SkyeBrowse Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Master Services Agreement at https://www.skyebrowse.com/msa, or any other written agreement covering the Services, between Customer and SkyeBrowse, Inc. ("Company") (the "Agreement"). Capitalized terms not defined in this DPA have the meanings given in the Agreement. This DPA applies whenever Company Processes Customer Personal Data that is subject to Data Protection Law, including personal data from the European Economic Area ("EEA"), the United Kingdom or Switzerland.

1. Definitions and Scope

1.1. Definitions. "Data Protection Law" means all privacy and data protection laws that apply to the Processing of Customer Personal Data under the Agreement, including Regulation (EU) 2016/679 (the "GDPR"), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act (the "CCPA"). "Customer Personal Data" means personal data contained in Customer Content, and personal data about Users that Company Processes on Customer's behalf to provide the Services. "Process", "Processing", "controller", "processor", "data subject" and "personal data" have the meanings given in Data Protection Law.

1.2. Roles of the Parties. Customer is the controller of Customer Personal Data and Company is its processor, except as stated in Section 1.3. Each party will comply with its obligations under Data Protection Law.

1.3. Training-Eligible Content. Section 7.4 of the Agreement licenses Company to use Training-Eligible Content (Customer Content uploaded under Free Trial Services or under any subscription other than Public Safety & Enterprise) and Generated Data derived from it to develop, train, evaluate and improve artificial intelligence and machine learning models, and to make it available to third parties for those purposes. For those uses only, Company acts as an independent controller. Before making Training-Eligible Content available to a third party, Company will remove account identifiers and use commercially reasonable measures to blur or remove faces and license plates. Customer may opt out of third-party licensing of its future uploads by emailing info@skyebrowse.com. Customer is responsible for having a lawful basis for, and giving any notices required for, this use. Customers that require processor-only handling of all Customer Content should use a Public Safety & Enterprise subscription, for which Section 7.5 of the Agreement applies and Company does not use Customer Content to train models or disclose it to third parties except as required to provide the Services, as directed by Customer, or as required by law.

1.4. Company Account Data. Company's Processing of account, billing, support and website usage information for its own business purposes, such as billing, security, analytics and marketing, is governed by Company's Privacy Policy at https://www.skyebrowse.com/privacy-policy. Company acts as a controller for that Processing.

1.5. Scope of Processing. The subject matter, nature and purpose of the Processing, the types of Customer Personal Data and the categories of data subjects are described in Schedule I.

1.6. Order of Precedence. If this DPA conflicts with the Agreement regarding the Processing of Customer Personal Data, this DPA controls to the extent of the conflict, and Sections 7.4 and 7.5 of the Agreement apply as described in Section 1.3. Where the Standard Contractual Clauses apply under Section 7, they control over both.

2. Processing of Customer Personal Data

2.1. Documented Instructions. Company will Process Customer Personal Data only to provide the Services and in accordance with Customer's documented instructions, which are set out in the Agreement, this DPA, Customer's configuration and use of the Services, or other written instructions agreed by Company ("Documented Instructions"). Company will inform Customer if it believes an instruction infringes Data Protection Law, and, unless the law prohibits it, if Company is legally required to Process Customer Personal Data other than under the Documented Instructions.

2.2. Confidentiality. Company will ensure that personnel authorized to Process Customer Personal Data are bound by appropriate obligations of confidentiality.

2.3. CCPA. To the extent the CCPA applies, Company is a "service provider" for the Customer Personal Data it Processes as a processor and will not (a) "sell" or "share" it (as those terms are defined in the CCPA), (b) retain, use or disclose it for any purpose other than providing the Services under the Documented Instructions, (c) retain, use or disclose it outside the direct business relationship between Customer and Company, or (d) combine it with personal information received from other sources, except as the CCPA permits.

2.4. Customer Responsibilities. Customer is responsible for the lawfulness of the Customer Personal Data it provides, including giving required notices and obtaining required consents from individuals who appear in uploaded video, images and 3D models, and for ensuring its instructions comply with Data Protection Law.

3. Subprocessors

3.1. Authorization. Customer gives general authorization for Company to engage the subprocessors listed in Schedule II. Company will enter into a written agreement with each subprocessor imposing data protection obligations substantially as protective as this DPA, to the extent applicable to the services it provides, and remains responsible for its subprocessors' Processing of Customer Personal Data, subject to the limitation of liability in the Agreement.

3.2. New Subprocessors. Company will update Schedule II at least 15 days before a new subprocessor begins Processing Customer Personal Data. Customer may object on reasonable data protection grounds by written notice to info@skyebrowse.com within that period, and the parties will work together in good faith to address the objection.

3.3. Third Party Services. Third Party Services that Customer chooses to connect or export data to, such as Axon Evidence.com, are not Company subprocessors. Section 5 of the Agreement governs them.

4. Assistance

4.1. Data Subject Requests. Company will promptly forward to Customer any request it receives from a data subject relating to Customer Personal Data, advise the data subject to submit the request to Customer, and provide reasonable assistance so Customer can respond as required by Data Protection Law.

4.2. Cooperation. Taking into account the nature of the Processing and the information available to it, Company will provide reasonable assistance with Customer's data protection impact assessments and any required consultations with supervisory authorities. Company may charge a reasonable fee for assistance beyond what the Services provide.

5. Security

5.1. Security Measures. Company maintains the administrative, physical and technical safeguards described in Section 3.2 of the Agreement and in Schedule I, Section 11 ("Security Measures"). Company may update the Security Measures provided the updates do not materially decrease the overall security of the Services.

5.2. Security Incidents. Company will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data ("Security Incident"). Company will provide the information reasonably available to it to help Customer meet its own notification obligations, and will take reasonable steps to investigate, contain and remediate the Security Incident.

5.3. Audits. On Customer's written request, no more than once every 12 months, Company will make available the information reasonably necessary to demonstrate compliance with this DPA, including written responses to security questionnaires. If that information is not sufficient to meet a requirement of Data Protection Law, Customer, or an independent auditor bound by confidentiality, may audit Company's controls applicable to Customer Personal Data at Customer's cost, during normal business hours, with reasonable advance notice, in a manner that minimizes disruption, and under a scope agreed in advance.

6. Return and Deletion

On termination or expiration of the Agreement, Customer may export Customer Content as described in Section 3.2(b) of the Agreement. After that export period, Company will delete or anonymize Customer Personal Data within 90 days, except to the extent Data Protection Law or other applicable law requires Company to retain it, and except for Training-Eligible Content already licensed under Section 1.3 before the deletion.

7. International Data Transfers

7.1. Location. Company stores and Processes Customer Personal Data in the United States. Customer authorizes the transfer of Customer Personal Data to the United States and to the subprocessors in Schedule II.

7.2. EU Transfers. For transfers of Customer Personal Data from the EEA, Customer and Company conclude Module 2 (controller to processor) of the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced from time to time (the "EU SCCs"), and, where Customer is itself a processor for a third-party controller, Module 3 (processor to processor). The EU SCCs are incorporated by reference and completed as follows: (a) the data exporter is Customer and the data importer is Company; (b) the optional docking clause in Clause 7 applies; (c) Option 2 of Clause 9(a) applies, with the notice period in Section 3.2; (d) the optional redress language in Clause 11(a) does not apply; (e) Option 1 of Clause 17 applies, and the governing law is the law of Ireland; (f) the courts referred to in Clause 18(b) are the courts of Dublin, Ireland; and (g) Annexes I and II are completed by Schedule I of this DPA, and Annex III by Schedule II.

7.3. UK Transfers. For transfers from the United Kingdom, the parties conclude the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022, as amended) (the "UK Addendum"), completed as follows: (a) in Table 1, the exporter is Customer and the importer is Company, with details as set out in this DPA and the Agreement; (b) in Table 2, the Approved EU SCCs are the EU SCCs as completed in Section 7.2; (c) in Table 3, the Appendix Information is set out in Schedules I and II; and (d) in Table 4, either party may end the UK Addendum.

7.4. Swiss Transfers. For transfers from Switzerland, the EU SCCs apply as completed in Section 7.2, with references to the GDPR read as references to the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and data subjects in Switzerland able to bring claims in the courts of Switzerland.

Schedule I: Description of Processing

1. Parties. Data exporter: Customer, which uses the Services as described in the Agreement; role: controller (or processor on behalf of a third-party controller). Data importer: SkyeBrowse, Inc., which provides the Services and Processes Customer Personal Data on Customer's behalf; role: processor. Contact for both: as set out in the Agreement and Customer's account.

2. Categories of Data Subjects. Customer's Users; and individuals who appear in, or are identifiable from, Customer Content, such as people at a scene captured in video, images or 3D models.

3. Categories of Personal Data. User account details (name, email address, organization, role); Customer Content, including video, images, drone flight logs and GPS data, 3D models, orthomosaic maps, measurements, annotations, notes and case information; and data derived from it, such as images of people, vehicles and license plates and location data.

4. Sensitive Data. Customer Content may include data relating to criminal offences or incidents, or images from which special categories of data could be inferred. Safeguards: access limited to authorized personnel; Public Safety & Enterprise content is processed in Company's CJIS-compliant environment on AWS GovCloud (US) and is not used for model training (Section 7.5 of the Agreement).

5. Frequency of Transfer. Continuous, for as long as Customer uses the Services.

6. Nature of the Processing. Hosting and storage; processing uploaded video into 3D models and maps on Company-operated processing servers and cloud infrastructure in the United States; display, measurement and sharing as directed by Customer; AI-assisted features when a User runs them; support.

7. Purpose of the Transfer and Processing. Providing the Services to Customer as described in the Agreement and this DPA.

8. Duration. The term of the Agreement plus the export and deletion periods in Section 6.

9. Subprocessor Transfers. As listed in Schedule II, for the subject matter and nature described there, for the duration of the Agreement.

10. Competent Supervisory Authority. For data subjects in the EEA, the Data Protection Commission of Ireland; in the United Kingdom, the UK Information Commissioner; in Switzerland, the Swiss Federal Data Protection and Information Commissioner.

11. Technical and Organizational Measures. Authentication through Amazon Cognito with multi-factor authentication available; role-based access within customer organizations; encryption of data in transit with TLS; Customer Content stored in Amazon S3 with encryption at rest; access to production systems limited to authorized personnel; Public Safety & Enterprise content processed in a CJIS-compliant environment on AWS GovCloud (US); logging and monitoring of production systems.

Schedule II: Subprocessors

Amazon Web Services, Inc. (United States): cloud hosting, storage, databases, authentication, email delivery, and processing infrastructure.

Google LLC, Gemini API (United States): AI-assisted analysis that a User chooses to run, such as Crush & Claims Analysis photo assessments and AI-drafted factual descriptions.

Hugging Face, Inc. (United States): hosting of the Labs tools (such as 3D AI and Crowd Counter) when a User uploads images to them.

CarAPI (United States): vehicle specification lookup by year, make, model, VIN or license plate when a User runs a vehicle lookup.

Last Updated 10/20/26