Data Processing Agreement

Parties, scope and precedence

This agreement is between Abalmon Inc. and the business or professional customer identified when it is completed (the "customer"). It applies when Abalmon processes personal data on the customer's behalf in providing Abalmon. The customer acts as controller or, if it processes the data on behalf of another controller, as a processor authorised to engage Abalmon as a subprocessor. Each party keeps its own legal obligations.

The completed agreement records the customer's legal name, address, privacy contact, signatory and declared authority, the date and the version accepted. For data protection matters, this agreement prevails over the Terms of Service; any official transfer clauses prevail within their scope.

Subject matter, nature and duration

Abalmon processes personal data to provide the services the customer uses: authorised connection and import of sources, recording, transcription, storage, search, memory, summaries and briefings, AI assistance, actions the customer's users request, export, integrations and the support those functions need. Annex A describes the categories of data and data subjects and the operations. Processing lasts for as long as the service is provided and until return, deletion and any limited legal retention are complete.

Documented instructions

The Terms of Service, this agreement, the settings the customer chooses and the requests its authorised users make are the customer's documented instructions. Abalmon processes personal data only on those instructions, including with regard to international transfers, unless required to do otherwise by applicable law; in that case it informs the customer before processing, unless the law prohibits it.

Abalmon informs the customer immediately if, in its opinion, an instruction infringes data protection law, and may suspend the affected processing until the instruction is clarified.

Abalmon does not sell customer personal data or use it for advertising, for profiling unrelated to the service, or to train general AI models on its own behalf, and does not permit subprocessors to process it outside the service they provide to Abalmon. Abalmon's own processing as controller (account, billing, security) is described in the Privacy Policy and does not cover customer content.

Customer obligations

The customer determines the purposes, legal bases, categories of data and retention; gives the people concerned the information the law requires; limits the sources it connects; and gives access only to authorised users. It assesses whether workplace use is proportionate and obtains consent where that is the applicable basis. It does not use Abalmon for covert monitoring, for significant decisions about people without legal safeguards, or for clinical processing that has not been specifically assessed and agreed.

Special categories of data that appear incidentally in ordinary communications remain special categories. The customer must have an applicable condition under Article 9 of the GDPR, limit their inclusion and ask for removal or specific arrangements where necessary. Accepting this agreement does not provide that condition.

Confidentiality and security

Abalmon ensures that the people it authorises to process personal data are bound by confidentiality and receive appropriate instructions. It applies technical and organisational measures appropriate to the risk, as described in Annex B, reviews their effectiveness and does not materially reduce the overall protection during the agreement. Abalmon does not offer end-to-end encryption and does not claim any security certification.

Subprocessors

The customer gives Abalmon general authorisation to engage the subprocessors listed in Annex C. Abalmon imposes on each subprocessor, by contract, data protection obligations equivalent to those in this agreement as they apply to its service, and remains fully liable to the customer for their performance, as required by Article 28(4) of the GDPR.

Abalmon informs the customer in writing, before the new subprocessor receives personal data, of any intended addition or replacement, giving the customer the opportunity to object on reasonable data protection grounds. The notice period and the communication channel are set in the completed agreement. If the parties cannot find a suitable alternative, the customer may terminate the affected service before the change, with a proportionate refund of amounts paid in advance for the period not provided.

Services the customer contracts directly and instructs Abalmon to send data to — for example its own ChatGPT or Claude account, or the email, calendar, Slack or WhatsApp accounts its users connect — are not Abalmon subprocessors. A personal assistant account is not assumed to be covered by a business agreement.

Assistance with data subject rights and compliance

Taking into account the nature of the processing and the information available to it, Abalmon assists the customer with appropriate measures to respond to data subject requests, to ensure security, to notify breaches and to carry out data protection impact assessments and prior consultations. Abalmon forwards to the customer, without undue delay, any request it receives from a data subject about the customer's data, and does not answer it on the customer's behalf unless authorised or required by law.

Ordinary assistance with rights requests, service information and incidents is included. Exceptional assistance may be quoted reasonably and agreed in advance, never as a condition for meeting urgent legal obligations and never at a cost to the data subject.

Personal data breaches

Abalmon notifies the customer without undue delay after becoming aware of a personal data breach affecting the customer's data. Any maximum notification time agreed with the customer is recorded in the completed agreement. A first notice may be provisional and is not delayed until the investigation is complete.

As far as it is known, the notice describes the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, the measures taken or proposed and a contact for follow-up. Abalmon contains the incident, keeps proportionate evidence, cooperates and updates the information as it becomes available. The customer decides on its own notifications as controller.

Return and deletion

When the service ends, the customer chooses whether Abalmon returns or deletes the personal data and existing copies, unless the law requires retention. Return uses a secure channel and commonly used formats, including relevant data that the self-service downloads do not cover, such as original audio and attachments. The parties agree a retrieval window before any irreversible deletion; an express instruction to delete immediately prevails unless the law requires otherwise.

Abalmon deletes the data from active systems without undue delay; copies in backups are removed as those backups expire, under the periods confirmed in the completed agreement (Annex B). Any legally required retention is limited to the data and period required, with restricted access. Abalmon confirms deletion on request.

Information and audits

Abalmon makes available to the customer the information necessary to demonstrate compliance with Article 28 of the GDPR and allows for and contributes to audits, including inspections, by the customer or an auditor it appoints. The parties may agree confidentiality, security, scope and reasonable notice, without preventing audits required by law, actions of supervisory authorities or responses to indications of non-compliance.

International transfers

Abalmon Inc. is established in the United States, and some subprocessors process data in other countries. Personal data is transferred outside the European Economic Area only with a valid mechanism under Chapter V of the GDPR and any assessments and supplementary measures required. The mechanism that applies to each flow — from the customer to Abalmon and from Abalmon to its subprocessors — is identified in Annex D of the completed agreement. Abalmon Inc. does not claim certification under the EU–US Data Privacy Framework, and this page is not itself a set of official transfer clauses.