Data Processing Addendum

1. Parties, application and definitions

This Data Processing Addendum ("DPA") forms part of the Agreement between פרסום מי סטודיו לעיצוב גרפי והפקות דפוס בע"מ, trading as Chat4U, and the Customer identified by the accepted project agreement or applicable Order. It applies when Chat4U processes personal data on the Customer's behalf, including where the Customer is itself a processor for another controller. Its acceptance, project scope and effective time follow the Terms; publication alone does not amend an earlier agreement or retrospectively authorize processing.

"Customer Personal Data" means personal data supplied, collected or generated through the Service for the Customer's purposes, including the content and linked metadata described in Annex A. "Data Protection Law" means privacy, data-protection and security law applicable to that processing, including the EU GDPR, UK GDPR and Data Protection Act, applicable Israeli law, Swiss law and applicable United States state privacy laws. "Controller", "processor", "personal data", "processing", "data subject" and "personal data breach" carry their meanings under the applicable law. A subprocessor processes Customer Personal Data on Chat4U's behalf. A restricted transfer is a transfer requiring additional safeguards under applicable Data Protection Law.

2. Roles and precedence

The Customer determines the purposes and permitted use of Customer Personal Data. Chat4U acts as processor or subprocessor for that processing. If the Customer acts for another controller, it must have authority to give the relevant instructions and appoint Chat4U; the Customer remains our instruction contact without removing the underlying controller's legal rights.

Chat4U separately acts as controller for necessary account administration, billing, legal acceptance, its own support relationship, and defined security and operational purposes explained in the Privacy Policy. That classification depends on the purpose and actual processing. It does not allow Chat4U to extract conversations, identifiers, derived analysis or customer content from this DPA by relabelling them telemetry, usage data or de-identified data. Linkable or pseudonymous information remains personal data. Independent uses need their own lawful basis, notice and safeguards.

This DPA prevails over conflicting Agreement provisions concerning processing on the Customer's behalf. An applicable mandatory transfer instrument prevails within its scope. The common contractual liability provisions in Terms section 17 apply to this DPA to the extent lawful; this DPA does not create an additional cap or diminish a data subject's or regulator's rights.

3. Instructions and permitted processing

Chat4U will process Customer Personal Data only on documented instructions, including for international transfers, to provide the agreed Service. The Agreement, Annex A, enabled configuration and authorized requests constitute those instructions. Further instructions may be given through the supported controls or privacy@chat4u.ai. We will clarify an ambiguous instruction before taking an action whose scope or authority cannot reasonably be established.

Instructions cover hosting, ingestion, indexing, retrieval, AI responses, agreed analysis, supported integrations and tools, secure administration, troubleshooting and deletion necessary for the selected services. They do not authorize unrelated advertising, sale of personal data, cross-customer content reuse or shared-model training.

We will immediately inform the Customer if, in our opinion, an instruction infringes applicable Data Protection Law and will not implement an unlawful instruction. If processing outside instructions is required by law binding on us, we will give advance notice unless legally prohibited and limit it to what is required. Where the GDPR applies, its restrictions on the legal grounds for such compelled processing and any third-country disclosure also apply; a foreign demand does not automatically override them.

The Customer is responsible for lawful collection, appropriate notices, the necessary lawful basis and valid instructions, including authority over its sources and integrations. Chat4U remains responsible for its own obligations; an instruction cannot excuse a breach by Chat4U.

4. Confidentiality and access

Chat4U will restrict access to authorized persons who need it for the permitted processing and are bound by contractual or statutory confidentiality. Access will be proportionate to the task and revoked when no longer needed. We will protect Customer Personal Data under this DPA during any lawful retention after the service ends. The Customer controls its own staff and integration permissions; those permissions do not authorize unrestricted access by Chat4U personnel.

Where regulation 15 of the Israeli Privacy Protection (Data Security) Regulations, 2017 applies to the relevant outsourcing arrangement, Chat4U will obtain the required signed undertakings from its authorized persons covering confidentiality, use of the information only as permitted by the applicable agreement, and implementation of the security measures specified in that agreement. An employment or contractor agreement may supply those undertakings if it contains the required commitments; an appropriate statutory confidentiality duty alone does not replace them.

5. Security measures

Taking account of the nature, scope, context, risks and purposes of processing, the state of the art and implementation costs, Chat4U will implement and maintain appropriate technical and organizational measures, including the applicable measures in Annex B. These address confidentiality, integrity, availability and resilience, recovery following an incident, and assessment of the effectiveness of safeguards.

Measures may evolve without materially reducing the overall protection of Customer Personal Data. Chat4U remains responsible for its applicable security duties notwithstanding a supplier limitation or the absence of a certification. The measures do not guarantee that every attack, error or interruption will be prevented.

6. Subprocessors: authorization, notice and objections

6.1 Existing authorization and supplier responsibility

The Customer gives general written authorization for the subprocessors disclosed for the relevant services in the Subprocessor List when this DPA is accepted, subject to this section for additions and replacements. Listing a possible provider does not authorize every data category or a purpose unrelated to the selected Service.

Before the relevant authorization, Chat4U will make available the supplier identities, purposes, processing locations and information about further processors necessary for the Customer to assess the relevant processing chain. The Subprocessor List and any necessary supplementary schedule delivered through the existing account or agreed contact route provide that information; a separate request is not a prerequisite. Proportionate confidentiality safeguards may govern sensitive details without withholding information necessary for the Customer's compliance. Additions and replacements remain subject to the notice and objection process below.

Before giving access, Chat4U will assess the subprocessor's ability to protect the data and bind it to written obligations providing the required protection for its work, including confidentiality, instructions, security, assistance, deletion and applicable transfer safeguards. Chat4U remains responsible to the Customer for the subprocessor's performance of those obligations.

For downstream arrangements to which regulation 15 of the Israeli Privacy Protection (Data Security) Regulations applies, the written terms will include the matters required by that regulation, including the authorized-person undertakings and reporting obligations described in sections 4 and 11.

6.2 Change notice

For an ordinary addition or replacement, we will give at least 14 calendar days' advance notice before the new subprocessor processes affected Customer Personal Data. The notice will identify the supplier, processing purpose, relevant data, processing location information, proposed start and how to object. We will directly notify customer account owners by default. A narrower recipient group may be used only where reliable records establish who is affected, including reasonably expected routing and retained data. Merely posting an updated list is not the direct notice.

6.3 Reasoned objections and protected processing

The Customer may send a reasoned data-protection objection to support@chat4u.ai during the notice period. No special form, lawyer's letter or expert report is required. We may seek relevant clarification, but will not treat that exchange as permission to send the Customer's data to the disputed supplier.

We will make commercially reasonable efforts to address a reasonable objection through safeguards, an available alternative or a configuration adjustment. We do not promise a custom integration, unlimited expenditure or indefinite continuation of the old supplier. We will respond promptly within a reasonable period, and will not give the disputed supplier the affected Customer's data while the objection remains unresolved. If existing authorized processing cannot continue, we will pause the affected processing. Unaffected processing may continue where lawful.

If no workable solution is available when the change is due, either party may end the affected service without an early-termination fee or remaining-term charges. Any agreed extension preserves the restriction on disputed data access. The exit covers the affected component or project where separable, or the relevant subscription as a whole if materially unusable. Chat4U will refund unused prepaid service and unusable separately purchased credits at their actual paid value, including paid unavailability from the start of a protective pause, under Refund Policy section 4. Consumed service and free credits are not refunded, and the same value is not counted twice. The damages cap does not reduce this refund.

6.4 Urgent circumstances

An emergency does not create a blanket right to bypass notice or an outstanding objection. We will use a suitable already authorized route or pause affected processing. Earlier use of a new subprocessor requires valid specific prior authorization from the affected Customer where legally sufficient, together with all necessary security and transfer safeguards. These arrangements do not promise multiple continuously available providers or eliminate a statutory requirement.

7. International processing and transfers

Processing may take place in Israel and the countries relevant to the selected suppliers. We do not promise that all processing or support remains in the EU or a single hosting region. We will identify applicable locations and safeguards in the supplier information and provide further transfer information on request, subject to proportionate confidentiality protection.

Before a restricted transfer, the responsible parties will establish a valid mechanism and complete the required terms, annexes, role selection and any necessary transfer assessment or supplementary measures. An applicable adequacy decision may cover a particular destination and flow; it does not automatically cover onward transfers. Where required, safeguards may include the EU standard contractual clauses adopted by Decision 2021/914 with the applicable modules, an appropriate UK mechanism, and necessary Swiss adaptations.

Chat4U will maintain evidence of the applicable transfer arrangements and provide relevant information and copies of safeguards on request, subject to lawful protection of confidential information. If a required safeguard can no longer be met, we will take the action required by the applicable instrument and law, including suspension where necessary. A mandatory transfer instrument's jurisdiction, third-party rights and liability provisions retain their required precedence.

8. Individual requests and customer assistance

Taking account of the processing and information available to us, we will assist the Customer with access, correction, erasure, restriction, portability, objections, other applicable rights and legally required handling of data-protection complaints. Supported controls, standard exports, secure support and, where needed, scoped manual handling provide that assistance. It includes relevant conversation analysis, linked media and downstream copies within the applicable request scope, not only the visible message row.

Where a request or complaint concerns Customer Personal Data, we will notify the relevant Customer without undue delay and coordinate the response under its documented instructions and applicable law. We will not disclose data to an unverified requester or treat an unanswered customer message as authorization for disclosure or erasure. We will not require a requester to restart a valid request through another channel. We handle our own controller data separately and coordinate mixed requests. Applicable legal deadlines are not extended simply because the parties need to coordinate.

For unnamed chats, a website, approximate time, safe reference or limited excerpt may help locate a conversation. Locating it does not itself prove authority to disclose or erase all its contents. Checks will be proportionate to the action, available evidence and risks to other people; passports and new accounts are not routine requirements. The contextual conversation-deletion request supplies a reference securely and enters the same verified request process; it is not an immediate erase command.

We will also provide relevant information and reasonable assistance for security duties, incident response, impact assessments and legally required prior consultation. The Customer retains its controller decisions; Chat4U remains responsible for its own duties.

Ordinary privacy and security assistance is included. Substantial custom business work may be subject to reasonable charges agreed in advance for a defined scope. Fee discussions, a plan limit or lack of a self-service feature will not obstruct required assistance or individual rights. We bear the cost of correcting our own failure to meet existing obligations, without promising reimbursement of every outside adviser or auditor expense.

9. Personal data breaches

Chat4U will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. We will not wait for a final investigation or root-cause conclusion. The initial notice will give available information about the nature of the breach, affected data and people, likely consequences, measures taken or proposed, and a contact route. Missing information will follow in phases without undue further delay.

We will take appropriate containment and remediation steps, preserve relevant evidence and assist the Customer with required assessment and notifications. Customer, regulator, affected-person and provider notices have distinct duties and clocks. A notification or assistance is not, by itself, an admission of fault, without reducing actual responsibility or required remedies. No additional fixed hourly customer-response guarantee is created.

For covered Shopify Merchant Data, Chat4U will make the separately required Shopify report immediately and no later than 24 hours after awareness of an actual or suspected breach or compromise, under the applicable Shopify terms. That report does not replace a notice to the Customer or another required recipient.

10. Return, deletion and copies

At the end of the relevant processing service, the Customer may choose return or deletion of Customer Personal Data. Chat4U will provide a standard structured, commonly used, machine-readable copy and necessary secure assistance for required scope, or delete it, as instructed. Following return we will delete remaining service copies unless applicable law requires storage, subject to the distinct lawful retrieval arrangement below. Valid requests during the service are handled under the same applicable duties. A missing dashboard button or export-size limit is not a reason to deny a required return.

For a covered service-switching request, the Data Export and Switching Schedule provides the transition and post-transition retrieval process. Necessary lawful retrieval processing remains within documented instructions and this DPA, with personal-data rights and applicable law controlling an actual conflict. A completed transfer does not, by itself, erase an applicable retrieval right. An instruction to delete instead is assessed separately; no retrieval period delays a valid earlier erasure duty. This does not permit retaining all service content under an accounting, security or backup label.

Any exception for legally required storage is subject to section 3. For processing governed by EU GDPR Article 28(3)(g), that exception is limited to storage required by Union or Member State law; a third-country requirement does not itself establish that exception.

Legally retained data will be limited to the relevant records and purpose, protected and inaccessible for unrelated use, and deleted when the ground ends. Where lawful, we will explain the categories, grounds and applicable timing. Independent accounting or contract evidence does not justify retaining unrelated conversation or store data.

Deletion includes appropriate instructions to our processors and attention to derived records, media and exports. Backup copies awaiting lawful, bounded expiry are isolated from ordinary use; restoration must reapply erasure before deleted information becomes available. We distinguish access revocation, pending cleanup and verified completion. Backup convenience cannot extend a stricter legal or provider deadline.

Covered Shopify Merchant Data, including copies, must be deleted within 30 days of the applicable trigger: uninstall, no further necessity for the relevant service, or an enforceable deletion request, except where applicable law prohibits or varies that deletion. Waiting for a later webhook does not restart the period. A keep-history preference applies only to information lawfully outside the required cleanup. If unable to comply, Chat4U will make the notification required by Shopify's terms.

The Customer's native WordPress/WooCommerce orders, host and mail records are separate. We assist with Chat4U-specific store-side records and explain any merchant action needed when the plugin cannot be reached. We do not call unreachable host copies erased or treat them as an excuse for failing to handle our own copies. The Retention Schedule explains the category rules and technical expiry separately from deletion.

11. Compliance information and audits

Chat4U will make available information necessary to demonstrate compliance and allow and contribute to audits, including necessary inspections by the Customer or its mandated independent auditor, as required by applicable law. Start with relevant documents, questionnaires and remote review where adequate; those routes do not extinguish a necessary inspection right.

Where regulation 15 of the Israeli Privacy Protection (Data Security) Regulations, 2017 applies to the relevant outsourcing arrangement, Chat4U will report at least annually to the relevant database controller on its performance of the applicable obligations under those Regulations and this DPA. We will deliver the report through the existing account or other agreed contact route without requiring a separate request. Where the Customer acts for another controller, the parties will arrange delivery to that controller through the Customer or directly where required. This periodic report is distinct from incident notification and does not promise an independent external audit or certification.

The parties will arrange proportionate scope, reasonable notice, confidentiality and safe access, protecting other customers and service security. Arrangements will accommodate urgent incidents and regulator requirements. Where a requested disclosure creates a concrete confidentiality or security risk, we will cooperate on an effective alternative rather than use confidentiality as a blanket refusal. No certification, fixed annual audit limit, additional notice minimum or audit-completion guarantee is implied. Section 8's assistance and cost rules apply.

12. United States state privacy terms

Where Chat4U is a processor, service provider or contractor under an applicable state privacy law, processing is limited to the specific service purposes and instructions in this DPA and Annex A. Chat4U will not sell the relevant personal information, share it for cross-context behavioral advertising, retain, use or disclose it outside those purposes or the direct business relationship, or combine it with information from other sources except as that law expressly permits. General instructions do not waive these restrictions.

Chat4U will provide the required level of protection, comply with applicable obligations, and notify the Customer if it can no longer do so. The Customer may take reasonable and appropriate measures to verify compliant use and, upon notice, stop and remediate unauthorized use. Chat4U will cooperate with that process and impose required written restrictions on permitted downstream processors. Chat4U certifies that it understands and will comply with these restrictions where the applicable law requires that certification. Nothing prevents mandatory individual rights, regulator oversight or remedies.

These terms apply to the qualifying relationship; they do not claim every Customer meets every state's statutory threshold. For Chat4U's independent controller processing, the Privacy Policy and applicable law govern separately.

Annex A — Processing particulars

Subject and duration. Provision of the selected Chat4U services for the applicable project, continuing only for the instructed service and the lawful, limited return, deletion or retention work described above. Storage beyond termination is not authorized for unspecified future improvement.

People concerned. Website and demo visitors; the Customer's personnel, customers and prospective customers; individuals appearing in authorized source material; store shoppers, verified order holders and lead submitters; participants in enabled social or support conversations; and authorized account users where processing is on the Customer's behalf.

Sensitive information. The standard service is not offered for child-directed or specialist regulated-data workflows. The AUP's restricted-use rules apply. Unexpected disclosures are handled proportionately and remain protected; they are not authorization for further sensitive processing. Any supported specialist exception requires a separately signed agreement with its own verified safeguards. It cannot override a legal or supplier prohibition.

Annex B — Applicable technical and organizational measures

Chat4U will apply the following measures to systems it operates for Customer Personal Data:

1. Authenticated administrative access, role and resource authorization, least-privilege operational access, and revocation when access is no longer necessary.
2. Logical project/workspace scoping in shared infrastructure, including retrieval, tool execution, stored data and privacy actions. Dedicated physical infrastructure per customer is not promised.
3. TLS for public service transport; encryption at rest for managed primary databases and object storage; protected stored integration credentials; and controlled access to keys and secrets. This is not a claim that every internal network path or third-party endpoint uses identical encryption.
4. Minimized processing, appropriate input/output and tool controls, separation of native verification secrets from AI context, and protection against unauthorized or duplicate actions. AI filtering is not a guarantee of detection.
5. Appropriate operational/security logging and alerts, access restrictions, incident handling and distinct notification processes, with proportionate retention rather than unrestricted transcript logging.
6. Controlled source and deployment changes and risk-appropriate checking of security measures. No statement of universal test coverage, external certification or a staffed round-the-clock team is made.
7. Protected recovery copies, restricted restoration, reapplication of erasure, and scoped export/deletion workflows that track incomplete provider or host work before confirming completion.
8. Supplier authorization, written protection, scoped data transfers and handling of rights, audits, incidents and legally required retention.

The Security Measures notice explains these measures at a public level. Sensitive implementation details may be supplied through the controlled information/audit process. A future change to a notice cannot silently reduce this Annex's contractual protection.