Data Processing Agreement

• "CCPA" means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., as amended by CPRA.
• "Controller" means the natural or legal person that determines the purposes and means of Processing of Personal Data (here, Customer).
• "Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
• "EEA" means the European Economic Area.
• "GDPR" means Regulation (EU) 2016/679 (General Data Protection Regulation) and, where applicable, the UK GDPR.
• "Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable Data Protection Laws.
• "Personal Data Breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.
• "Processing" (and "Process", "Processed") means any operation performed on Personal Data, including collection, storage, retrieval, transmission, erasure, and destruction.
• "Processor" means the entity that Processes Personal Data on behalf of the Controller (here, Company).
• "Standard Contractual Clauses" or "SCCs" means the clauses adopted by the European Commission for the transfer of Personal Data to third countries.
• "Sub-processor" means any third party engaged by the Company to Process Personal Data on behalf of Customer.
• "Supervisory Authority" means the relevant data protection authority in the applicable jurisdiction.

Customer represents and warrants that: (a) it has a lawful basis for Processing and for instructing the Company to Process Personal Data; (b) it has provided all required notices to and obtained all required consents from Data Subjects; (c) it will comply with all applicable Data Protection Laws with respect to its Processing activities; and (d) it has the authority to enter into this DPA.

The Company shall notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Data, using commercially reasonable efforts to provide notice within seventy-two (72) hours. Initial notice may be provided before all information is available; the Company will supplement as details are confirmed. Such notice shall include, to the extent then known: (a) nature of the breach; (b) categories and approximate number of Data Subjects affected; (c) categories and approximate number of Personal Data records affected; (d) likely consequences; (e) measures taken or proposed to address the breach. The Company shall cooperate with Customer's reasonable investigation and remediation requests.

Upon expiry or termination of the MSA/Order Form, the Company shall, at Customer's election: (a) delete all Personal Data within thirty (30) days; or (b) return a copy to Customer in a machine-readable format within thirty (30) days, and delete all copies thereafter. The Company may retain Personal Data required by applicable law, for the duration required by such law only. For the avoidance of doubt, Personal Data may persist in encrypted, isolated backup archives for up to ninety (90) days following completion of active deletion; the Company will not actively access, process, or restore such backup data during this period and will purge it on its standard backup rotation schedule. This backup retention period does not affect Customer's rights or the Company's obligations under applicable Data Protection Law.

The Company shall: (a) maintain records of Processing activities as required by applicable Data Protection Laws; (b) make available to Customer all information reasonably necessary to demonstrate compliance with this DPA; and (c) upon Customer's written request and reasonable notice (not less than 30 days), contribute to audits of the Company's processing activities, no more than once per calendar year.

If the Company transfers Personal Data from the EEA, UK, or Switzerland to countries not deemed adequate by the European Commission or applicable authorities, such transfer shall be subject to: (a) the Standard Contractual Clauses (SCCs) adopted by the European Commission (as amended from time to time), incorporated herein by reference in the applicable module; or (b) another valid transfer mechanism under applicable Data Protection Law.

For UK transfers: the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs shall apply where required.

The Company's use of DeepSeek involves transfer of script and narration text to DeepSeek's servers located in China. China does not have an EU adequacy decision. Lenera AI relies on Standard Contractual Clauses where available, but acknowledges that the efficacy of SCCs for China transfers is subject to legal uncertainty. Customers with heightened data protection requirements in this regard should contact support@lenera.ai prior to use. D-ID processes data in Israel and the United States. Israel has an EU adequacy decision, and transfers to D-ID do not require SCCs for EEA transfers.

To the extent the CCPA applies: (a) the Company shall not sell or share Personal Data; (b) the Company shall not retain, use, or disclose Personal Data for any purpose other than the Services; (c) the Company shall provide the same level of privacy protection as required under the CCPA; and (d) the Company shall notify Customer if it determines it can no longer meet its CCPA obligations, and Customer may take reasonable steps to investigate, remediate, or stop the Processing.

This DPA shall be governed by the laws specified in the MSA, except that GDPR-related provisions shall be governed by the laws of the EU member state of Customer's primary establishment (if applicable) for the purposes of SCCs compliance.