Valar Customer Data Processing Addendum

For the purposes of this DPA, the following terms shall have the meanings set out below.

“Affiliate”

means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity, where “control” means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.

“Authorized Affiliate”

means any of Customer’s Affiliates that is permitted to use the Services pursuant to the Agreement between Customer and Valar but has not signed its own agreement with Valar and is not a “Customer” as defined under the Agreement.

“CCPA”

means the California Consumer Privacy Act of 2018, Cal. Civ. Code Sections 1798.100 et seq. (as amended by the California Privacy Rights Act) and its implementing regulations, each as amended or superseded from time to time.

“Completion Window”

means the maximum period within which Valar undertakes to return the first token following receipt of a Prompt, as selected by Customer for each request through the completion window parameter of the API, ranging from real-time execution to a maximum of twelve (12) hours.

“Controller, Member State, Processor, Processing, Supervisory Authority”

means have the same meanings as in the GDPR.

“Customer Personal Data”

means Personal Data Processed by Valar solely on behalf of Customer under this DPA and the Agreement. References in this DPA to “Personal Data” shall, in context, mean Customer Personal Data.

“Data Incident”

means the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data Processed by Valar on behalf of the Customer.

“Data Protection Laws”

means all applicable and binding privacy and data protection laws and regulations, including those of the European Union, the European Economic Area and their Member States, Switzerland, the United Kingdom, the United States of America, and Israel, as applicable to the Processing under this DPA, including (without limitation) the GDPR, the UK GDPR, CCPA, PPL, and the FADP, each as amended or superseded from time to time.

“Data Subject”

means the identified or identifiable person to whom the Personal Data relates.

“Data Subject Request”

means a request from a Data Subject to exercise rights under Data Protection Laws, including, where applicable, the rights of access, rectification, restriction of Processing, erasure, data portability, objection to Processing, and the right not to be subject to automated individual decision-making.

“FADP”

means the Swiss Federal Act on Data Protection of 25 September 2020.

“GDPR”

means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation).

“Model”

means a third-party artificial intelligence model made available through the Services and selected by Customer for the execution of a Prompt.

“Output”

means the content generated by a Model in response to a Prompt and returned to Customer through the Services.

“Personal Data”

means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to or with an identified or identifiable natural person.

“PPL”

means Israel’s Protection of Privacy Law, 5741-1981, together with the regulations promulgated thereunder (including Amendment 13 / “Tikun 13”, in force from 14 August 2025), as amended or superseded from time to time.

“Prompt”

means the content submitted by or on behalf of Customer to the Services for execution against a Model.

“Security Documentation”

means the technical and organizational measures applicable to the Services purchased by Customer, as further detailed in the Valar Trust Center accessible at https://trust.valarhq.ai/. Valar grants Customer access to the Trust Center on request.

“Self-Managed Deployment”

means a deployment of the Services within Customer’s own infrastructure or within a cloud environment controlled by Customer, in which Prompts and Outputs are processed within that environment.

“Services”

means the services provided to Customer by Valar in accordance with the Agreement.

“Standard Contractual Clauses”

means (a) where the GDPR applies, the standard contractual clauses set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the “EU SCCs”); and (b) where the UK GDPR applies, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B.1.0, issued by the UK Information Commissioner’s Office under the Data Protection Act 2018 (the “UK Addendum”).

“Sub-processor”

means any third party (including any Affiliate of Valar) that Processes Customer Personal Data under the instruction or supervision of Valar.

“UK GDPR”

means the UK Data Protection Act 2018, together with the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended.

“Zero Data Retention”

means the standing configuration of the Services under which Prompts and Outputs are not retained after the request to which they relate has been executed.

Valar shall inform Customer without undue delay if, in Valar’s opinion, an instruction for the Processing of Customer Personal Data given by Customer infringes applicable Data Protection Laws. To the extent Valar cannot comply with an instruction from Customer, Valar (i) shall inform Customer with relevant details, (ii) may, without liability to Customer, temporarily cease all Processing of the affected Personal Data (other than securely storing it) and/or suspend Customer’s access to the affected part of the Services, and (iii) if the Parties cannot agree on a resolution and the costs thereof, Customer may terminate the Agreement and this DPA with respect to the affected Processing, paying only for the Services actually provided up to the date of termination.

Taking into account the nature of the Processing, Valar shall (to the extent legally permitted) notify Customer or refer the Data Subject to Customer if Valar receives a Data Subject Request relating to Customer Personal Data. Valar shall assist Customer by appropriate technical and organizational measures, insofar as this is possible and reasonable, in fulfilling Customer’s obligation to respond to a Data Subject Request under Data Protection Laws. Where appropriate, Valar may advise Data Subjects of the self-service features available within the Services.

Valar’s assistance under this Section 3 is limited to the information and means reasonably available to it.

Valar shall ensure that personnel, contractors and advisors engaged in the Processing of Customer Personal Data have committed themselves to confidentiality obligations at least as protective as those set forth in this DPA and the Agreement, or are under an appropriate statutory obligation of confidentiality, and that access to Customer Personal Data is granted on a need-to-know basis.

Upon Customer’s reasonable request and at Customer’s cost, Valar shall reasonably assist Customer in ensuring compliance with Customer’s obligations under Articles 32-36 of the GDPR (and equivalent UK GDPR provisions), or any other applicable obligation in this regard, taking into account the nature of the Processing and the information available to Valar.

1. 6.2.1. Valar may, in the first instance, seek to satisfy this obligation by providing recent and relevant third-party certifications, attestations and audit reports; provided, however, that Customer may, acting reasonably, require on-site audit access where such certifications and audit reports do not, in Customer’s reasonable determination, adequately demonstrate compliance;
2. 6.2.2. audit information, audits, inspections and the results thereof — including any documents reflecting the outcome of the audit and/or inspection — shall be used by Customer solely to assess compliance with this DPA or to comply with its contractual obligations to third parties, and shall not be used for any other purpose or disclosed to any third party without Valar’s prior written approval;
3. 6.2.3. upon Valar’s first written request, Customer shall return all records and documentation in its possession or control provided by Valar in the context of the audit and/or inspection; provided that Customer may retain a copy of such records to comply with its applicable statutory and contractual obligations;
4. 6.2.4. if and to the extent the Standard Contractual Clauses apply, nothing in this Section 6.2 shall vary or modify the audit rights of Customer under the Standard Contractual Clauses (which prevail in that respect);
5. 6.2.5. in the event of an audit or inspections as set forth above, Customer shall ensure that it (and each of its mandated auditors) will not cause (or, if it cannot avoid, minimize) any damage, injury or disruption to Valar’s premises, equipment, personnel and business while conducting such audit or inspection; and
6. 6.2.6. the audit rights set forth in this Section 6.2 shall only apply to the extent that the Agreement does not otherwise provide Customer with audit rights that meet the relevant requirements of Data Protection Laws.

Prompts and Outputs. Customer Personal Data contained in Prompts and Outputs is deleted in the ordinary course of the Services in accordance with Zero Data Retention. No such Personal Data remains in Valar’s possession or control on termination or expiry of the Agreement, and no deletion request or return is required in respect of it.

In respect of any other Customer Personal Data Processed on Customer’s behalf (including account, administrative and support data), within thirty (30) days following termination or expiry of the Agreement (and subject thereto), Valar shall, at Customer’s choice (indicated by written notice to Valar), delete or return such Personal Data to Customer, and Valar shall delete existing copies unless applicable Data Protection Laws require otherwise. To the extent authorized or required by applicable law, Valar may retain a copy of the Personal Data solely for evidential purposes, for the establishment, exercise or defense of legal claims, or for compliance with legal obligations. Personal Data retained on the basis of this paragraph shall continue to be subject to the protective obligations of this DPA.

Subject Matter. The subject matter of the Processing is the performance of the Services pursuant to the Agreement.

Nature and Purpose of Processing.

1. Providing the Services to Customer;
2. Performing the Agreement, this DPA and any other contracts executed by the Parties;
3. Acting upon Customer’s instructions, where such instructions are consistent with the Agreement;
4. Sharing Customer Personal Data with third parties in accordance with Customer’s instructions and/or pursuant to Customer’s use of the Services;
5. Complying with applicable laws and regulations; and
6. Performing all tasks related to any of the above and in accordance with the DPA and the Agreement.

Duration and Frequency.

1. Prompts and Outputs: Processed continuously and on demand, on receipt of each request, for the duration of the Agreement. Retained in accordance with Zero Data Retention.
2. Account, administrative and support data: Processed for the duration of the Agreement and deleted or returned in accordance with Section 8.
3. Usage and log data: Processed for the duration needed for the provision of the Services under the Agreement and this DPA.

Type of Personal Data. The Personal Data Processed under this DPA falls into three categories. The extent and nature of the Personal Data contained in Prompts is determined and controlled by Customer in its sole discretion.

1. Personal Data that Customer or its users choose to include in a Prompt, or that a Model generates in an Output.
2. Account and administrative data (e.g. names, business email addresses, authentication identifiers and credentials).
3. Usage and log data (e.g. API request metadata, IP addresses, logs, metrics).

Categories of Data Subjects.

1. Customer’s administrative users, developers and other personnel who access or use the Services.
2. Natural persons whose Personal Data is contained in a Prompt or an Output depending on the use case Customer implements.

Sensitive Categories of Personal Data. Valar does not require, request or intentionally Process special categories of Personal Data within the meaning of Article 9 of the GDPR, or any other category of Personal Data subject to heightened legal requirements. Customer determines, in its sole discretion, whether to include such data in a Prompt, and is responsible for establishing its lawful basis and for any additional notices or consents required.

Where Customer intends to submit Personal Data subject to sector-specific requirements, Customer shall notify Valar in advance and the Parties shall enter into any further agreement required by applicable law before such data is submitted to the Services.

Part 1 — EEA Trans-Border Transfers. The Parties agree as follows:

1. the EU SCCs are hereby incorporated by reference and shall apply to any EEA Transfer as set out in this Part 1;
2. Module Two (Controller to Processor) of the EU SCCs shall apply where the EEA Transfer is made by Customer as data controller and Valar as data processor of the Personal Data;
3. Module Three (Processor to Processor) of the EU SCCs shall apply where the EEA Transfer is made by Customer as data processor and Valar as a sub-processor of the Personal Data;
4. Module Four (Processor to Controller) of the EU SCCs shall apply where the EEA Transfer is made by Valar as data processor and Customer as data controller of the Personal Data, and Customer is not subject to the GDPR in respect of that Processing;
5. Clause 7 (Docking Clause) of the EU SCCs shall not apply;
6. Option 2: GENERAL WRITTEN AUTHORISATION in Clause 9 of the EU SCCs shall apply, with the time period for prior notice of Sub-processor changes being as set out in Section 5.2 of the DPA;
7. in Clause 11 of the EU SCCs, the optional language shall not apply;
8. in Clause 17 of the EU SCCs, Option 1 shall apply, and the Parties agree that the EU SCCs shall be governed by the laws of the Republic of Ireland;
9. in Clause 18(b) of the EU SCCs, disputes shall be resolved before the courts of the Republic of Ireland;
10. Annex I.A (Parties): the data exporter and data importer, their contact details, the activities relevant to the data transferred and the role of each are completed as set out in the tables below; signature and date are deemed effected by entry into the Agreement and this DPA;
11. Annex I.B (Description of Transfer): the categories of Data Subjects, the categories of Personal Data, the frequency of transfer, the nature of the Processing, the purposes of the data transfer and further Processing, and the period for which the Personal Data will be retained, are described in Schedule 1 to this DPA. In relation to transfers to Sub-processors, the subject matter, nature and duration of the Processing are described at the Sub-processor List URL set out in Section 5.2 of this DPA;
12. Annex I.C (Competent Supervisory Authority): the supervisory authority in the Member State stipulated under Clause 17 / Clause 18 above shall be the competent supervisory authority;
13. Annex II (Technical and Organizational Measures): the Security Documentation referred to in this DPA serves as Annex II of the EU SCCs; and
14. to the extent of any conflict between the EU SCCs and any other terms of this DPA or the Agreement, the EU SCCs shall prevail.

EU SCCs Annex I.A — Parties.

Part 2 — UK Trans-Border Transfers. The UK Addendum is hereby incorporated by reference and shall apply to UK Transfers as set out in this Part 2, together with the EU SCCs as set out in Part 1.

1. Table 1 (Parties): as stipulated in Annex I.A of Part 1;
2. Table 2 (Selected SCCs, Modules and Selected Clauses): as stipulated in Part 1;
3. Table 3 (Appendix Information): Annex 1A — as stipulated in Annex I.A of Part 1; Annex 1B — as stipulated in the Annex I.B paragraph of Part 1; Annex II — as stipulated in the Annex II paragraph of Part 1; Annex III — as set forth at the Sub-processor List URL detailed in Section 5.2 of this DPA; and
4. Table 4 (Ending the Addendum when the Approved Addendum Changes): neither Party may end the UK Addendum in the manner set out in Section 19 of the Mandatory Clauses of the UK Addendum.

Part 2 (Mandatory Clauses) of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament under section 119A of the Data Protection Act 2018 on 2 February 2022 (as it may be revised under Section 18 of those Mandatory Clauses), shall apply.

Part 3 — Swiss Trans-Border Transfers. The Parties agree that the EU SCCs in Part 1, as adjusted below, shall apply where the FADP applies to Swiss Transfers:

1. references to the Standard Contractual Clauses mean the EU SCCs as amended by this Part 3;
2. the Swiss Federal Data Protection and Information Commissioner (“FDPIC”) shall be the sole Supervisory Authority for Swiss Transfers exclusively subject to the FADP;
3. references to the GDPR or Regulation (EU) 2016/679 in the EU SCCs shall be interpreted to include the FADP with respect to Swiss Transfers;
4. references to Regulation (EU) 2018/1725 are removed;
5. Swiss Transfers subject to both the FADP and the GDPR shall be dealt with by the FDPIC insofar as the Swiss Transfer is governed by the FADP, and by the EU Supervisory Authority named in Part 1 insofar as it is governed by the GDPR;
6. references to the “Union”, “EU” and “EU Member State” shall not be interpreted to exclude Data Subjects in Switzerland from the possibility of exercising their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs;
7. where Swiss Transfers are exclusively subject to the FADP, all references to the GDPR in the EU SCCs are to be understood as references to the FADP; and
8. where Swiss Transfers are subject to both the FADP and the GDPR, all references to the GDPR in the EU SCCs are to be understood as references to the FADP insofar as the Swiss Transfer is subject to the FADP.

Part 4 — Additional Safeguards. In the event of an EEA Transfer, UK Transfer or Swiss Transfer, the Parties supplement Parts 1-3 with the following safeguards and representations:

1. Valar shall maintain, in accordance with good industry practice, measures to protect the Personal Data from interception, including in transit between Customer and Valar and between different systems and services. These measures include network protection intended to deny attackers the ability to intercept data, and encryption of Personal Data in transit and at rest intended to deny attackers the ability to read the data;
2. Valar shall make commercially reasonable efforts to resist, subject to applicable law, any request for bulk surveillance relating to the Personal Data protected under the GDPR or the UK GDPR, including under section 702 of the United States Foreign Intelligence Surveillance Act (“FISA”);
3. If Valar becomes aware that any government authority (including a law-enforcement authority) wishes to obtain access to or a copy of any Personal Data — whether on a voluntary or mandatory basis — then, unless legally prohibited or under a mandatory legal compulsion that requires otherwise, Valar shall (i) inform the relevant authority that Valar is a processor of the Personal Data and that the Controller has not authorized Valar to disclose the Personal Data, and direct any request to the Controller in writing; and (ii) use commercially reasonable legal mechanisms to challenge any such demand, recognizing that challenge may not always be reasonable or possible in light of the nature, scope, context and purposes of the intended access; and
4. No more than once every twelve (12) months and only at Customer’s written request, Valar shall inform Customer of the types of binding legal demands for Personal Data it has received (to the extent permitted by law), including national-security orders and directives, including any process issued under section 702 of FISA.

1. Scope, Application & Interpretation.

1. 1.1 This Schedule 3 shall apply and bind the Parties if and to the extent that (i) Customer is a Business under the CCPA, and (ii) Valar Processes Personal Information (as defined below) that is subject to the CCPA in the course of providing the Services to Customer pursuant to the Agreement.
2. 1.2 This Schedule 3 prevails over any conflicting terms of the Agreement or the DPA but does not otherwise modify the Agreement or the DPA.
3. 1.3 This Schedule 3 shall be interpreted in favor of the Parties’ intent to comply with the CCPA, and therefore any ambiguity shall be resolved in favor of a meaning that complies and is consistent with the CCPA.
4. 1.4 Capitalized terms not specifically defined herein shall have the meanings ascribed to them in the DPA, as amended by this Schedule 3.

2. Definitions. For the purposes of this Schedule 3:

1. 2.1 The terms “Business”, “Collects” (and “collected” and “collection”), “Consumer”, “Business Purpose”, “Sell” (and “selling”, “sale”, and “sold”), “Share” (and “shared”, or “sharing”), and “Service Provider” shall each have the same meaning as in the CCPA.
2. 2.2 “Personal Information” means any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to or with an identified or identifiable Consumer or household of a Consumer, which is processed by Valar solely on behalf of Customer under this Schedule 3 and the Agreement.

3. Processing of Personal Information.

1. 3.1 Customer hereby appoints Valar as a Service Provider to Process Personal Information on behalf of Customer. Customer, in its use of the Services, and Customer’s instructions to Valar, shall comply with the CCPA. Customer represents and warrants that it has provided notice consistent with Section 1798.135 of the CCPA, and has obtained consents to the extent required under the CCPA for Valar to lawfully Collect and Process the Personal Information in pursuit of the permitted purposes (as defined in Section 3.2 below).
2. 3.2 Valar shall Process Personal Information solely for the purposes set forth in Section 2.3 of the DPA and as necessary to comply with this Schedule 3 and the CCPA (“Permitted Purposes”).
3. 3.3 Sections 3-8 and 11.2 of the DPA shall apply to the Processing of Personal Information and the following terms shall be replaced as follows: “Data Protection Laws” shall mean the CCPA; “DPA” shall mean this Schedule 3; “Personal Data” shall mean “Personal Information”; “Data Subject” shall mean “Consumer”; “Controller” shall mean “Business”; “Processor” shall mean “Service Provider”; and Sub-processor shall refer to the concept of a Service Provider engaged by Valar to Process Personal Information.
4. 3.4 Valar shall Process Personal Information in accordance with the provisions of the CCPA, and in a manner that provides the same level of privacy protection to Personal Information as required by the CCPA. Valar certifies that it understands the rules, requirements, and definitions of the CCPA and this Schedule 3, and shall comply with them.
5. 3.5 Valar acknowledges and confirms that it does not receive or process any Personal Information as consideration for any services or other items that Valar provides to Customer under the Agreement. Valar agrees to refrain from Selling and/or Sharing any Personal Information Processed hereunder without Customer’s prior written consent, nor taking any action that would cause any transfer of Personal Information to or from Valar under the Agreement or this Schedule 3 to qualify as Selling and/or Sharing such Personal Information. Valar shall not have, derive, or exercise any rights or benefits regarding the Personal Information, and shall not retain, use, or disclose any Personal Information (i) for any purpose other than the Permitted Purposes, and/or (ii) outside of the direct business relationship between the Parties.
6. 3.6 Valar shall not combine Personal Information with any other data if and to the extent that this would be inconsistent with the limitations on Service Providers under the CCPA.
7. 3.7 Valar shall notify Customer if Valar makes a determination that it can no longer meet its obligations under this Schedule 3 and/or the CCPA.

1. Application. This Supplement forms part of, and is Schedule 4 to, the DPA and it applies to the extent Valar Processes Personal Data subject to the PPL on behalf of Customer in the course of providing the Services. It supplements and, in the event of a conflict, prevails over the main body of the DPA in respect of the matters it governs.

2. Definitions. Capitalized terms used but not defined in this Supplement have the meanings given to them in the DPA. The terms “Authorized User”, “Data Security Procedure”, “Database Systems”, “Monitoring Mechanism”, “Risk Assessment” and “Security Incident” have the meanings given to them under Israel’s Protection of Privacy Regulations (Data Security), 5777-2017 (the “Information Security Regulations”). “PPL” means Israel’s Protection of Privacy Law, 5741-1981, together with the regulations promulgated thereunder (including Amendment 13 / “Tikun 13”, in force from 14 August 2025), as amended or superseded from time to time. “Database” means a collection of Personal Data Processed by digital means by Valar solely on behalf of Customer. “Database Controller” and “Holder” have the meanings given to them under the PPL.

3. Roles. For the purposes of the PPL, Customer is the Database Controller of Customer Personal Data and Valar is the Holder, Processing it solely on Customer’s behalf; Valar’s Sub-processors are sub-Holders. Sections 2 to 8, 10 and 11.2 of the DPA apply to such Processing, with “Controller” construed as “Database Controller”, “Processor” as “Holder”, “Data Protection Laws” as the PPL and “Data Incident” as including a Security Incident.

4. Information Security. Valar implements and maintains technical and organizational measures satisfying the requirements of the Information Security Regulations applicable to the security level of the relevant Database, including: a Data Security Procedure; up-to-date documentation of the Database structure and inventory of Database Systems, accessible on a need-to-know basis; periodic Risk Assessments and penetration tests, with findings remediated; retention of Monitoring Mechanism records as required by law; controls restricting portable devices and securing remote access, including appropriate authentication of Authorized Users; and restorable backups. The Security Documentation referred to in Section 6.1 of the DPA applies to such Processing.

5. Cross-Border Transfers from Israel. Personal Data originating from Israel to a jurisdiction outside Israel shall only be transferred in compliance with Israel’s Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001 and any successor regime adopted under Amendment 13.

6. Data Subject Rights and Direct Mailing. Valar shall assist Customer (as Database Controller) in responding to inspection, rectification and erasure requests under the PPL, and shall not engage in “direct mailing” within the meaning of section 17C of the PPL using Customer Personal Data without Customer’s prior written instruction.

7. Reporting and PPA Notification. Without limiting Section 6.2 of the DPA, Valar shall, on Customer’s written request, report to Customer at least annually on the performance of its obligations under this Supplement, and shall support Customer’s compliance with any notification obligations to the Privacy Protection Authority and to Data Subjects under the PPL.