Business Data Processing Agreement

1. DEFINITIONS

"Applicable Data Protection Law" means the GDPR, the Irish Data Protection Acts 1988 to 2018, the ePrivacy Directive 2002/58/EC as implemented in Ireland, the UK GDPR and UK Data Protection Act 2018 (where the Customer is established in the United Kingdom), and any other data protection law that applies to the processing under this DPA.

"Customer Personal Data" means any personal data that OnFire processes on behalf of the Customer in providing the Services, as described in Annex I.

"GDPR" means Regulation (EU) 2016/679.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

"SCCs" means the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914, and, for transfers from the United Kingdom, the UK International Data Transfer Addendum issued by the Information Commissioner.

"Sub-processor" means any third party engaged by OnFire to process Customer Personal Data.

"controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the GDPR.

2. ROLES AND SCOPE

2.1 Customer as controller. For Customer Personal Data, the Customer is the controller and OnFire is the processor. Where the Customer is itself a processor acting for a third-party controller, OnFire is the Customer's sub-processor, and the Customer warrants that its instructions are authorised by that controller.

2.2 OnFire as controller. OnFire acts as an independent controller, and this DPA does not apply, for personal data it processes for its own purposes. These include account registration and authentication, billing and fraud prevention, security monitoring, legal compliance, trust-and-safety moderation, and the improvement of the Platform using aggregated or de-identified data. That processing is described in the OnFire Privacy Policy at https://onfire.so/privacy.

2.3 Ride and delivery data. Where Authorised Users book rides or deliveries, the trip data that OnFire shares with the Customer through Reporting is processed by OnFire as processor for the Customer. Data that OnFire needs to operate the marketplace, pay Providers and meet transport regulations is processed by OnFire as controller.

2.4 Details of processing. Annex I sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

3. CUSTOMER OBLIGATIONS

3.1 The Customer shall ensure that it has a lawful basis for the processing, and has given every notice and obtained every consent that Applicable Data Protection Law requires, before Customer Personal Data is provided to or collected by the Services. This includes, without limitation:

(a) informing participants before a call is recorded or transcribed, and obtaining their consent where the law requires it;

(b) having a lawful basis for importing contacts and for sending marketing email or messages through the Services; and

(c) not submitting special categories of personal data (GDPR Article 9) or data relating to criminal convictions (Article 10) unless the Customer has a lawful basis and has configured the Services appropriately.

3.2 The Customer is responsible for the accuracy and lawfulness of Customer Personal Data and of the means by which it was acquired.

4. ONFIRE OBLIGATIONS

4.1 Instructions. OnFire shall process Customer Personal Data only on the Customer's documented instructions, including with regard to international transfers, unless Union or Member State law requires otherwise. In that case OnFire shall inform the Customer of the legal requirement before processing, unless that law prohibits it on important grounds of public interest. The Agreement, this DPA, and the Customer's use and configuration of the Services are the Customer's complete instructions. OnFire shall promptly inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

4.2 Confidentiality. OnFire shall ensure that every person it authorises to process Customer Personal Data is bound by a duty of confidentiality, whether contractual or statutory.

4.3 Security. OnFire shall implement the technical and organisational measures described in Annex II, as required by GDPR Article 32. OnFire may update these measures, provided that the overall level of protection is not reduced.

4.4 Assistance with data subject requests. Taking into account the nature of the processing, OnFire shall assist the Customer by appropriate technical and organisational measures, so far as possible, in responding to requests from data subjects to exercise their rights. The Services provide self-service export and deletion tools for this purpose. If OnFire receives a request directly from a data subject concerning Customer Personal Data, it shall forward the request to the Customer without undue delay and shall not respond to it except to confirm that it has been forwarded, unless the Customer authorises otherwise.

4.5 Assistance with compliance. Taking into account the nature of the processing and the information available to it, OnFire shall provide reasonable assistance to the Customer with its obligations under GDPR Articles 32 to 36, including data protection impact assessments and prior consultations with supervisory authorities.

4.6 No other use. OnFire shall not sell Customer Personal Data, and shall not use it to train or fine-tune any general-purpose artificial intelligence model made available to other customers.

5. SUB-PROCESSORS

5.1 General authorisation. The Customer gives OnFire general written authorisation to engage Sub-processors. The Sub-processors in use at the date of this DPA are listed in Annex III.

5.2 Changes. OnFire shall give the Customer at least thirty (30) days' notice before adding or replacing a Sub-processor, by updating Annex III at https://onfire.so/legal and by email to the Administrator. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection in good faith, the Customer may terminate the affected Services without penalty and receive a pro-rata refund of prepaid fees for them. Where a change is urgently required to maintain the security or availability of the Services, OnFire may make it with shorter notice and shall explain why.

5.3 Flow-down. OnFire shall impose on each Sub-processor, by written contract, data protection obligations that are no less protective than those in this DPA. OnFire remains fully liable to the Customer for the performance of each Sub-processor's obligations.

6. INTERNATIONAL TRANSFERS

6.1 OnFire's primary hosting for Customer Personal Data is in the European Union. Some Sub-processors process Customer Personal Data outside the EU/EEA, as shown in Annex III.

6.2 OnFire shall not transfer Customer Personal Data to a country outside the EU/EEA unless the transfer complies with Chapter V of the GDPR. The transfer must be covered by an adequacy decision (including the EU-US Data Privacy Framework, where the recipient is certified), by the SCCs, or by another valid transfer mechanism.

6.3 Where the SCCs apply between OnFire and a Sub-processor, OnFire shall enter into Module 3 (processor to processor). Where OnFire Messenger Inc. is the contracting entity, or the Customer is established outside the EU/EEA and exports data to OnFire Messenger Ltd, the parties agree that the SCCs, Module 2 (controller to processor), are incorporated into this DPA by reference, with the options set out in Annex IV.

6.4 OnFire shall carry out and document a transfer impact assessment for each transfer that relies on the SCCs, and shall make a summary available to the Customer on request.

7. PERSONAL DATA BREACH

7.1 OnFire shall notify the Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

7.2 The notification shall describe, so far as the information is then available:

(a) the nature of the breach, including the categories and approximate number of data subjects and records concerned;

(b) the name and contact details of OnFire's contact point;

(c) the likely consequences of the breach; and

(d) the measures taken or proposed to address the breach and to mitigate its possible adverse effects.

Where it is not possible to provide all of this information at once, OnFire may provide it in phases without further undue delay.

7.3 OnFire shall take reasonable steps to contain, investigate and remediate the breach, and shall cooperate with the Customer so that it can meet its own notification obligations under GDPR Articles 33 and 34.

7.4 OnFire's notification of, or response to, a Personal Data Breach is not an acknowledgement of fault or liability.

8. AUDITS

8.1 On request, OnFire shall make available to the Customer the information reasonably necessary to demonstrate compliance with GDPR Article 28. This includes a completed security questionnaire and any third-party certifications or audit reports that OnFire holds.

8.2 If that information is reasonably insufficient, or a supervisory authority requires it, the Customer may conduct an audit, including an inspection, no more than once in any twelve (12) month period, unless a Personal Data Breach has occurred. The Customer must give at least thirty (30) days' written notice, conduct the audit during business hours without unreasonably disrupting OnFire's operations, and use an auditor bound by confidentiality who is not a competitor of OnFire. Each party bears its own costs, unless the audit reveals a material breach of this DPA by OnFire.

9. RETURN AND DELETION

9.1 During the term, the Customer may export and delete Customer Personal Data using the tools in the Services.

9.2 On termination or expiry of the Agreement, the Customer has thirty (30) days to export Customer Personal Data. OnFire shall then delete it, including copies held by Sub-processors, within a further sixty (60) days. Backups shall be overwritten in the ordinary backup rotation, which keeps backups for no longer than twelve (12) months, and shall remain protected by this DPA until they are.

9.3 OnFire may keep Customer Personal Data only where Union or Member State law requires it to be stored, and only for as long as that law requires. While it is kept, this DPA continues to apply to it.

10. LIABILITY

Each party's liability under or in connection with this DPA is subject to the limitations and exclusions in Clause 9 of the Agreement, including the Data Protection Cap. Nothing in this DPA limits either party's liability to data subjects or supervisory authorities under GDPR Article 82 or 83.

11. GENERAL

11.1 Precedence. If this DPA conflicts with the Agreement, this DPA prevails in relation to the processing of Customer Personal Data. If this DPA conflicts with the SCCs, the SCCs prevail.

11.2 Term. This DPA continues for as long as OnFire processes Customer Personal Data, even after the Agreement ends.

11.3 Changes in law. OnFire may amend this DPA where a change in Applicable Data Protection Law, or a decision of a court or supervisory authority, requires it. OnFire shall give notice of such changes in accordance with Clause 11 of the Agreement.

11.4 Governing law. This DPA is governed by the laws of Ireland, and the courts of Ireland have exclusive jurisdiction, except where the SCCs require otherwise.

ANNEX I - DETAILS OF PROCESSING

Parties.

• Controller (data exporter): the Customer, as identified in its Business Account. Contact: the Administrator.
• Processor (data importer): OnFire Messenger Ltd, 77 Camden Street Lower, Dublin, D02 XE80, Ireland, for Customers established in the EU, the EEA or the United Kingdom; or OnFire Messenger Inc., 254 Chapman Rd, Ste 209, Newark, DE 19702, United States, for all other Customers. Contact: [email protected].

Subject matter and duration. Provision of the Services under the Agreement, for the term of the Agreement and the deletion period in Clause 9.

Nature and purpose. Hosting, storage, transmission, display, search, synchronisation, analysis and deletion of Customer Personal Data, so that the Customer and its Authorised Users can use the Services. This includes AI-assisted features that the Customer chooses to use, such as drafting, summarising, transcription, translation, search and voice agents. Processing for those features is performed only to answer the Customer's request.

Categories of data subjects.

• The Customer's Authorised Users (employees, contractors and agents).
• The Customer's contacts, leads, clients, students, guests and suppliers.
• Recipients and senders of email, messages and calls made through the Services.
• Participants in calls, meetings and lessons hosted by the Customer.
• People who submit forms, bookings or payments to the Customer through the Services.

Types of personal data.

• Identity and contact data: name, email address, phone number, postal address, job title, organisation, profile photo.
• CRM data: notes, tags, deal and activity history, attachments, custom fields.
• Communications content: email (including headers and attachments), chat messages, form responses, documents and notes.
• Call data: call metadata, and, where the Customer enables them, recordings and transcripts.
• Calendar and booking data.
• Files stored in OnFire Drive.
• Invoice and billing data of the Customer's own clients.
• Trip data (pick-up and drop-off locations, times, fares) for Authorised Users who use ride or delivery Services.
• Technical data: IP address, device and log data relating to the above.

Special categories. None are intended. The Customer may only submit them in accordance with Clause 3.1(c).

Frequency. Continuous.

Retention. As configured by the Customer within the Services, subject to Clause 9. Call recordings are kept for thirty (30) days by default unless the Customer chooses a different period.

ANNEX II - TECHNICAL AND ORGANISATIONAL SECURITY MEASURES

OnFire maintains at least the following measures.

Access control and tenant isolation

• Row-level security in the production database, so that each request can read only the rows that belong to the authenticated account or workspace.
• Short-lived signed access tokens with automatic refresh; tokens can be revoked per user.
• Administrative access to servers over a private network (Tailscale) with named accounts.
• Least-privilege database roles for internal services.
• Role-based permissions inside each Business Account, managed by the Administrator.

Encryption

• TLS 1.2 or higher for all data in transit between clients, the Platform and Sub-processors.
• Encrypted local database on the native mobile and desktop apps.

Network and application security

• Web application firewall, DDoS protection and bot management in front of public endpoints.
• Automated secret scanning on every commit, so that credentials cannot be committed to source code.
• Dependency and security reviews of changes to authentication, access control and data access.

Availability and resilience

• Regular automated database backups, stored separately from the primary system.
• Monitoring and alerting for service health.

Operational

• Confidentiality obligations for all personnel and contractors with access to Customer Personal Data.
• An incident response procedure that meets the timelines in Clause 7 of this DPA.
• Data minimisation: location features use country-level data unless a user enables precise location.
• Deletion tools for accounts and content, and default retention limits for call recordings.

ANNEX III - SUB-PROCESSORS

ANNEX IV - SCC OPTIONS

Where the SCCs are incorporated under Clause 6.3:

• Module: Module 2 (controller to processor), or Module 3 (processor to processor) where the Customer is a processor.
• Clause 7 (docking clause): applies.
• Clause 9(a): Option 2 (general written authorisation), with the notice period in Clause 5.2 of this DPA.
• Clause 11(a): the optional independent dispute resolution language does not apply.
• Clause 13: the supervisory authority is the Data Protection Commission (Ireland), unless the Customer's establishment requires otherwise.
• Clauses 17 and 18: the law and courts of Ireland.
• Annexes I and II of the SCCs: completed by Annexes I and II of this DPA.
• UK transfers: the UK International Data Transfer Addendum applies, with Table 4 set so that neither party may end it.

OnFire Messenger Ltd.

Registered in Ireland with company number 796932

Registered Office: 77 Camden Street Lower, Dublin, D02 XE80, Ireland

Email: [email protected]