Cleverdist Data Processing Agreement

Version 1.1 | Last updated 4 November 2026

This Data Processing Agreement (DPA) forms part of the service agreement, order or online service terms through which a customer engages Cleverdist to provide IO Industrial Intelligence, a pilot or related services, where that agreement incorporates this DPA. It applies when Cleverdist processes personal data on the customer’s behalf. A separate signature on this DPA is not required when it has been validly incorporated into an accepted agreement. Customers may agree a separate DPA directly with Cleverdist as provided in section 2.

1 Parties roles and scope

Cleverdist SA, Route de la Galaise 34, 1228 Plan-les-Ouates, Geneva, Switzerland, contact info@cleverdist.com, is the Processor. Customer means the legal entity identified in the accepted Main Agreement. The Customer acts as controller or, where identified in the Processing Record, as a processor appointing Cleverdist as a subprocessor. Where the Customer acts for a controller, it shall have the necessary authority and communicate the controller’s applicable instructions and restrictions.

Protected Data means personal data processed by the Processor on the Customer’s behalf under the Main Agreement. Main Agreement means the binding service agreement, accepted order or accepted online service terms incorporating this DPA. Processing Record means the applicable service description, deployment profile, order particulars and documented instructions described in Schedule 1. Applicable Law means Regulation (EU) 2016/679 (GDPR) and relevant EEA national data protection law where applicable, and the Swiss Federal Act on Data Protection (FADP) and its implementing requirements where applicable. Controller, processor, personal data, processing and personal data breach have their meanings under the applicable legislation.

This Agreement does not cover processing for which either party independently determines its purposes, such as its own billing contacts, legal administration or independent prospecting. Such processing requires its own lawful basis and transparency. This Agreement does not authorise either party to repurpose Protected Data as independent-controller data. An independent B2B data provider is not made a processor merely by being named a supplier. Joint-controller activities require a separate allocation where applicable.

2 Application acceptance and separate agreements

This DPA and its applicable schedules become binding when the Customer and Cleverdist enter into a Main Agreement that expressly incorporates them, whether acceptance is recorded by signature or by another legally effective written or electronic method. Cleverdist shall make the applicable version accessible before acceptance. The individual accepting on behalf of the Customer must have authority to bind that entity. Acceptance of the Main Agreement also covers this DPA; no separate DPA signature is required.

A Customer that requires a separate or amended DPA may contact info@cleverdist.com. Any separate DPA or written amendment must be expressly agreed by authorised representatives of both parties. Once effective, it takes priority over this standard DPA for the processing it covers, to the extent of a conflict. Provisions of this standard DPA continue only insofar as the separate agreement incorporates or preserves them. Requesting or sending an alternative document does not itself change the agreed terms.

The parties shall retain the version incorporated into their Main Agreement, the applicable service profile and evidence of acceptance. Publishing this DPA does not by itself bind a website visitor or retrospectively amend an existing agreement. Affiliates are covered only if identified as parties or validly represented in the accepted agreement; access to a service does not automatically make an affiliate a contracting party or authorise disclosure to a new controller.

3 Processing instructions and responsibilities

The Processor shall process Protected Data only on documented instructions, including authorised service settings and support requests, for the purposes, operations and period in Schedule 1. Instructions concerning transfers are also subject to section 9. The Processor shall not sell Protected Data, use it for its own advertising, combine it with unrelated customer datasets or otherwise determine a new purpose.

The Customer determines lawful purposes, appropriate legal grounds, notices, permitted data categories and retention instructions, and supplies only data it is entitled to provide. If it acts for another controller, it shall ensure that its instructions and authorisations comply with that relationship. These responsibilities do not remove the Processor’s own statutory or contractual obligations.

If legally compelled to process beyond instructions, the Processor shall inform the Customer before doing so unless the applicable law prohibits that notice on important public-interest grounds. An instruction considered unlawful shall be brought to the Customer’s attention immediately. The affected processing shall be suspended where necessary while the parties resolve the issue. Foreign disclosure demands are handled under section 9 and do not themselves override Applicable Law.

4 Confidentiality and security

The Processor shall ensure that everyone authorised to access Protected Data is bound by confidentiality obligations or an appropriate statutory duty, receives relevant training, and has access limited to assigned tasks. Duties continue after access or employment ends. Access is withdrawn promptly when no longer necessary.

Before receiving Protected Data and throughout processing, the Processor shall implement the technical and organisational measures in Schedule 2, supplemented by the accepted service security profile. Measures shall be appropriate to the risks, taking account of the state of the art, implementation costs, the nature and scope of processing and risks to individuals. The Processor shall regularly evaluate effectiveness and remedy material weaknesses. A material reduction in agreed protection requires prior agreement and must remain lawful. This Agreement makes no claim of a certification unless a current certificate is expressly supplied.

5 AI systems and connected tools

Protected Data, including prompts, attachments, retrieved records, outputs and logs containing personal data, shall not be used to train or fine-tune a general-purpose or shared AI model. The Processor shall impose this restriction on authorised subprocessors. Use of an AI system solely to perform an authorised service task does not by itself constitute model training, but remains subject to instructions, minimisation, security, retention and transfer controls.

ChatGPT, Codex, Jev, Treg, Hublead and other external AI, enrichment, gateway or CRM tools are not authorised to receive Protected Data merely because Cleverdist uses them for its own business operations. Before any such tool receives Protected Data, the Customer must give documented authorisation covering the purpose and actual recipients, and the Processor must satisfy sections 8 and 9. Authorisation may be part of an accepted, sufficiently specific Processing Record. An AI feature within IO is permitted only within its documented service scope and approved processing chain.

The Processor shall not infer sensitive personal characteristics or use Protected Data for employment, credit or other consequential individual decisions unless separately and expressly instructed and lawfully supported. The parties shall specify necessary human review, accuracy controls and any additional AI-law obligations for the actual feature. This DPA does not itself satisfy product safety, AI conformity, transparency or high-risk-system requirements.

6 Individual rights and compliance assistance

Taking account of the nature of processing, the Processor shall assist through appropriate technical and organisational measures with access, correction, erasure, restriction, portability and objection requests, and safeguards concerning automated decisions. Requests received directly shall be forwarded promptly and ordinarily within two business days. The Processor shall not determine the substantive response unless authorised or legally required.

The Processor shall provide necessary assistance and available information for security obligations, breach assessment and notification, data protection impact assessments and prior consultation. It shall respond sufficiently promptly to enable statutory deadlines to be met; any shorter deadline communicated with reasons shall take priority over ordinary support targets. The parties may agree reasonable charges for exceptional assistance, but charges shall not prevent mandatory assistance or timely compliance. The Processor bears remediation costs caused by its own breach.

7 Personal data breaches

The Processor shall notify the Customer without undue delay and in any event within 24 hours after becoming aware of a personal data breach affecting Protected Data. Initial notification shall not wait for a complete investigation. It shall describe, as available, the nature of the breach, affected systems, data and individuals, approximate numbers, likely consequences, mitigation and containment, and a responsible contact. Missing information shall follow in timely updates, with an incident timeline and relevant evidence.

The Processor shall promptly contain and investigate the breach, preserve relevant evidence, cooperate with reasonable remediation instructions and document corrective actions. It shall assist the Customer in deciding whether and how to notify authorities and individuals. It shall not make a notification on the Customer’s behalf without authorisation unless legally required. The 24-hour contractual deadline does not replace a controller’s own statutory notification deadlines.

8 Subprocessors

The Customer gives general written authorisation only for subprocessors identified in the accepted Processing Record or an expressly incorporated initial list meeting Schedule 3. Before appointment, the Processor shall assess sufficient guarantees and enter a binding written agreement imposing materially equivalent data protection duties, including security, confidentiality, assistance, deletion and transfer controls. The Processor remains fully liable to the Customer for the performance of its subprocessor’s data protection obligations.

The Processor shall actively notify the designated contact at least 30 calendar days before adding or replacing a subprocessor, identifying the entity, service, data involved, locations and safeguards. The Customer may object on reasonable data protection grounds within 20 calendar days. The proposed subprocessor shall not receive affected data until the notice period expires without objection or the parties resolve an objection in writing. An urgent change requires prior specific written authorisation rather than bypassing these protections.

If an objection cannot be resolved through an alternative or adequate safeguards, the Customer may terminate the affected processing or service before the disputed appointment, with a proportionate refund of prepaid unused affected service fees and without an early-termination penalty for that part. Other remedies remain available. The Processor shall maintain a current list and supply relevant subprocessor terms on request, with necessary redactions that do not conceal data protection obligations.

9 Locations and international transfers

Processing, storage, support access and onward disclosure shall be limited to the countries and recipients authorised in the Processing Record. Hosting in the EEA does not exclude international remote access or onward transfers. A change requires documented instructions, the applicable subprocessor procedure and a lawful transfer basis before processing begins.

Where required by GDPR Chapter V or the Swiss FADP, the parties shall establish a valid adequacy basis or appropriate safeguards and complete any required transfer assessment and supplementary measures. If transfer SCCs are used, the legally applicable clauses and module, parties, annexes, competent authority, governing-law and forum selections, and any necessary Swiss adaptations shall be completed and made binding before the transfer. No SCC module or third-country transfer is deemed authorised merely by accepting this DPA. Any other country-specific requirements must also be satisfied.

The Processor shall assess legally binding public-authority requests, disclose only what is legally required, and notify the Customer where legally permitted. It shall use available lawful efforts to narrow, challenge or obtain permission to disclose a request where warranted, and document the assessment. If lawful protection can no longer be maintained, it shall promptly inform the Customer and suspend the affected transfer or processing. Mandatory transfer clauses prevail over inconsistent terms of this Agreement.

10 Return deletion and retention

During service, the Processor shall implement lawful retention and deletion instructions. On termination or expiry, the Customer may choose return of Protected Data in an agreed usable format followed by deletion, or deletion without return. Unless a shorter lawful period is instructed or another necessary return period is agreed, the Processor shall complete return and deletion of active copies within 30 calendar days after termination or the instruction, whichever applies. No separate prospect-marketing retention period extends the processing under this DPA.

Residual backup copies shall be securely isolated, not used for ordinary processing, and overwritten or deleted within 90 calendar days, unless an expressly agreed service profile sets a shorter period. If restored, deletion instructions shall be reapplied. The Processor shall cause authorised subprocessors to follow equivalent obligations and confirm completion in writing on request. Retention required by applicable law shall be limited to the required data and period, protected from other use and explained to the Customer unless legally prohibited. A general desire to improve AI systems is not a retention exception.

11 Evidence audits and oversight

The Processor shall make available information necessary to demonstrate compliance and allow and contribute to audits, including inspections, by the Customer or an independent auditor it mandates. Suitable reports and evidence may be used first where they sufficiently address the issue, but do not remove the right to an audit where needed. Audits shall protect other customers’ data, security and legitimate confidentiality. Reasonable notice, scope and confidentiality arrangements shall not prevent urgent investigations, regulatory access or effective verification after an incident or credible concern.

The Processor shall maintain relevant processing and security records as legally required, identify material noncompliance promptly and implement corrective actions. Nothing in the Main Agreement restricts competent supervisory authorities’ powers or individuals’ mandatory rights. The parties shall cooperate with competent authorities in relation to the processing.

12 Priority liability and termination

Subject to the separate-agreement provisions in section 2, this DPA and its applicable schedules prevail over inconsistent Main Agreement terms concerning Protected Data. Mandatory law and applicable binding transfer clauses prevail over this DPA and any separate agreement. The governing law and dispute forum are those validly agreed in the Main Agreement, subject to mandatory law and transfer-clause requirements. No privilege or immunity of an international organisation is waived by implication.

Commercial liability allocations in the Main Agreement apply only insofar as legally effective. Nothing here excludes a party’s mandatory responsibility, individuals’ compensation rights, regulatory powers or liabilities and rights imposed by applicable transfer clauses. No new liability cap is created by this Agreement.

This DPA continues while Protected Data is processed, including restricted residual retention. A material failure shall entitle the Customer to require suspension and remediation and, if it cannot be remedied within a reasonable period compatible with the risk and law, terminate the affected processing. Immediate suspension or termination is available where required to prevent unlawful processing. An updated website version applies to an existing Main Agreement only through a valid agreed amendment or another binding change mechanism in that agreement, consistently with Applicable Law. An update does not itself expand instructions or reduce agreed protection. Privacy and security notices to Cleverdist shall be sent to info@cleverdist.com and any additional incident channel in the Processing Record.

Schedule 1 Processing particulars and instructions

This Schedule describes the standard processing for the contracted services. The Main Agreement identifies the Customer, the selected service, its duration and authorised configuration. The applicable service description and documented deployment instructions supplement this Schedule and form the Processing Record. A common service profile may apply to multiple customers using the same service configuration; a separately negotiated or signed processing schedule is not required where the accepted Main Agreement incorporates sufficiently specific particulars. Before processing starts, the parties shall establish any additional particulars needed for the actual deployment.

Service and roles

The subject matter is the provision, configuration and support of the IO deployment, pilot or related service selected in the Main Agreement. Processing is undertaken to deliver that service on the Customer’s instructions, including analysis of authorised operational cases and generation of the contracted outputs. Cleverdist does not receive an independent right to use Protected Data for its own prospecting or model training. Customer identity and authorised contacts are established by the Main Agreement and account or deployment records. Any upstream controller restrictions apply as communicated by the Customer.

Data individuals and operations

Depending on the selected service and the material the Customer authorises, data subjects are authorised users, Customer employees, contractors and professional contacts whose information appears in submitted records. Personal data types are names, work contact details, account identifiers, role and access information, technical usage and security records, and personal information in authorised operational cases, maintenance notes or support correspondence. Only categories needed for the selected service are within scope. Processing operations are collection through authorised submissions or connections, storage, retrieval, organisation, analysis or AI inference, output generation, authorised support, return and deletion as required for the contracted service. Machine and process data that does not relate to an identifiable person is outside the definition of Protected Data.

Limits duration and locations

Processing lasts for the service term stated in the Main Agreement and any limited return, deletion or legally required retention period under section 10. Frequency may be continuous for an authorised connection or intermittent for submitted cases and support tasks, according to the contracted configuration. The Processing Record identifies the actual storage and remote-access countries, applicable retention settings and return arrangements before those activities begin. Special-category data, criminal-offence data, children’s data, biometric identification and systematic employee-performance monitoring are excluded unless separately and expressly authorised with the necessary safeguards. The Customer retains the rights and responsibilities set out in this DPA.

Deployment details and instructions

Cleverdist shall provide the Customer with the service-specific security information, the initial subprocessor and location details under Schedule 3, and any required transfer arrangements before the corresponding processing starts. External AI tools and gateways require the documented authorisation in section 5. Configuration records and authorised written support requests provide further instructions only within the agreed scope. A missing detail does not authorise an unspecified data use, recipient or country.

Schedule 2 Minimum technical and organisational measures

Cleverdist shall implement the following measures for the processing within its control and provide service-specific security information before Protected Data is received. Additional risk-specific measures may be agreed through the Main Agreement or Processing Record. A departure from this baseline requires explicit agreement and lawful equivalent protection. The safeguards apply throughout the processing and remain subject to section 4.

Governance and access

Maintain assigned security and privacy responsibilities, confidentiality and training records, incident procedures and periodically reviewed access rights. Use individual accounts, least privilege and multi-factor authentication for administrative and remote access to systems processing Protected Data. Protect credentials and secrets, prohibit shared privileged accounts except controlled emergency arrangements, and record and review emergency access.

Data protection and isolation

Encrypt Protected Data in transit over untrusted networks and at rest in managed storage and backups, using current appropriate cryptographic standards and protected key access. Implement tenant or equivalent access isolation, controlled exports, minimisation of support copies, and safeguards against unauthorised cross-customer access. Restrict physical access through appropriate hosting and workplace controls. Record customer-managed controls and shared responsibilities without treating them as a waiver of the Processor’s obligations.

Secure operation and resilience

Maintain asset and configuration records, supported systems, risk-based vulnerability and patch management, protective network controls and appropriate malware safeguards. Separate development and production, review material changes, test security controls and use synthetic or properly protected test data. Keep necessary access and security logs with restricted access and documented proportionate retention. Monitor relevant events and investigate alerts. Back up where needed for the service, protect backup access and periodically test recovery and availability arrangements.

Review AI safeguards and disposal

Assess control effectiveness at least annually and after material changes or incidents; document findings and remediation. Where authorised AI is used, constrain connector permissions, minimise prompts and retrieved data, protect against unintended disclosure and tool execution, apply agreed human review, and verify no-training and retention settings. Apply secure deletion and media disposal, and maintain evidence of return, deletion and access revocation. Do not place Protected Data into personal consumer AI accounts or unapproved tools.

Schedule 3 Authorised subprocessors and locations

The Customer authorises only those initial subprocessors identified in the versioned service-specific list or Processing Record made available before acceptance and incorporated into the Main Agreement. That information shall identify each subprocessor’s legal entity, service and purpose, affected data, storage and remote-access countries, and any applicable onward-transfer safeguard. A standard list may be used for all customers of the same service. A copy of the list applicable to the Customer’s service may be requested at info@cleverdist.com. Additions and replacements require the active notice and objection procedure in section 8.

The actual Azure contracting entity, relevant services and processing locations shall be specified where Microsoft Azure is used for Protected Data. The same disclosure and authorisation requirements apply to other cloud services, AI providers, gateways and support providers. Mention of a tool in Cleverdist’s Privacy Policy or on its website does not by itself authorise that tool to process Protected Data under this DPA. No unspecified recipient or country is authorised by default.