EU Standard Contractual Clauses

Incorporation of the SCCs by reference

The Parties incorporate by reference, and agree to be bound by, the Standard Contractual Clauses set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021. The selections recorded in this document complete the SCCs; nothing in this document varies the substantive obligations of the SCCs.

For the avoidance of doubt:

• The data exporter is the Customer identified in Annex I.A. The data importer is Komplexity AI LLC.
• The Parties enter into Module 2 (transfer Controller to Processor). Modules 1, 3, and 4 do not apply.
• In the event of any inconsistency between this document and the SCCs themselves as set out in Decision 2021/914, the SCCs control.
• The Komplex AI Data Processing Agreement is the agreement “between the Parties” referred to in Clause 8 and elsewhere. Where these SCCs and the DPA both address the same subject, the SCCs control to the extent required by Clause 5.

Option selections within the SCCs

Clause 7 — Docking clause

Included. An entity that is not a party to these Clauses may, with the agreement of all Parties, accede at any time, either as a data exporter or as a data importer, by completing the relevant Annexes.

Clause 9 — Use of sub-processors

Option 2 — General written authorization.The data importer has the data exporter's general authorization for the engagement of sub-processors from the agreed list at Annex III. The data importer will specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least thirty (30) days in advance, thereby giving the data exporter sufficient time to object to such changes prior to the engagement of the sub-processor(s). The data importer will provide the data exporter with the information necessary to enable the data exporter to exercise its right to object.

Clause 11(a) — Redress (independent dispute body option)

The optional language permitting data subjects to lodge a complaint with an independent dispute-resolution body at the importer's expense is not included. Data subjects retain all rights under Clause 11 and applicable law to lodge complaints with a supervisory authority and to seek judicial remedies.

Clause 17 — Governing law

Option 1. These Clauses are governed by the laws of Ireland, a Member State of the EU that allows for third-party beneficiary rights.

Clause 18 — Choice of forum and jurisdiction

(b) The Parties agree that any dispute arising from these Clauses shall be resolved by the courts of Ireland, without prejudice to Clause 18(c) (data subjects' right to bring proceedings in their habitual place of residence) or Clause 18(d) (rights of supervisory authorities).

Annex I — A. List of Parties

Data exporter

Data importer

Annex I — B. Description of the transfer

Annex I — C. Competent supervisory authority

In accordance with Clause 13, the competent supervisory authority for the transfers under these Clauses is the Data Protection Commission (DPC) of Ireland, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland — dataprotection.ie.

Where the data exporter is established in an EU Member State other than Ireland, the competent supervisory authority is the authority of that Member State.

Where the data exporter is not established in the EU but is subject to the GDPR under Article 3(2) and has appointed a representative under Article 27, the competent supervisory authority is the authority of the Member State in which the representative is established. Where no such representative has been appointed, the competent supervisory authority remains the Irish DPC.

Annex II — Technical and organisational measures

The technical and organizational measures applied by the data importer are set out in Annex D of the DPA and are incorporated here by reference. In summary:

• Zero retention of submitted text. Submitted text exists only in process memory for the duration of an inference call.
• Transport encryption. TLS 1.2 or higher for all traffic.
• Access controls. Production access limited to authorized personnel with multi-factor authentication; per-customer API keys.
• Authentication and password hygiene. Provided by Clerk; salted hashed passwords; no plaintext passwords held by the importer.
• Payment-card data. Handled exclusively by Stripe (PCI-DSS).
• Logging. Usage metadata only; submitted text and model outputs are not logged.
• Personnel confidentiality. Staff with production access are bound by confidentiality obligations.
• Sub-processor diligence. Each sub-processor has a published DPA and either SOC 2 or equivalent attestation.
• Incident response. 72-hour notification under DPA Section 9 and Clause 12 of these SCCs.
• Business continuity. Inference and web hosting redundancy provided by Modal and Vercel respectively.

For transfers to sub-processors, the measures listed above also describe the measures the data importer requires of its sub-processors, subject to each sub-processor's own published technical and organizational measures.

Annex III — List of sub-processors

The list of sub-processors authorized under Clause 9(a) Option 2 is set out in Annex C of the DPA and is reproduced below for convenience.

Signatures

The Parties sign these SCCs via the signature block of the DPA, which the Parties agree constitutes signature of these SCCs for the purposes of Annex I.A.