal rights. For Platform Infrastructure customers building their own applications, this restriction may be modified via Order Form with appropriate risk allocation terms.
d. Responsibility for automated and agentic use. Customer is solely responsible for all actions, decisions, and outputs taken or generated by Customer's systems, applications, integrations, and any autonomous or agentic implementations that use the Output or the API, including actions taken automatically and without human review. Customer's acknowledgments and obligations under this clause 2.2 apply regardless of the degree of automation or autonomy of Customer's implementation.
2.3 No representation or endorsement. Corti does not make any representation or warranty that the Output will be error-free or suitable for use without professional oversight. Output may include incomplete or contextually inaccurate information and should be reviewed and validated by qualified personnel before being used for operational purposes. Customer is solely responsible for determining whether and how to use Output, ensuring that such use complies with applicable law, regulatory requirements, and professional standards.
2.4 Corti Responsibilities.
a. Access rights. For Customers using pay-as-you-go billing, Corti grants a limited, revocable, non-exclusive, and non-transferable right to access and use the Platform and Platform Services, subject to usage-based fees and the applicable usage and billing terms published on the Corti developer portal. For Monthly Subscription Customers, the same right applies subject to maintaining an active Monthly Subscription with a valid payment method on file. For Order Form Customers, during the applicable Order term and subject to timely payment of all applicable fees, Corti grants Customer and its Authorized Users a limited, revocable, worldwide, non-exclusive, and non-transferable right to access and use the Platform and Corti Services. No such right of access extends to Corti Products, which are available only under a separate Order Form;
b. Services. Corti is responsible for the operation of the Platform in connection with the provision of the Platform Services. The performance, availability, and support levels will be governed by Corti's SLA;
c. Security Measures. Corti shall implement and maintain reasonable administrative, physical, and technical safeguards designed to protect the security, confidentiality, integrity, and availability of Customer Data. For Customers subject to the DPA, additional security obligations are set forth in the DPA. Corti may update the Security Measures from time to time, provided that such updates will not materially reduce the overall level of protection for Customer Data, and Corti will provide notice of material changes;
d. Subcontractors. Corti shall be responsible for its use of any subcontractors as if Corti had performed such services itself. Corti has a general authorisation to engage, add or replace subcontractors, provided that Corti will provide Customer with advance written notice of any intended changes at least thirty (30) days before the change takes effect, during which Customer may object on reasonable, documented, data protection grounds. If Corti cannot reasonably remedy an objection within a commercially reasonable period, Customer may terminate the affected Services upon written notice and receive a pro-rata refund of any prepaid fees for the terminated portion; and
e. Corti Compliance with laws. Corti will provide the Corti Services in accordance with (a) applicable laws in the jurisdiction of the Corti contracting entity identified in the Background section; and (b) data protection and data privacy laws applicable to Corti as a data processor or sub-processor, as applicable, as set forth in the DPA. Regulatory compliance obligations for products built by Customer using Platform Infrastructure rest with Customer as set forth in clause 6.6.
2.5 Customer responsibilities.
a. General Requirements. The Customer is responsible for establishing and maintaining the technical environment required to connect to and use the API as described in the Documentation, including secure management of API Keys, network connectivity, and configuration;
b. API Keys and Authentication. The Customer is solely responsible for the security of its API Keys and authentication credentials. Customer will keep such credentials confidential, store API Keys securely, not embed API Keys in client-side code or public repositories, implement appropriate access controls, rotate API Keys periodically, and immediately notify Corti at security@corti.ai if Customer suspects any unauthorized access. Customer acknowledges that all API requests made using Customer's valid API Keys will be deemed authorized by Customer and billed accordingly;
c. Customer Data Rights. Customer represents that it has all rights and authorizations to submit and process Customer Data using the Platform, and will make and maintain its own backups of Customer Data;
d. Reasonable Use instructions. Customer shall follow all reasonable use instructions and recommendations given by Corti in respect of the use of the Platform, including Corti's published rules, policies, or guidelines;
e. Customer Compliance with laws. Customer undertakes it shall, and shall procure that its Authorized Users shall, use the Corti Services in compliance with all applicable laws and government regulations, including those related to data protection and data privacy. Customer acknowledges that the Corti Services may be subject to export controls and trade sanctions and may not export or provide access to the Platform Services where prohibited under applicable law. Customer acknowledges that certain Platform components may include open-source software;
f. Unauthorized Access or Use. Customer will prevent any unauthorized access to, or use of, the Platform and, in the event of any such unauthorized access or use, promptly notify Corti;
g. Responsibility for Users. Customer will be fully responsible for the Authorized Users' authentications, for any actions taken using Customer's user accounts, and for any acts or omissions of Customer's personnel. If requested by Corti, Customer will provide a list of its then-current Administrators and Authorized Users within 5 days; and
h, API Operations and Technical Requirements.
i. Rate Limits and Throttling. Customer's use of the Platform APIs is subject to API Rate Limits, subject to a default Rate Limit of 200 concurrent connections. If Customer exceeds applicable Rate Limits, Corti may throttle, queue, or reject API requests, or charge additional fees;
ii. Service Availability. Corti will use commercially reasonable efforts to make the Platform APIs available in accordance with the uptime commitments set forth in the SLA. Customer acknowledges that API availability may be affected by factors outside Corti's control;
iii. Credit Exhaustion and Service Continuity. If Customer exhausts its allocated API Credits or prepaid balance, then (a) for Customers with an active Order Form, Corti will provide email notice at 90% and 100% of allocated API Credits and may continue to provide services for up to five (5) Business Days after exhaustion, with overage billed at standard rates; and (b) for PAYG Wallet and Subscription Customers, Corti may immediately suspend API access until payment is received or limits are increased; and
iv. API Request Specifications. Customer will format API requests in accordance with the Documentation. Corti may reject malformed requests, requests exceeding size limits, or requests that Corti reasonably determines pose a security or stability risk.
2.6 Platform Restrictions. Customer shall not:
a. except as expressly permitted in an Order Form, sell, resell, rent, lease, license, sublicense, assign, transfer, distribute, host, time-share, outsource, provide service bureau or managed service access to, disclose, modify, or otherwise make the Platform, the API, or any API credentials available to any third party; provided that Customer may incorporate Output generated through API usage into Customer's own software products or services for distribution to its end customers without Corti's prior written approval so long as: (A) no third party is provided direct access to the Platform, APIs, or credentials; (B) Customer remains fully responsible for all downstream use; (C) such incorporation complies with clauses 2.2 to 2.4; (D) Customer does not represent that such products are "powered by Corti" or use Corti's name, trademarks, or logos without Corti's prior written approval; (E) Customer's agreements with its end customers include AI output disclaimers materially equivalent to those in clauses 2.2 to 2.4; and (F) Corti may revoke this permission upon ninety (90) days' written notice if Customer's use of Output materially harms Corti's reputation or creates regulatory risk for Corti;
b. reverse engineer source code or machine learning model parameters;
c. use the API to develop or train competing machine-learning models or services to Corti;
d. use the API or Output for unlawful purposes or in violation of regulatory requirements;
e. interfere with or degrade the Platform, or introduce malware or harmful code;
f. misrepresent the Output generated by the Platform as having been human-generated, it being acknowledged that Corti will implement reasonable technical measures to enable identification of AI-generated Output where required by applicable law, including the EU AI Act;
g. bypass, disable, interfere with, or attempt to circumvent safety features, guardrails, or content filters embedded in the Platform, including via prompt injection or adversarial inputs; and
h. benchmark or test the Platform for competitive purposes without prior written approval.
2.7 Third-Party Use. Any provision of direct access to the Platform Services, APIs, or API credentials to third parties requires prior written approval from Corti and may be subject to additional terms and fees; for clarity, no prior approval is required for Customer's distribution of Output integrated into Customer's own products in accordance with clause 2.6(a).
2.8 Enhancements. Customer acknowledges that it is entering into this Agreement based on the Platform and APIs as they exist on the Effective Date, and not in reliance on the delivery of any future functionality. Corti may, at its sole discretion, develop, modify, release, or deprecate features, models, endpoints, or other components of the Platform, and has no obligation to maintain backward compatibility except where explicitly stated in an active Order Form or the Documentation. Notwithstanding the foregoing, Corti will give Customer at least ninety (90) days' prior written notice before deprecating, or making a backward-incompatible change to, any generally available API, endpoint, or model that Customer is then actively using in production, and will use commercially reasonable efforts to keep the prior version available during a transition period of at least sixty (60) days, except where a shorter period is reasonably required to address a security vulnerability, a change imposed by a third-party provider, or a legal or regulatory requirement. All Enhancements are and will remain the exclusive property of Corti, and Customer hereby irrevocably assigns all such rights, title, and interest to Corti.
2.9 Beta Services. Beta Services are provided solely for ideation, testing, and evaluation purposes, may contain errors, and may be modified, suspended, or discontinued at any time without notice. Beta Services are not intended for use in any workflow where failure or inaccuracy could cause harm, regulatory non-compliance, or material impact. Beta Services are provided "as-is" without warranties of any kind and Corti will have no liability arising from their use. If a Beta Service transitions to general availability, Corti will notify Customer at least thirty (30) days in advance, after which the service will become subject to the standard terms, warranties, SLA commitments, and pricing applicable to Platform Services.
2.10 Exclusions. The Platform and APIs are provided as hosted services. Corti will not be responsible for failures, delays, or errors arising from (a) hardware, software, network connectivity, or infrastructure not provided or controlled by Corti; (b) third-party services, integrations, or data sources not operated by Corti; (c) Customer's failure to follow Corti's Documentation, implementation guidance, or security instructions; (d) Customer's modification or misuse of the API or SDKs; or (e) Customer's rejection of required updates or Enhancements.
2.11 Customer Data.
a. Processing rights. Corti processes Customer Data solely to provide and improve the Corti Services, maintain operational security, and troubleshoot incidents in accordance with documented instructions under the DPA; Corti will not use Customer Data to train or improve models provided to other customers absent Customer's prior, express opt-in via the Model Training and Improvement Addendum. Any thirty (30) day deletion timeline is an operational objective and not a service level commitment;
b. Backups. Corti does not serve as the system of record for Customer Data. Customer is responsible for maintaining its own persistent copies or backups of Customer Data and Output. In the event of any loss or corruption of data within Corti's control, Corti will use commercially reasonable efforts to restore such data from its existing logs or backups, if maintained; and
c. Personal Information. Corti will process Personal Information strictly in accordance with Customer's documented instructions as set out in the DPA. Any additional Customer-specific data-processing instructions may require written agreement and may result in additional charges.
2.12 Support. Corti will provide technical support for the Platform and APIs at the level specified in the applicable Order Form or SLA. If no support level is specified, Customer's support will be limited to access to Corti's publicly available Documentation, developer resources, and community or status pages.
3. FEES AND PAYMENT
3.1 Payment. Customer will pay all fees for the Corti Services as outlined in the applicable Order Form or, for PAYG Wallet or Monthly Subscription access, in accordance with Corti's published pricing at the time of use.
3.2 General. Platform usage is measured in API Credits, unless otherwise specified in an Order Form. The Platform dashboard provides Customer with visibility into remaining API Credit balance and consumption trends; Corti's system logs and metering infrastructure shall serve as the authoritative record for billing purposes.
3.3 Currency and payment terms. All fees are payable in the currency specified in the applicable Order Form (or, if none, in U.S. Dollars), and invoiced amounts are due within fourteen (14) days from the invoice date; for clarity, all monetary limits relating to liability are stated and enforceable solely in United States Dollars (USD), regardless of the Order Form currency.
3.4 Frequency of invoicing. Billing frequency varies by customer arrangement: (a) PAYG Wallet Customers are billed upon replenishment of wallet balance; (b) Monthly Subscription customers are billed monthly in advance; and (c) Order Form Customers are invoiced in accordance with the payment schedule set forth in the applicable Order Form.
3.5 API Credit Validity. All API Credits purchased are valid for twelve (12) months from the date of purchase (the "Credit Validity Period"), unless otherwise specified in an Order Form. Monthly Subscriptions operate on a monthly take-or-pay basis and Order Forms with committed API Credits operate on an annual take-or-pay basis. Unused credits at expiration of the Credit Validity Period will expire and become non-recoverable, except as expressly set forth in an Order Form. The Credit Validity Period may be extended in the event of Service Disruptions attributable to Corti that prevented Customer from using the Platform for a cumulative period exceeding five (5) Business Days, with extension equal to the duration of such Service Disruptions.
3.6 Refunds. Unless otherwise specified in an Order Form, all fees are non-refundable and non-creditable.
3.7 Reseller payments. Where Customer purchases through a reseller or partner, payment terms with that reseller or partner govern. However, if Customer fails to pay any due amounts to such reseller or partner, Corti may seek payment directly from Customer.
3.8. Pay-as-you-go payments. For PAYG Customers, payment occurs when Customer manually replenishes their PAYG Wallet balance. Customer authorizes Corti (and its third-party payment processors) to charge the applicable fees to the payment method on file. Customer must maintain a valid payment method on file at all times for PAYG Wallet accounts.
3.9. Late Payments. Any amounts not paid when due will accrue late payment charges at the rate of two percent (2%) per month, or the maximum rate permitted by applicable law, whichever is higher. If Customer's account becomes more than thirty (30) days past due, Corti may suspend Customer's access to the Platform until all outstanding amounts are paid. Customer will reimburse Corti for all reasonable costs of collection.
3.10. Price Adjustments. Beginning 12 months after the Effective Date, Corti may increase its then-current fees upon renewal of any Order Form or, for month-to-month services, upon sixty (60) days' advance written notice. Any such price increase will not exceed ten percent (10%) annually, except where increases are necessary to reflect material increases in third-party infrastructure costs, for which Corti will provide at least ninety (90) days' advance notice and reasonable supporting documentation. For Order Forms structured with a Pricing Envelope with locked pricing, no price adjustments will apply during the term. If Customer objects to a price increase, Customer's sole remedy is to terminate the affected Services at the end of the then-current term by providing written notice within thirty (30) days of receiving notice.
3.11 Taxes. All fees are exclusive of all applicable value-added, sales, use, and other taxes and all applicable export and import fees, customs duties, and similar charges (other than taxes based on Corti's net income) ("Taxes"). Corti will invoice applicable Taxes as a separate line item, and Customer will be responsible for payment. If Customer claims an exemption from any Tax, Customer will provide Corti with appropriate exemption certificates.
4. CONFIDENTIALITY
4.1. Definition. "Confidential Information" means any non-public information provided by one Party ("Discloser") to the other Party ("Recipient") that is either conspicuously identified as confidential or proprietary or should be reasonably understood to be confidential, including product plans, pricing, source code, security and architecture details, and customer information. Customer's Confidential Information includes Customer Data, and Corti's Confidential Information includes non-public information about the Platform, APIs, models, and Documentation.
4.2. Exclusions. Confidential Information does not include information that (a) is already known to Recipient without obligation of confidentiality prior to disclosure; (b) is or enters the public domain through no wrongful act of the Recipient; (c) is lawfully received by Recipient from a third party without confidentiality obligations; or (d) was independently developed by Recipient without access to the Confidential Information.
4.3. Protection. Recipient will only use Confidential Information to perform its obligations or exercise its rights under this Agreement and will not disclose Confidential Information except to its and its Affiliates' officers, employees, agents, and representatives who have a need to know and who are bound by confidentiality obligations at least as protective as those set forth herein. Recipient will maintain the Confidential Information using the same degree of care as it uses to protect its own similar information (but no less than reasonable care).
4.4. Duration. The obligations in this clause 4 will survive for five (5) years from the date of disclosure, except for trade secrets, which will remain protected for so long as they qualify as trade secrets under applicable law.
4.5. Compelled Disclosure. If Recipient is compelled by law to disclose Confidential Information, it will, where legally permitted, provide Discloser with prompt written notice sufficient to allow Discloser an opportunity to object, and will produce only such Confidential Information as is legally required.
4.6. Return or Destruction. At Discloser's request upon termination, Recipient will promptly return or destroy all Confidential Information, except for copies required to be retained under applicable law or in backup or archive media, provided the obligations of confidentiality continue to apply to such retained copies.
4.7. Remedies. Each Party agrees that the non-breaching Party will be entitled to seek injunctive or other equitable relief to prevent or remedy a breach of this clause 4 in addition to any legal remedies available.
4.8. Use of Anonymized Usage Data. Corti may use anonymized or aggregated usage data, including system logs and telemetry derived from Customer's use of the Platform, to operate, maintain, and improve the Platform and related services, consistent with the Usage Data definition, clause 5.4(b), and the DPA.
5. INTELLECTUAL PROPERTY RIGHTS
5.1 Rights. As between the Parties, all rights, title, and interest in and to the Platform, APIs, Documentation, SDKs, models, algorithms, designs, and all related technology and intellectual property ("Corti IP") are and will remain the exclusive property of Corti and its licensors. Access to the Platform is provided as a service, not as a sale or transfer of ownership.
5.2. Feedback. Customer may provide Corti with feedback, suggestions, or ideas relating to the Platform ("Feedback"). Corti may freely use, modify, and incorporate Feedback without restriction or obligation to Customer, provided Corti will not attribute such Feedback to Customer without consent. Customer hereby assigns to Corti all rights, title, and interest in and to any intellectual property arising from such Feedback. All Feedback is provided "as-is" without warranties.
5.3. Model improvements. Corti retains all right, title, and interest in and to any improvements, modifications, or enhancements to its Platform, models, algorithms, or systems ("Model Improvements"), including those resulting from the processing of Usage Data in the ordinary course of providing the Corti Services, provided that such Model Improvements do not incorporate, disclose, or make identifiable any Customer Data or Customer Confidential Information and are not derived from Customer Data except where Customer has expressly opted in under the Model Training and Improvement Addendum.
5.4. Output and Usage Data.
a. Output Ownership. As between the parties, and to the extent permitted by applicable law, Customer retains all rights, title, and interest in its Customer Data and in all Output generated by the Platform based on that Customer Data. If and to the extent Corti has any rights in such Output, Corti hereby assigns those rights to Customer. Notwithstanding the foregoing, Corti retains all rights, title, and interest in and to the underlying Platform, APIs, models, algorithms, software, and other technologies used to generate the Output;
b. Restrictions on Use of Customer Data for Model Training.
i. Corti will not use Customer Data (including Personal Information) for the training or improvement of AI models provided to other customers absent Customer's express, written opt-in via Corti's Model Training and Improvement Addendum (the "Model Training Addendum"); for clarity, absent such opt-in, Corti's processing of Customer Data is limited to providing the Corti Services, ensuring security and integrity of the Platform, and troubleshooting incidents in accordance with the DPA. For Personal Information subject to the GDPR or UK GDPR, de-identification or anonymisation means processing such that the data no longer relates to an identified or identifiable natural person within the meaning of Article 4(1) GDPR, assessed in accordance with Recital 26 GDPR; for the avoidance of doubt, pseudonymisation alone does not constitute anonymisation;
ii. Only upon Customer's express, written opt-in via the Model Training Addendum may Corti process Customer Data for model improvement purposes, and any such processing will be strictly limited to the scope, safeguards, and consideration set out in that addendum, which shall document Customer's role as data controller and Corti's role as data processor or sub-processor (as applicable), lawful basis, retention, and transfer mechanisms. The Model Training Addendum will provide for appropriate technical and organizational safeguards (including documented GDPR-compliant safeguards such as data minimization), a prohibition on re-identification, Customer's right to revoke consent upon 30 days' written notice, and Corti's transparency and reporting obligations; and
iii. Fine-tuning. Where agreed, Corti may use Customer Data solely to create and maintain Customer's dedicated fine-tuned model instance. Such fine-tuning does not constitute general model training and the results will not be incorporated into Corti's base models or made available to other customers in identifiable form. Corti may use aggregated, de-identified performance insights derived from fine-tuning engagements to improve the Platform generally, provided that such insights cannot reasonably be used to identify Customer, reconstruct Customer Data, or reverse-engineer Customer's fine-tuned model;
c. Usage Data. Corti may collect and use Usage Data to operate, maintain, secure, and improve the Platform and Corti's related technologies, including to improve the performance, accuracy, and reliability of Corti's AI models and services, and for internal analytics and research purposes. Corti will implement appropriate technical measures designed to ensure that Usage Data does not contain Customer Data or personal data in identifiable form, and will promptly delete or de-identify any identifiable data inadvertently captured. Usage Data will not be used in any manner that would identify Customer by name or expose the substantive content of Customer's prompts or outputs; and
d. Data Privacy Compliance. To the extent applicable and in the role applicable to it under the DPA (including as processor or sub-processor), Corti will collect, process, and use data in compliance with the DPA and applicable data protection laws, and will implement lawful transfer mechanisms for any cross-border processing as specified in the DPA.
6. WARRANTIES AND DISCLAIMERS
6.1. Mutual Warranty. Each party warrants that it is validly entering into the Agreement and has the legal authority to do so.
6.2. Customer Warranties. Customer represents and warrants that it (a) has implemented and will maintain commercially reasonable technical and organizational measures to prevent unauthorized access to the Platform and misuse of any API credentials; and (b) will use the Platform and Corti Services only in compliance with all applicable laws and regulations, including those relating to data protection and export control.
6.3. Limited Warranty. Corti warrants that, during the term, the Platform will perform in material conformance with the applicable Service Description hosted on Corti's Documentation pages. For any breach of this warranty, Corti's sole obligation and Customer's sole remedy will be for Corti to promptly (and at no charge) bring the Platform into material conformance or, if not commercially feasible, to terminate this Agreement and refund any unused, prepaid fees. This warranty will not apply to any non-conformance caused by Customer's misuse or modification of the Platform, failures in Customer's own equipment, networks, and systems, or issues in or caused by third-party systems.
6.4. Disclaimer. Except as expressly provided above, Corti provides the Platform, Documentation, and all related Services on an "as is" and "as available" basis and disclaims all other warranties, whether express, implied, statutory, or otherwise, including any implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement.
6.5. AI Technology Limitations. Customer acknowledges and agrees that:
a. the Platform uses artificial intelligence and machine learning technologies that are probabilistic in nature, and AI agents, embedded applications, and API-generated Output may produce varied, unexpected, incomplete, or inaccurate results;
b. model-generated Output is not a substitute for professional judgment, human review, or subject-matter expertise, and Customer is solely responsible for verifying the accuracy, completeness, and appropriateness of any Output before use;
c. Customer must not rely on Output as a sole source of truth or use it for decisions that could materially affect individuals without appropriate human oversight and independent verification as required by law or professional standards;
d. if Output references any third-party products, services, or information, this does not mean such third party endorses or is affiliated with Corti, nor does Corti endorse or warrant such third-party content; and
e. the Platform may contain links or references to third-party sites or data, and Corti has no liability for Customer's use of or reliance on such third-party content. Any residual warranties to the extent not disclaimable under applicable law are limited to ninety (90) days from the date Corti first granted Customer access to the Platform.
6.6. Customer's Regulatory Responsibilities. Where Customer uses Platform Infrastructure to build its own products, applications, or services, Customer is solely responsible for: (a) determining the regulatory classification of Customer's products under applicable law, including the EU AI Act and any other applicable requirements; (b) obtaining all necessary regulatory clearances, certifications, or registrations for Customer's products; (c) implementing validation, human oversight, quality management systems, and technical documentation as required by applicable laws; (d) reporting issues to applicable regulatory authorities; and (e) maintaining required records and audit trails. To the extent Platform Infrastructure qualifies as a general-purpose AI (GPAI) model under the EU AI Act, Corti will comply with applicable GPAI provider obligations, and customers using Platform Infrastructure to build their own AI systems are independently responsible for their own AI Act provider or deployer obligations. Corti will provide model documentation and technical information to support Customer's compliance.
7. INDEMNIFICATION
7.1. Indemnification by Corti.
a. Third Party IP Claim. Corti will indemnify, defend, and hold Customer harmless from and against any losses, liabilities, damages, fees, costs, and expenses (including reasonable attorneys' fees) ("Losses") it may incur in connection with a third-party claim to the extent arising out of any infringement of a third party's patent, copyright, trademark or trade secret by Corti or the Platform. If a third-party claim of infringement is threatened or occurs, Corti may seek to mitigate damages by modifying the Platform to be non-infringing, obtaining a license for Customer, or (if neither is commercially feasible) terminating this Agreement and refunding unused, prepaid fees; and
b. Indemnification Exclusions. Corti's obligations do not apply to any claim arising out of (a) the misuse or modification of the Platform by Customer or an Authorized User; (b) combination of the Platform with software, data, or technology not provided by Corti; (c) Customer settling or making admissions about a claim without Corti's prior consent; (d) Customer Data or Corti's conformance with Customer's specific requirements or instructions; (e) use of the Platform after Corti has notified Customer to discontinue such use; or (f) any open-source components or third-party technology integrated into the Platform under their own license terms. The foregoing shall be Customer's exclusive remedy and Corti's entire liability for any third-party claims of infringement.
Notwithstanding the foregoing, Corti's total aggregate liability under the indemnity in clause 7.1(a) shall not exceed the greater of (i) two (2) times the General Cap and (ii) USD 2,000,000 (two million United States Dollars) (the "IP Indemnity Cap"). The IP Indemnity Cap does not apply to liability arising from Corti's fraud, gross negligence, or wilful misconduct.
7.2. Indemnification by Customer. Customer will indemnify, defend, and hold Corti harmless from and against any Losses it may incur in connection with a third party claim to the extent arising out of Customer's use of the Platform, the Documentation, or the Customer Data, other than claims that Corti has indemnified Customer against under clause 7.1. Where Customer uses Platform Infrastructure to build its own products, Customer's indemnification obligation extends to all claims arising from Customer's products, including claims relating to regulatory non-compliance, product defects, or harm caused by Customer's products to third parties.
7.3. Conditions of indemnification. As a condition to an indemnifying party's ("Indemnitor") obligations, a party seeking indemnification ("Indemnitee") will (a) promptly notify the Indemnitor of the claim (but late notice will relieve the Indemnitor only to the extent prejudiced by the delay); (b) grant the Indemnitor sole control of the defense and settlement of the claim; (c) provide the Indemnitor, at the Indemnitor's expense, with all reasonable assistance, information, and authority; and (d) preserve and not waive legal privilege without prior notification of consent by the Indemnitor. The Indemnitor will not settle any claim in a manner that does not fully discharge the claim against an Indemnitee or that imposes any obligation on an Indemnitee without the Indemnitee's prior written consent, which may not be unreasonably withheld or delayed.
8. LIMITATIONS ON LIABILITY
8.1. Nothing in this Agreement will limit either party's liability for Excluded Claims.
8.2. Subject to clause 8.1:
a. to the fullest extent permitted by law, neither party will have any liability for (a) lost profits or revenue; (b) loss of goodwill or business reputation; (c) loss or corruption of data; (d) indirect, incidental, special, punitive, or consequential damages; or (e) loss arising from inaccurate or unexpected results arising from the use of the Corti Services, in each case regardless of whether such party has been advised of the possibility of such losses; for clarity, this clause 8.2(a) does not exclude amounts payable to third parties under a party's indemnification obligations, subject to the applicable cap;
b. General Liability Cap. Subject to clauses 8.2(c) and 8.2(d), in no event will the aggregate liability of each party together with all of its Affiliates arising out of or related to the Agreement exceed the total amount paid or payable by Customer and its Affiliates for the Corti Services giving rise to the liability in the twelve (12) months preceding the first incident out of which the liability arose (the "General Cap");
c. Enhanced Cap for Data Breaches. Notwithstanding clause 8.2(b), Corti's aggregate liability for claims relating to Customer Data (including any "personal data breach" or "security incident" as defined in the DPA) resulting from Corti's breach of (i) its confidentiality obligations in clause 4, (ii) its data protection and security obligations under this Agreement or the DPA, or (iii) its material failure to implement and maintain the security measures required of it under Article 32 GDPR, shall be limited to the greater of (X) two (2.0) times the General Cap amount and (Y) USD 500,000 (five hundred thousand United States Dollars), provided that in all cases such liability shall not exceed USD 2,000,000 (two million United States Dollars), or such higher amount as the parties may expressly agree in the applicable Order Form (the "Enhanced Cap"). This Enhanced Cap does not apply to breaches caused by Corti's gross negligence or wilful misconduct, which remain subject to the Excluded Claims in clause 8.1; and
d. Single Recovery. For any single incident or series of related incidents, Customer may recover under only one of the following caps: the General Cap (clause 8.2(b)), the Enhanced Cap for Data Breaches (clause 8.2(c)), or the IP Indemnity Cap (as defined in clause 7.1), as applicable. The maximum aggregate liability across all claims arising from the same incident, regardless of theory, shall not exceed the highest applicable cap for the type of claim asserted.
8.3. Notwithstanding anything in this clause 8 to the contrary and so far as permitted by law, Corti's liability relating to Beta Services or any Corti Services provided free of charge, including during a free trial or pilot period, will be limited to five thousand United States Dollars (USD $5,000).
9. SUSPENSION OF PLATFORM SERVICES
9.1. Suspension. Corti may suspend Customer's access to the Platform (a) upon seventy-two (72) hours' prior written notice if Corti reasonably believes that Customer (or one of its Authorized Users) has materially violated clauses 2.5 or 2.6, provided that Corti will describe the suspected violation in reasonable detail and provide Customer an opportunity to cure or dispute prior to suspension; or (b) immediately without prior notice only if Corti determines, in its reasonable discretion, that (i) continued access poses an imminent security threat, (ii) Customer's use violates applicable law in a manner that exposes Corti to criminal or regulatory liability, or (iii) Customer has failed to pay undisputed amounts more than thirty (30) days past due. Corti will not suspend access for disputed payment amounts that are the subject of a good-faith billing dispute raised in writing within thirty (30) days of the applicable invoice. Any suspension shall not affect Customer's payment obligations.
9.2. Restoration. Corti will notify Customer of any suspension and the reason as soon as commercially practicable, and will restore service as soon as commercially practicable once the underlying issue is resolved.
10. CONTRACT TERM AND TERMINATION
10.1. Contract Term. The Agreement will become effective on the Effective Date and will continue in full force and effect until terminated by either party pursuant to this clause 10 (the "Contract Term").
10.2. Term of Order Forms. Each Order Form will specify the effective duration of the Corti Services purchased under that Order Form. Unless otherwise stated, Order Forms are non-cancellable for convenience during their term and will automatically expire at the end of the stated period unless renewed in writing.
10.3. PAYG Wallet Services. Corti may suspend or terminate access for inactive PAYG Wallet accounts with zero balance upon thirty (30) days' prior written notice (email sufficient) if Customer has not used the Platform for six (6) months and fails to maintain a valid payment method on file. Accounts with remaining credit balances or active Monthly Subscriptions will not be subject to automatic termination for inactivity.
10.4. Termination for convenience. Except as otherwise provided in an applicable Order Form or partner agreement, either Party may terminate this Agreement at any time by 30 days' written notice to the other Party; provided that such termination for convenience will be effective only as to future renewals and shall not terminate or relieve either Party of its obligations under any then-current, non-cancellable Order Form, Monthly Subscription period, or take-or-pay commitment. Termination for convenience by Customer shall not entitle Customer to any refund of prepaid fees.
10.5. Termination for Cause. Either Party may terminate the Agreement immediately for cause if the other Party materially breaches the Agreement and does not cure such breach within 30 days from receipt of written notice or, if the breach is not curable, without further notice. Corti may terminate the Agreement immediately upon written notice if Customer (a) becomes insolvent, makes an assignment for the benefit of creditors, or has a receiver appointed for all or substantially all of its assets; (b) uses the Platform for any unlawful purpose or in an unlawful manner; or (c) breaches the provisions on Corti IP Rights or otherwise infringes Corti IP Rights.
10.6. Effect of Termination. Termination or expiration will not affect any already-accrued obligations or liabilities (including Customer's obligation to pay all fees owed). Upon expiration or termination in its entirety, Customer's right to access the Platform will immediately end, and Customer shall return all material related hereto to Corti, including the Documentation, and delete all stored elements of the Platform Services from Customer's Systems. Upon termination of a specific Order Form (while the Agreement remains in effect), Customer's access under that Order Form will end, but Customer may continue to access the Platform under any other active Order Forms.
10.7. Data Deletion. Corti will delete Customer Data upon termination of Customer's right to access the Platform, or termination of a specific Order Form where such Customer Data relates only to that Order Form; provided that, should Customer so request in writing prior to the scheduled deletion date, Corti shall retain Customer Data for an additional period of no more than sixty (60) days prior to destruction.
10.8. Survival. The provisions of clauses 2.6 (Platform Restrictions), 2.8 (Enhancements), 2.11 (Customer Data), 2.5.5 (Customer Compliance with Laws), 3 (Fees and Payment), 4 (Confidentiality), 5 (Intellectual Property Rights), 6 (Warranties and Disclaimers), 7 (Indemnification), 8 (Limitations on Liability), 10.6 (Effect of Termination) and 11 (General) will survive the expiration or termination of the Agreement.
10.9. Remedies. Termination of the Agreement is without prejudice to any other remedies available to the terminating Party.
11. GENERAL
11.1. Notice. Notices will be considered properly received (a) when delivered, if delivered in person or via e-mail; (b) one Business Day after dispatch, if sent by an overnight delivery service that provides signed acknowledgment of receipt; or (c) three Business Days after deposit in the mail, if sent by certified or registered first class mail, postage prepaid, return receipt requested. Notices will be addressed as set forth on the Order Form, or as otherwise notified by a Customer.
11.2. Governing Law and Jurisdiction.
a. The governing law and exclusive venue applicable to any dispute arising in connection with the Agreement will be determined as follows:

a. The parties hereby irrevocably consent to the personal jurisdiction and venue of the courts in the venues shown above. Unless prohibited by governing law or venue, each party irrevocably agrees to waive a jury trial. Prior to initiating arbitration or litigation, the parties will attempt in good faith to resolve any dispute informally for at least 45 days after written notice of the dispute. Each party waives the right to participate in a class action to the fullest extent permitted by law. In all cases, the application of law will be without regard to conflict of law rules or principles, and the United Nations Convention on Contracts for the International Sale of Goods will not apply.
11.3. Insurance. Corti will maintain commercially appropriate insurance coverage given the nature of the Corti Services and Corti's obligations under the Agreement, including commercially appropriate cyber liability insurance coverage. Upon request, Corti will provide the Customer with certificates of insurance evidencing such coverage.
11.4. Relationship of the Parties. Nothing in this Agreement creates any agency, partnership or joint venture, or any other fiduciary relationship between the parties.
11.5. Force Majeure. Except for payment obligations, neither Party will be liable for any delays or failures to perform to the extent due to a cause beyond such Party's reasonable control, including natural disasters or acts of God, strikes or work stoppages, acts of war or terrorism, failure of internet or communications networks, failures of third-party cloud infrastructure providers, health emergencies, quarantines, or compliance with the laws, acts, orders, rules or regulations of any government body.
11.6. Assignment. Neither this Agreement nor any rights or responsibilities hereunder may be assigned, delegated, or otherwise transferred by Customer without the prior written consent of Corti. Corti may transfer or assign this Agreement to an Affiliate or to the successor entity in the event of a merger, stock sale, or sale of all or part of Corti's business.
11.7. Severability. Should any provision of the Agreement be held to be void, invalid or inoperative, the remaining provisions will not be affected and will continue in effect, and the invalid provision will be deemed modified or severed to the least degree necessary to remedy such invalidity.
11.8. Priority of Terms. In the event of any conflict or inconsistency between the documents comprising the Agreement, the following order of precedence shall apply (from highest to lowest priority):
a. any applicable Order Form or Statement of Work (but only to the extent it expressly modifies or supplements these Terms and is signed by both parties);
b. any applicable Addendum to these Terms;
c. the DPA, if applicable;
d. the general provisions of these Terms; and
e. the SLA and the Documentation.
11.9. Customer-specific terms in an Order Form shall not override or modify (a) Corti's intellectual property rights as set forth in clause 5, (b) the limitation of liability provisions in clause 8, or (c) the indemnification provisions in clause 7, unless such modification is expressly stated in the Order Form.
11.10. Amendments. Corti may update the Terms, DPA, and Documentation from time to time to reflect changes in applicable law, regulatory requirements, or service functionality; provided that any change that would newly authorize the use of Customer Data for model training or expand the scope of any prior opt-in will have no effect unless Customer separately agrees in writing via the Model Training and Improvement Addendum. Corti may make non-material updates at any time. With regard to material updates, Corti will notify Customer at least thirty (30) days prior to their effective date, and continued use of the Corti Services after the effective date constitutes acceptance. No continued use shall be deemed consent to model training and no click-through update shall authorize model training absent execution of the Model Training and Improvement Addendum.
11.11. Waivers. No waiver of a breach of any provision of this Agreement will constitute a waiver of any subsequent breach, and no waiver will be effective unless made in writing and signed by a duly authorized representative of the waiving Party.
11.12. Entire Agreement. The Agreement constitutes the entire agreement between the Parties relating to the subject matter hereof and supersedes any prior agreements, oral or written. Customer acknowledges that, in entering this Agreement, it has not relied on any statement, warranty, representation or other promise not contained in this Agreement.
2. Preamble
2.1. These Contractual Clauses (the Clauses) set out the rights and obligations of the data controller and the data processor, when processing personal data on behalf of the data controller.
2.2. The Clauses have been designed to ensure the parties’ compliance with Article 28(3) of Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
2.3. In the context of the provision of Corti’s services, as described in the Terms and Conditions, the data processor will process personal data on behalf of the data controller in accordance with the Clauses.
2.4. The Clauses shall take priority over any similar provisions contained in other agreements between the parties.
2.5. Four appendices are attached to the Clauses and form an integral part of the Clauses.
2.6. Appendix A contains details about the processing of personal data, including the purpose and nature of the processing, type of personal data, categories of data subject and duration of the processing.
2.7. Appendix B contains the data controller’s conditions for the data processor’s use of sub-processors and a list of sub-processors authorised by the data controller.
2.8. Appendix C contains the data controller’s instructions with regards to the processing of personal data, the minimum security measures to be implemented by the data processor and how audits of the data processor and any sub-processors are to be performed.
2.9. Appendix D contains provisions regarding the Standard Contractual Classes (SCC).
2.10. Appendix E contains provisions for other activities which are not covered by the Clauses.
2.11. The Clauses along with appendices shall be retained in writing, including electronically, by both parties.
2.12. The Clauses shall not exempt the data processor from obligations to which the data processor is subject pursuant to the General Data Protection Regulation (the GDPR) or other legislation.
3. The rights and obligations of the data controller
3.1. The data controller is responsible for ensuring that the processing of personal data takes place in compliance with the GDPR (see Article 24 GDPR), the applicable EU or Member State data protection provisions and the Clauses.
3.2. The data controller has the right and obligation to make decisions about the purposes and means of the processing of personal data.
3.3. The data controller shall be responsible, among other, for ensuring that the processing of personal data, which the data processor is instructed to perform, has a legal basis.
4. The data processor acts according to instructions
4.1. The data processor shall process personal data only on documented instructions from the data controller, unless required to do so by Union or Member State law to which the processor is subject. Such instructions shall be specified in appendices A and C. Subsequent instructions can also be given by the data controller throughout the duration of the processing of personal data, but such instructions shall always be documented and kept in writing, including electronically, in connection with the Clauses.
4.2. The data processor shall immediately inform the data controller if instructions given by the data controller, in the opinion of the data processor, contravene the GDPR or the applicable EU or Member State data protection provisions.
5. Confidentiality
5.1. The data processor shall only grant access to the personal data being processed on behalf of the data controller to persons under the data processor’s authority who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and only on a need to know basis. The list of persons to whom access has been granted shall be kept under periodic review. On the basis of this review, such access to personal data can be withdrawn, if access is no longer necessary, and personal data shall consequently not be accessible anymore to those persons.
5.2. The data processor shall at the request of the data controller demonstrate that the concerned persons under the data processor’s authority are subject to the abovementioned confidentiality.
6. Security of processing
6.1. Article 32 GDPR stipulates that, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the data controller and data processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
The data controller shall evaluate the risks to the rights and freedoms of natural persons inherent in the processing and implement measures to mitigate those risks. Depending on their relevance, the measures may include the following:
6.1.1. Pseudonymisation and encryption of personal data;
6.1.2. the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services;
6.1.3. the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
6.1.4. a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
6.2. According to Article 32 GDPR, the data processor shall also – independently from the data controller – evaluate the risks to the rights and freedoms of natural persons inherent in the processing and implement measures to mitigate those risks. To this effect, the data controller shall provide the data processor with all information necessary to identify and evaluate such risks.
6.3. Furthermore, the data processor shall assist the data controller in ensuring compliance with the data controller’s obligations pursuant to Articles 32 GDPR, by inter alia providing the data controller with information concerning the technical and organisational measures already implemented by the data processor pursuant to Article 32 GDPR along with all other information necessary for the data controller to comply with the data controller’s obligation under Article 32 GDPR.
If subsequently – in the assessment of the data controller – mitigation of the identified risks require further measures to be implemented by the data processor, than those already implemented by the data processor pursuant to Article 32 GDPR, the data controller shall specify these additional measures to be implemented in Appendix C.
7. Use of sub-processors
7.1. The data processor shall meet the requirements specified in Article 28(2) and (4) GDPR in order to engage another processor (a sub-processor).
7.2. The data processor shall therefore not engage another processor (sub-processor) for the fulfilment of the Clauses without the prior general written authorisation of the data controller.
7.3. The data processor has the data controller’s general authorisation for the engagement of sub-processors. The data processor shall inform in writing the data controller of any intended changes concerning the addition or replacement of sub-processors at least 1 month in advance, thereby giving the data controller the opportunity to object to such changes prior to the engagement of the concerned sub-processor(s). Longer time periods of prior notice for specific sub-processing services can be provided in Appendix B. The list of sub-processors already authorised by the data controller can be found in Appendix B.
7.4. Where the data processor engages a sub-processor for carrying out specific processing activities on behalf of the data controller, the same data protection obligations as set out in the Clauses shall be imposed on that sub-processor by way of a contract or other legal act under EU or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the Clauses and the GDPR.
The data processor shall therefore be responsible for requiring that the sub-processor at least complies with the obligations to which the data processor is subject pursuant to the Clauses and the GDPR.
7.5. A copy of such a sub-processor agreement and subsequent amendments shall – at the data controller’s request – be submitted to the data controller, thereby giving the data controller the opportunity to ensure that the same data protection obligations as set out in the Clauses are imposed on the sub-processor. Clauses on business related issues that do not affect the legal data protection content of the sub-processor agreement, shall not require submission to the data controller.
7.6. The processor shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the processor has factually disappeared, ceased to exist in law or has become insolvent – the controller shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.
7.7. If the sub-processor does not fulfil their data protection obligations, the data processor shall remain fully liable to the data controller as regards the fulfilment of the obligations of the sub-processor. This does not affect the rights of the data subjects under the GDPR – in particular those foreseen in Articles 79 and 82 GDPR – against the data controller and the data processor, including the sub-processor.
8. Transfer of data to third countries or international organisations
8.1. Any transfer of personal data to third countries or international organisations by the data processor shall only occur on the basis of documented instructions from the data controller and shall always take place in compliance with Chapter V GDPR.
8.2. In case transfers to third countries or international organisations, which the data processor has not been instructed to perform by the data controller, is required under EU or Member State law to which the data processor is subject, the data processor shall inform the data controller of that legal requirement prior to processing unless that law prohibits such information on important grounds of public interest.
8.3. Without documented instructions from the data controller, the data processor therefore cannot within the framework of the Clauses:
8.3.1. transfer personal data to a data controller or a data processor in a third country or in an international organization
8.3.2. transfer the processing of personal data to a sub-processor in a third country
8.3.3. have the personal data processed in by the data processor in a third country
8.4. The data controller’s instructions regarding the transfer of personal data to a third country including, if applicable, the transfer tool under Chapter V GDPR on which they are based, shall be set out in Appendix C.6.
8.5. The Clauses shall not be confused with standard data protection clauses within the meaning of Article 46(2)(c) and (d) GDPR, and the Clauses cannot be relied upon by the parties as a transfer tool under Chapter V GDPR.
9. Assistance to the data controller
9.1. Taking into account the nature of the processing, the data processor shall assist the data controller by appropriate technical and organisational measures, insofar as this is possible, in the fulfilment of the data controller’s obligations to respond to requests for exercising the data subject’s rights laid down in Chapter III GDPR.
This entails that the data processor shall, insofar as this is possible, assist the data controller in the data controller’s compliance with:
9.1.1. the right to be informed when collecting personal data from the data subject
9.1.2. the right to be informed when personal data have not been obtained from the data subject
9.1.3. the right of access by the data subject
9.1.4. the right to rectification
9.1.5. the right to erasure (‘the right to be forgotten’)
9.1.6. the right to restriction of processing
9.1.7. notification obligation regarding rectification or erasure of personal data or restriction of processing
9.1.8. the right to data portability
9.1.9. the right to object
9.1.10. the right not to be subject to a decision based solely on automated processing, including profiling
9.2. In addition to the data processor’s obligation to assist the data controller pursuant to Clause 6.3., the data processor shall furthermore, taking into account the nature of the processing and the information available to the data processor, assist the data controller in ensuring compliance with:
In accordance with Clause 9(2)(a), the data processor shall assist the data controller in notifying the personal data breach to the competent supervisory authority, meaning that the data processor is required to assist in obtaining the information listed below which, pursuant to Article 33(3)GDPR, shall be stated in the data controller’s notification to the competent supervisory authority:
9.2.1. The data controller’s obligation to without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons;
9.2.2. the data controller’s obligation to without undue delay communicate the personal data breach to the data subject, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons;
9.2.3. the data controller’s obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a data protection impact assessment);
9.2.4. the data controller’s obligation to consult the competent supervisory authority, prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the data controller to mitigate the risk.
9.3. The parties shall define in Appendix C the appropriate technical and organisational measures by which the data processor is required to assist the data controller as well as the scope and the extent of the assistance required. This applies to the obligations foreseen in Clause 9.1. and 9.2.
Notification of personal data breach
10.1. In case of any personal data breach, the data processor shall, without undue delay after having become aware of it, notify the data controller of the personal data breach.
10.2. The data processor’s notification to the data controller shall, if possible, take place within 48 hours after the data processor has become aware of the personal data breach to enable the data controller to comply with the data controller’s obligation to notify the personal data breach to the competent supervisory authority, cf. Article 33 GDPR.
10.3. In accordance with Clause 9(2)(a), the data processor shall assist the data controller in notifying the personal data breach to the competent supervisory authority, meaning that the data processor is required to assist in obtaining the information listed below which, pursuant to Article 33(3)GDPR, shall be stated in the data controller’s notification to the competent supervisory authority:
10.3.1. The nature of the personal data including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
10.3.2. the likely consequences of the personal data breach;
10.3.3. the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
10.4. The parties shall define in Appendix C all the elements to be provided by the data processor when assisting the data controller in the notification of a personal data breach to the competent supervisory authority.
11. Erasure and return of data
11.1. On termination of the provision of personal data processing services, the data processor shall be under obligation to delete all personal data processed on behalf of the data controller and certify to the data controller that it has done so unless Union or Member State law requires storage of the personal data.
12. Audit and inspection
12.1. The data processor shall make available to the data controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 and the Clauses and allow for and contribute to audits, including inspections, conducted by the data controller or another auditor mandated by the data controller.
12.2. Procedures applicable to the data controller’s audits, including inspections, of the data processor and sub-processors are specified in appendices C.7. and C.8.
12.3. The data processor shall be required to provide the supervisory authorities, which pursuant to applicable legislation have access to the data controller’s and data processor’s facilities, or representatives acting on behalf of such supervisory authorities, with access to the data processor’s physical facilities on presentation of appropriate identification.
13. The parties’ agreement on other terms
13.1. The parties may agree to other clauses concerning the provision of the personal data processing service specifying e.g. liability, as long as they do not contradict directly or indirectly the Clauses or prejudice the fundamental rights or freedoms of the data subject and the protection afforded by the GDPR.
14. Commencement and termination
14.1. Both parties shall be entitled to require the Clauses renegotiated if changes to the law or inexpediency of the Clauses should give rise to such renegotiation.
14.2. The Clauses shall apply for the duration of the provision of personal data processing services. For the duration of the provision of personal data processing services, the Clauses cannot be terminated unless other Clauses governing the provision of personal data processing services have been agreed between the parties.
14.3. If the provision of personal data processing services is terminated, and the personal data is deleted, the Clauses may be terminated by written notice by either party.
15. Data controller and data processor contacts/contact points
15.1. The parties may contact each other using the following contacts/contact points:
15.2. The parties shall be under obligation continuously to inform each other of changes to contacts/contact points.
On behalf of the data controller:
Name: Contact person’s name that accepts the Terms and Conditions.
Position: Contact person’s position that accepts the Terms and Conditions.
E-mail: Contact person’s contact details that accepts the Terms and Conditions.
On behalf of the data processor:
Name: Sonia Moula
Position: Privacy Manager & Legal Associate
E-mail: snm@corti.ai
Appendix A: Information about the processing
A.1. The purpose of the data processor’s processing of personal data on behalf of the data controller is:
Providing the services detailed in the Terms and Conditions.
A.2. The data processor’s processing of personal data on behalf of the data controller shall mainly pertain to (the nature of the processing):
Access, transmission, modification, deletion, pseudonymization, anonymization of personal data in connection with the provision of the above-mentioned services.
These services may be delivered through various interfaces, including both API and Assistant. The processing involves the use of machine learning models for transcription, medical code prediction, and summarization.
The services include the use of a machine learning model employed to transcribe audio data, converting audio input into textual output. This model is specifically fine-tuned using audio recordings from consultations, enhancing its accuracy for this particular domain. Importantly, no patient or consultation-specific metadata is utilized during either the inference process (audio-to-text conversion) or the fine-tuning phase.
For the prediction of medical codes, another machine learning model is utilized. This model processes both raw audio and the textual output generated by the transcription model. Its training involves periodic fine-tuning, incorporating user corrections to continually improve its performance and accuracy in code prediction.
The task of summarization is handled by a proprietary large language model (LLM). This model takes the text transcribed by the first model and processes it according to a specified template provided in the input prompt. Similar to the previous models, this summarization model also benefits from periodic fine-tuning, using corrections from users to refine its output and better meet user expectations.
As part of the provision of the services, the Processor may access and process customer data, including but not limited to audio recordings and associated metadata, for the purpose of investigating operational incidents, improving support processes, and ensuring service quality.
The described processing applies to both API-based integrations and Assistant-led use, depending on the customer’s chosen implementation.
A.3. The processing includes the following types of personal data about data subjects:
The data controller determines the types of data processed by the services used, which may include:
Ordinary and confidential personal data:
- Name
- Address
- Phone number
- Date of birth
- ID number
- Recordings
- Transcripts
- Online identifiers
- Login details
- Employee ID
- Job position
Special categories of personal data:
- Health information.
- Possible: political, religious or philosophical belief.
- Possible: Racial and ethnic origin.
- Possible: Sex life or sexual orientation.
A.4. Processing includes the following categories of data subjects:
Personnel:
Individuals employed or engaged by the Data Controller that have access to the Offering, including:
- Physicians, nurses, paramedics, and other clinical staff using the Offering;
- Administrative staff involved in coordinating or documenting patient interactions;
- IT personnel managing the integration or technical operation of the Offering;
- Support personnel submitting or mentioned in support requests related to the Offering;
- Decision-makers and authorized contacts of the Data Controller with user access to the system.
Patients and Related Individuals:
Natural persons whose personal data may be captured or referenced through the use of the Offering, including:
- Patients, whose health-related information is recorded, dictated, or processed via the Offering;
- Third parties mentioned during clinical interactions (e.g., relatives, caregivers, or emergency contacts), to the extent such individuals are referenced in dictated notes, voice recordings, transcriptions, or associated metadata.
A.5. The data processor’s processing of personal data on behalf of the data controller may be performed when the Clauses commence. Processing has the following duration:
The processing will continue until the Agreement is no longer valid (e.g., because of termination, expiration etc.). All personal data will be deleted 30 days after the Main Agreement’s termination.
Appendix B: Authorised sub-processors
B.1. Approved sub-processors
On commencement of the Clauses, the data controller authorises the engagement of the following sub-processors as listed in our current list of authorised sub-processors.
The data controller shall on the commencement of the Clauses authorise the use of the abovementioned sub-processors for the processing described for that party. The data processor shall not be entitled – without the data controller’s general written authorisation – to engage a sub-processor for a ‘different’ processing than the one which has been agreed upon or have another sub-processor perform the described processing.
B.2. Prior notice for the authorisation of sub-processors
The data processor has the data controller’s general authorisation for the engagement of sub-processors. The data processor shall inform in writing the data controller of anysnipp intended changes concerning the addition or replacement of sub-processors at least 1 month in advance, thereby giving the data controller the opportunity to object to such changes prior to the engagement of the concerned sub-processor(s) pursuant to Clause 7.3.
Appendix C: Instruction pertaining to the use of personal data
C.1. The subject of/instruction for the processing
The data processor’s processing of personal data on behalf of the data controller shall be carried out by the data processor performing the following:
The data processor is obliged to process the personal data in accordance with the data controller's instructions under the Main Agreement (including the Exhibits) in a clear format to fulfill its obligations under these agreements, including the Exhibits, for the purposes stated above in A.1.
C.2. Security of processing
The data processor implements and maintains the technical and organisational security measures described in this Appendix. The data processor may update or modify such technical and organisational measures from time to time, provided that such updates and modifications do not materially decrease the overall security of the services.
- Policies. The data processor documents and maintains information security policies approved by its senior management. Policies are readily accessible to all employees and contractors.
- People Security. An execution of a confidentiality agreement, via confidentiality clauses or the execution of a non-disclosure agreement, is required from all employees and contractors. Performance of reference checks and/or a background check that is administered before hiring in accordance with applicable local laws. As appropriate, the data processor establishes mechanisms or processes to communicate and hold individuals accountable in relation to work and security, such as performance evaluation.
- Training and Awareness. The data processor provides appropriate security and privacy training and awareness to all its personnel and contractors, both upon onboarding and at least annually thereafter. Policies and procedures are rolled out to employees and contractors for approval as pertinent to their role. All software engineers are trained in secure coding techniques.
- Storage. The data processor stores personal data with an approved cloud hosting provider as listed in the ‘’Approved sub-processors” list mentioned in Appendix B. The cloud provider holds and maintains a robust security program and security certifications (incl. SOC 2 Type 2 and ISO 27001).
- System Access Control and Access Management. The data processor maintains access control policies and procedures that are designed to prevent unauthorized persons and/or systems from gaining access to systems used to process personal data. The data processor requires the use of unique IDs, together with passwords and/or two-factor authentication. Documented permission processes are employed, and access is logged. Access rights are granted or modified on a need-to-know basis. Access lists are under periodic review. In addition to the multifactor authentication, access to the cloud systems is only possible through the data processor’s network or a dedicated VPN. Access to production is granted only on a case-by-case basis and is time-limited. The offboarding process takes effect by revoking access to systems.
- Risk Management. The data processor performs appropriate risk assessments as part of an ongoing risk governance program with the following steps (i) recognizing risks pertaining to multiple areas including security and privacy, (ii) assessing the impact of risk, and (iii) where risk reduction or mitigation strategies are identified, effectively managing the risk and implementing identified risk mitigation controls.
- Third-party vendor management. The data processor has implemented a vendor management program that applies the appropriate technical and organizational security controls that are proportional to the type of service the third-party vendor is providing and any associated security-related risks. Prospective third-party vendors are vetted through a process that ensures they comply with, and will continue to comply with, the data processors’ confidentiality, security, and privacy requirements for the duration of their relationship.
- Network security. The data processor restricts unwanted network traffic through the use of firewalls, security groups and/or IP allowlisting.
- Encryption. The data processor ensures all personal data is encrypted at rest (with security no less than 256-bit Advanced Encryption Standard (AES) encryption or similar) and during transit (incl. Secure FTP or HTTPS, using transport layer security (TLS) 1.2 or higher).
- Monitoring and alerting. The data processor maintains a monitoring and alerting system where actions, events, and capacity are logged, and alerts are set to known vulnerabilities.
- Incident Response. The data processor maintains an incident response procedure to ensure the ability to identify and respond to incidents in a timely manner. Personnel on call are trained to react promptly to known incidents. All incidents are logged. Causes, impact, and immediate and long-term solutions related to an incident are part of a post-mortem evaluation.
- Secure development. The data processor employs a secure development lifecycle process, which includes change management, requirements gathering, code review, and testing.
- Business continuity management. The data processor implements and maintains business continuity processes, which include the development of disaster recovery and business continuity plans that outline measures to prevent and address potential disasters or failures.
- Customer data backup. The data processor performs regular backups of customer data, which is hosted on the cloud provider’s data center infrastructure.
- Vulnerability Management. The data processor maintains controls and policies to mitigate the risk of security vulnerabilities. The data processor engages independent, recognized third parties to conduct application-level penetration tests at least annually. Security threats and vulnerabilities that are detected are prioritized, triaged, and remediated.
- Workstation security. The data processor employs multiple security controls in workstations, including anti-malware scanning, screen saver lock, auto-update configurations, and monitoring.
- Data handling. The data processor maintains formal procedures for handling data, including the handling of personal data.
- Physical security. The data processor’s physical premises are secured with appropriate anti-theft monitoring and alarms. Offices have designated secure rooms for IT equipment and internet setup. For the cloud environment, the data processor relies on the hosting provider’s extensive physical security controls.
C.3. Assistance to the data controller
The data processor shall insofar as this is possible – within the scope and the extent of the assistance specified below – assist the data controller in accordance with Clause 9.1. and 9.2 by implementing the following technical and organisational measures:
Assistance with Data Subject Requests: The data processor shall implement and maintain appropriate technical and organisational measures to enable the Data Controller to respond to requests from data subjects exercising their rights under the GDPR, including rights of access, rectification, erasure, restriction of processing, data portability, objection, and rights related to automated decision-making. The data processor shall, upon written request from the Data Controller, provide relevant information or take necessary actions within reasonable timeframes to support the Controller’s response to such requests.
Assistance with Security of Processing: The data processor maintains and applies technical and organisational measures described in Section C.2 to ensure a level of security appropriate to the risk, including encryption, access controls, and regular risk assessments. In the event of a personal data breach, the Data Processor shall notify the Data Controller without undue delay and provide reasonable cooperation and assistance with breach assessment, mitigation, and notification obligations as outlined in Article 33 and 34 of the GDPR.
Assistance with Data Protection Impact Assessments (DPIAs): Upon request, the Data Processor shall provide the Data Controller with available information necessary to support the performance of a DPIA or prior consultation with the relevant supervisory authority as required under Articles 35 and 36 of the GDPR. This includes documentation of the Data Processor’s technical and organisational security measures, risk assessments, and any relevant audits or third-party certifications (e.g., SOC 2 Type 2, ISO 27001).
Support for Compliance Monitoring: The Data Processor shall make available to the Data Controller information necessary to demonstrate compliance with obligations under the DPA and data protection law, including audit logs, Documentation of implemented controls, Information on sub-processors and transfer safeguards. The Data Processor shall permit and contribute to audits and inspections by the Data Controller or an auditor mandated by the Controller, subject to the conditions agreed in this DPA.
Incident Management: The Data Processor has implemented an incident response plan (as described in Section C.2) to identify, report, and manage security incidents in a timely and structured manner. Post-incident evaluations include sharing relevant findings with the Data Controller where such incidents impact personal data.
C.4. Storage period/erasure procedures
Data Processor’s default retention policy is data storage for the duration of the agreement for the customer's access. The processing will continue until either the Agreement is no longer valid (e.g., because of termination, expiration, etc.) All personal data will be deleted 30 days after the contract's termination. The customer may delete the data by using the delete function, e.g., ensuring data is stored for only the length of a consultation.
Upon termination of the provision of personal data processing services, the data processor shall delete unless the data controller – after the signature of the agreement – has modified the data controller’s original choice. Such modification shall be documented and kept in writing, including electronically, in connection with the Clauses.
C.5. Processing location
Processing of the personal data under the Clauses cannot be performed at other locations than the following without the data controller’s prior written authorisation. The processing locations, as applicable to each authorised sub-processor, are detailed in our current link of authorised sub-processors.
C.6. Instruction on the transfer of personal data to third countries
If the data controller does not in the Clauses or subsequently provide documented instructions pertaining to the transfer of personal data to a third country, the data processor shall not be entitled within the framework of the Clauses to perform such transfer.
Where the Data Processor engages sub-processors to process Personal Data, it shall ensure that such sub-processors are contractually bound to data protection obligations that provide an equivalent level of protection for Personal Data as set out in this Agreement, including, where applicable, the execution of the European Commission’s Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms in accordance with Chapter V of the GDPR. Sub-processors processing Personal Data in third countries do so only on the basis of appropriate safeguards and in full compliance with Data Protection Laws. The Data Processor remains fully liable for the performance of its sub-processors’ obligations in accordance with the terms of this Agreement.
The Data Controller acknowledges that the Data Processor may access and process Personal Data from locations outside the European Economic Area (“EEA”) in order to provide the contracted services, including through sub-processors located in jurisdictions where the Data Processor’s sub-processors maintain operations. The Data Processor shall ensure that all such transfers are conducted in compliance with applicable Data Protection Laws and, where required, with appropriate supplementary measures in place.
Transfer Mechanisms for Data Transfers
The data Processor will not transfer Personal data to any country or recipient not recognized as providing an adequate level of protection for Personal Data (within the meaning of applicable European Data Protection Laws), unless it first takes all such measures as are necessary to ensure the transfer is in compliance with applicable European Data Protection Laws. Such measures may include (without limitation) transferring such data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Data, to a recipient that has achieved binding corporate rules authorization in accordance with European Data Protection Laws, or to a recipient that has executed appropriate standard contractual clauses in each case as adopted or approved in accordance with applicable European Data Protection Laws.
The data Processor confirms that, where it transfers Personal Data to the United States, such transfers are made in reliance on the EU–US Data Privacy Framework (DPF), which has been recognized by the European Commission as providing an adequacy decision pursuant to Article 45 of the GDPR. The Data processor is self-certified and listed as a participating organization under the EU–US DPF, the UK Extension to the EU–US DPF, and the Swiss–US DPF.
C.7. Procedures for the data controller’s audits, including inspections, of the processing of personal data being performed by the data processor
The data processor shall once a year at the data processor's expense obtain an auditor's report from an independent third party concerning the data processor's compliance with the GDPR, the applicable EU or Member State data protection provisions and the Clauses.
The parties have agreed that the following types of Auditor's report may be used in compliance with the Clauses:
At least one of the following: ISO 27001 certificate (including scope and SOA), ISO 27701 certificate, ISAE 3000, ISAE 3402 Type II, or SOC 2. And/or participation in audit questionnaires including relevant documentation, or other relevant and similar reports or certifications.
The auditor's report shall, upon the data controller’s request, be submitted to the data controller for information.
C.8. Procedures for audits, including inspections, of the processing of personal data being performed by sub processors
The data processor shall once a year at the sub-processor’s expense obtain an Auditor’s Report from an independent third party concerning the sub-processor's compliance with the GDPR, the applicable EU or Member State data protection provisions and the Clauses.
The parties have agreed that the following types of Auditor’s Report may be used in compliance with the Clauses:
At least one of the following: ISO27001 Certificate, ISO27701 Certificate, ISAE3000, ISAE3402II or SOC2, And/or participation in audit questionnaires incl. relevant documentation, Or other relevant and similar reports or certifications
The auditor's report shall, upon the data controller’s request, be submitted to the data controller for information.
Appendix D: STANDARD CONTRACTUAL CLAUSES (SCC)
Module Two: Controller to Processor
Module Three: Processor to Sub-Processor
If the Data Processor processes any Customer Data outside the EEA, such processing will be governed by the provisions of the EU Standard Contractual Clauses, pursuant to Clause C.6.
The EU Standard Contractual Clauses (Modules Two and Three) with the following modifications are hereby incorporated here:
- Module Two (Transfer Controller to Processor) clauses shall apply to the processing activities concerning Customer’s Data, where the Customer is the Controller (exporter) and Data Processor is the Processor (importer).
- Module Three (Transfer Processor to Processor) clauses shall apply to the processing activities concerning End Customer Data, where the Customer is the Processor (exporter) and Data Processor is the sub-processor (importer)
- Clause 7 (Docking Clause) - Optional - shall apply
- Clause 9(a) (Use of Sub-processors):
- Module Two - The data importer has the data exporter’s general authorisation for the engagement of sub-processor(s) from an agreed list. The applicable time period shall be 30 (thirty) days.
- Module Three - The data importer has the controller’s general authorisation for the engagement of sub-processor(s) from an agreed list. The applicable time period shall be 30 (thirty) days.
- Clause 11 (Redress): The option in paragraph (a) shall not apply.
- Clause 17 (Governing Law): Option 1 shall apply. The applicable law shall be the law of Denmark.
- Clause 18 (Choice of Forum and Jurisdiction): The courts of Denmark shall be inserted into paragraph (b).
Appendix A: shall be completed as follows:
- List of Parties: as set out in this DPA, with the Customer being the data exporter and Data Processor being the data importer.
- Description of Transfer: as set out in this DPA.
- Competent Supervisory Authority: The Danish Supervisory Authority.
Appendix B: shall be completed as follows:
- The sub-processors as set out in this DPA.
Where the UK GDPR applies, the “International Data Transfer Addendum to the EU Commission Standard Contractual Clauses” issued by the Information Commissioner under s.119A(1) of the Data Protection Act 2018 (“UK Addendum”) applies. The UK Addendum shall be deemed complete with relevant information from this DPA.
Where the Swiss Data Protection Act (“Swiss DPA”) applies, the applicable standard data protection clauses issued, approved or otherwise recognized by the Swiss Federal Data Protection and Information Commissioner (“FDPIC”) (the “Swiss SCCs”). The Swiss SCCs shall be deemed completed with relevant information from this DPA.
Appendix E: The parties’ terms of agreement on other subjects
No additional terms have been agreed between the Parties under this Appendix.