Exporb Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Aeon Kosmos, LLC ("Processor," "we," "us," "our") and the customer ("Controller," "you," "your") who has entered into the Terms of Service for the Exporb service ("Service"). This DPA governs the Processing of Personal Data by Processor on behalf of Controller in the course of providing the Service.

This DPA is incorporated by reference into the Terms of Service effective as of the date you accept the Terms (the "Effective Date"). By using the Service, you enter into this DPA on behalf of yourself and any organization you represent, and you represent that you have authority to bind that organization.

Capitalized terms used but not defined in this DPA have the meanings given in the Terms of Service. In this DPA:

2.1 Subject Matter, Nature, and Purpose

Processor processes Personal Data to provide, maintain, and improve the Service as described in the Terms and Privacy Policy, acting on Controller's documented instructions.

2.2 Duration of Processing

For the duration of the Terms of Service plus the data retention periods specified in Section 8 of the Privacy Policy (active account → 30 days post-deletion → 90 days backup retention). Audio recordings deleted by Controller are permanently removed within 24 hours.

2.3 Categories of Data Subjects

The Personal Data processed concerns the following categories of Data Subjects:

• Controller's employees, contractors, and authorized users of the Service
• Trade show booth visitors, prospects, and business contacts whose conversations are recorded
• Individuals whose business cards are scanned or contact details are captured
• Any other natural person whose Personal Data Controller uploads to the Service

2.4 Types of Personal Data

The following types of Personal Data may be processed:

• Account Data: Name, email address, company name, phone number, job title, billing information (Controller acts as Data Subject here)
• Contact Data (Customer Data): Names, email addresses, phone numbers, job titles, company names of third-party contacts
• Audio Data: Voice recordings of conversations, AI-generated transcriptions
• Visual Data: Business card images, selfie photos (where used for contact profiles)
• Derived Data: AI-generated summaries, sentiment analysis, topic extraction, key insights

Controller authorizes Processor to engage the following Sub-processors to process Personal Data. All Sub-processors are bound by written agreements that impose data protection obligations no less protective than those in this DPA, including confidentiality, security, and limited-use provisions.

3.1 Current Sub-processors

3.2 DPA/SCC Status per Sub-processor

3.3 Sub-processor Changes — Notice & Objection

We will notify Controller at least 30 days before engaging any new Sub-processor that will have access to Customer Data, by email to the account administrator and by updating this DPA. Controller may object to a new Sub-processor on legitimate data protection grounds within 10 business days of notice. If the objection cannot be resolved, Controller may terminate the affected Service without penalty for the unused portion of the subscription term. Continued use after the 30-day notice period constitutes acceptance of the new Sub-processor.

3.4 Sub-processor Liability

Processor remains fully liable to Controller for the performance of each Sub-processor's data protection obligations. If a Sub-processor fails to fulfill its obligations, Processor shall be liable to Controller for the performance of that Sub-processor's obligations.

Controller represents and warrants that:

• It has a lawful basis for Processing Personal Data under GDPR Article 6 (and, where applicable, explicit consent under Article 9 for special-category data).
• It has provided all necessary notices to Data Subjects, including a privacy notice that discloses the use of a third-party processor (Exporb/Aeon Kosmos).
• It has obtained all consents required by applicable law before recording conversations or scanning business cards.
• Its instructions to Processor comply with applicable data protection laws.
• It will not instruct Processor to Process Personal Data in violation of applicable law.

Processor shall, taking into account the nature of the Processing, assist Controller by appropriate technical and organizational measures, insofar as possible, to fulfill Controller's obligation to respond to Data Subject requests.

5.1 Requests Received by Processor

If Processor receives a request from a Data Subject to exercise their rights (access, rectification, erasure, restriction, portability, objection), Processor will:

• Verify the request concerns Customer Data (not Account Data)
• Forward the request to Controller within 48 hours
• Assist Controller in responding (e.g., providing data exports)
• Not respond directly to the Data Subject except to acknowledge and redirect

5.2 Controller Requests to Processor

When Controller receives a Data Subject request that requires Processor's assistance, Controller shall submit a detailed request to support@exporb.com with "Data Subject Request — [Type]" in the subject line. Processor will respond within 5 business days and complete the requested action within 30 days (or provide a detailed explanation of any delay).

Processor implements and maintains the following technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access:

Processor shall notify Controller without undue delay and in any event within 48 hoursof becoming aware of a Personal Data Breach involving Customer Data.

Processor shall also cooperate with Controller, at Controller's expense, in any investigation, notification to supervisory authorities, or communication to Data Subjects required under GDPR Articles 33 and 34.

8.1 Data Storage Location

All Customer Data is stored and processed primarily in the European Union(Supabase eu-central-1, Vercel iad1). The following transfers outside the EU/EEA occur:

• Google Gemini API: Audio and text data processed in the United States for AI transcription and analysis. Zero-retention — data is not stored by Google after processing.
• Stripe: Payment data processed in the United States for billing.
• RevenueCat: Purchase receipt metadata processed in the United States.

8.2 Transfer Safeguards — Standard Contractual Clauses

For transfers of Personal Data from the EEA, UK, or Switzerland to a third country not subject to an adequacy decision, the parties agree that the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (Controller-to-Processor), are incorporated by reference into this DPA and shall apply as follows:

• Clause 7 — Docking Clause: Not applicable (only Controller and Processor are parties).
• Clause 9(a) — Sub-processor Authorization: Option 2 (General Written Authorization) applies, with the specific notice period of 30 days as stated in Section 3.3 of this DPA.
• Clause 11(a) — Redress: The optional language shall not apply. Data Subjects may not lodge complaints with an independent dispute resolution body at no cost.
• Clause 17 — Governing Law: The laws of Ireland (for EEA transfers) or the laws of England and Wales (for UK transfers) shall govern the SCCs.
• Clause 18 — Choice of Forum: Disputes shall be resolved by the courts of Ireland (for EEA) or England and Wales (for UK).
• Annex I.A — Data Exporter: Controller (as identified by account registration data).
• Annex I.B — Data Importer: Aeon Kosmos, LLC, 9169 W State St, Ste 3694, Garden City, ID 83714, USA. Contact: support@exporb.com.
• Annex II — Technical & Organisational Measures: As described in Section 6 of this DPA.
• Annex III — Sub-processors: As listed in Section 3.1 of this DPA.

8.3 UK Addendum

For transfers subject to UK GDPR, the International Data Transfer Addendum to the EU SCCs (issued by the UK ICO, version B1.0, in force 21 March 2022) is incorporated by reference. Tables 1-3 are completed per the SCC selections above. Table 4: Either party may end this Addendum per Section 19 of the Mandatory Clauses.

Controller may, no more than once per twelve-month period and at Controller's expense, audit Processor's compliance with this DPA, subject to the following:

• Audit requests must be submitted in writing at least 30 days in advance.
• Audits are scoped to Processor's Processing of Controller's Personal Data.
• Audits shall not unreasonably disrupt Processor's business operations.
• Controller's auditor must sign a confidentiality agreement acceptable to Processor.
• Controller bears all costs of the audit (including Processor's reasonable time spent supporting it).
• Findings shall be shared with Processor and treated as confidential.

10.1 Duration

This DPA takes effect on the Effective Date and continues until the later of: (a) termination of Controller's account; or (b) the completion of all data deletion obligations in Section 10.2.

10.2 Deletion or Return of Data

Upon termination of the Service, Processor shall, at Controller's choice, delete or return all Customer Data. The deletion timeline follows the Privacy Policy Section 8:

• Days 0-30: Data retained for recovery (Controller can request return during this period).
• Day 30: All Customer Data permanently deleted from live systems.
• Day 90: Customer Data purged from backups.
• Exception: Legal/financial records retained as required by applicable law (tax compliance, max 7 years).

Processor will provide written confirmation of deletion within 30 days of completion.

11.1 Governing Law

This DPA is governed by the laws specified in Section 16 of the Terms of Service (Delaware, USA), provided that where the GDPR, UK GDPR, or Swiss FADP applies, the relevant provisions of those laws shall govern to the extent required by such laws. The SCCs incorporated under Section 8 shall be governed per Clauses 17-18 of the SCCs.

11.2 Order of Precedence

In the event of any conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to data protection and privacy obligations. The SCCs shall prevail over this DPA with respect to the subject matter of the SCCs.

11.3 Liability

Processor's liability under this DPA is subject to the limitations in Section 14 of the Terms of Service (Limitation of Liability), except that nothing in this DPA limits either party's liability for: (a) violations of Data Subject rights under GDPR; (b) data breaches caused by Processor's failure to implement the security measures in Section 6; or (c) fines imposed by supervisory authorities to the extent caused by Processor's breach of this DPA.

For questions about this DPA, to exercise audit rights, or to request a signed copy:

12.1 DPA Updates

This DPA may be updated to reflect new Sub-processors, updated security measures, or changes in applicable law. Updates follow the same notice procedure as the Terms of Service:

• Minor updates: posted here, effective on posting
• Material changes: 30 days' email notice to account administrator
• New Sub-processors: per Section 3.3 (30 days' notice + objection right)