Data Processing Addendum

Data Protection Laws means all laws that apply to the processing of Customer Personal Data under the agreement, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act (CCPA).

Customer Personal Data means personal data that we process on your behalf in providing Oasis, including personal data contained in content from services you connect. Controller, processor, data subject, personal data, processing, and personal data breach have the meanings given in the GDPR.

Subprocessor means a third party we engage to process Customer Personal Data. Standard Contractual Clauses (SCCs) means the clauses adopted by the European Commission in Decision 2021/914.

You are the controller of Customer Personal Data, or a processor acting for your own controller. We are your processor, or subprocessor. For the CCPA, we are your service provider.

You are responsible for having a lawful basis for the processing, for the instructions you give us, and for giving any notices and obtaining any consents required to connect services and share data with Oasis.

We process Customer Personal Data only on your documented instructions, unless the law requires otherwise, in which case we will tell you before processing unless the law prohibits it. The agreement, this DPA, and your configuration and use of Oasis are your complete instructions.

We will tell you if we believe an instruction violates Data Protection Laws.

We require everyone we authorize to process Customer Personal Data to keep it confidential.

We maintain the technical and organizational measures described in Annex II to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. We may update these measures as long as the overall level of protection does not decrease.

You give us general authorization to engage subprocessors. Our current subprocessor list is available at trust.joinoasis.com.

We will give you notice of a new subprocessor by updating that list before the subprocessor begins processing Customer Personal Data. You may object on reasonable data protection grounds within 30 days of the notice. If we cannot resolve the objection, you may terminate the affected part of the service.

We require each subprocessor to protect Customer Personal Data under written terms consistent with Data Protection Laws, and we remain responsible for their performance.

Our agreements with AI model providers prohibit them from using Customer Personal Data to train or improve their models. We do not use Google user data to train any AI or machine-learning model.

If we receive a request from a data subject about Customer Personal Data, we will direct them to you. Taking into account the nature of the processing, we will help you respond to data subject requests through the features of Oasis and, where those are not enough, by reasonable additional assistance.

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Our notice will describe the breach, its likely consequences, and the measures we have taken or propose to take, as that information becomes available.

We will provide reasonable information to help you carry out data protection impact assessments and prior consultations with supervisory authorities that relate to your use of Oasis.

When the agreement ends, or when you delete data or ask us to, we delete Customer Personal Data within 90 days, unless the law requires us to keep it.

You may agree a different retention period with us in writing. Contact us to discuss zero data retention.

We will make available the information reasonably needed to demonstrate compliance with this DPA, including security documentation available at trust.joinoasis.com.

If that information is not enough to meet a requirement of Data Protection Laws or a supervisory authority, we will work with you in good faith to provide further information.

We may process Customer Personal Data in the United States and in other countries where we or our subprocessors operate.

For transfers of Customer Personal Data from the European Economic Area that are not covered by an adequacy decision, the SCCs are incorporated into this DPA: Module Two where you are a controller and Module Three where you are a processor. Clause 7 applies; under Clause 9 option 2 applies with the notice period in section 6; the optional language in Clause 11 does not apply; under Clause 17 and Clause 18 the law and courts of Ireland apply. Annexes I and II of this DPA complete the SCC annexes.

For transfers from the United Kingdom, the SCCs apply as amended by the UK International Data Transfer Addendum. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the competent authority is the Swiss Federal Data Protection and Information Commissioner.

We will not sell or share Customer Personal Data, retain, use, or disclose it outside our direct business relationship with you or for any purpose other than providing Oasis, or combine it with personal information we receive from others, except as the CCPA permits.

Each party's liability under this DPA is subject to the limitations of liability in the agreement.

If this DPA conflicts with the agreement, this DPA controls for the processing of Customer Personal Data. If the SCCs conflict with this DPA, the SCCs control.

Data exporter: Customer. Data importer: Mercury Intelligence Inc., privacy@joinoasis.com.

Subject matter and purpose: providing Oasis, including AI agents, rooms, documents, workspace memory, and integrations with services you connect, as described in the agreement.

Nature of processing: collection, storage, organization, retrieval, analysis, transmission, and deletion of data as needed to provide Oasis and carry out your instructions.

Data subjects: your members and users, and people whose personal data appears in content you submit or in services you connect, such as email correspondents, meeting attendees, and customer or business contacts.

Categories of personal data: names, contact details, account identifiers, job and organization information, and the contents of messages, email, calendar events, documents, and other content you submit or connect. We do not intend to process special categories of personal data; any such data in content you submit is processed only as part of that content.

Frequency and duration: continuous, for the term of the agreement and the deletion period in section 10.

Encryption of Customer Personal Data in transit and at rest.

Authentication and authorization controls that limit access to authorized users and services, including organization membership checks before access to organization-scoped resources.

Least-privilege access for our personnel.

Logging and monitoring of production systems, and a process for responding to security incidents.

Restrictions on human access to Google user data, as described in our Privacy Policy.

Contractual no-training obligations for AI model providers.

More detail on our security program is available at trust.joinoasis.com.

Our current subprocessor list is maintained at trust.joinoasis.com.