Topiq Data Processing Addendum

1. Incorporation and roles

This Addendum incorporates by reference the Common Paper Data Processing Agreement Standard Terms, current version posted at https://commonpaper.com/standards/data-processing-agreement/ as of the Effective Date (the "DPA Standard Terms"). This Addendum is the Cover Page for those terms and controls over them if they conflict. It also controls over the Agreement as to Personal Data. It applies whenever Customer Content includes Personal Data, regardless of where data subjects are located; where the GDPR, UK GDPR or CCPA/CPRA applies, the corresponding provisions of the DPA Standard Terms apply, including the EU Standard Contractual Clauses (Module 2) and the UK Addendum for transfers out of the EEA or UK.

Customer is the controller (or business under the CCPA) of Personal Data in Customer Content, including Personal Data about individuals who are not Users. Basiq is Customer's processor (service provider) and processes Personal Data only on Customer's documented instructions, which consist of the Agreement, this Addendum, and the configuration and actions Users take in the Cloud Service, including the Connected Services they authorize.

2. Key Terms

Term	Value
Subprocessor notice	Customer authorizes Basiq to use the subprocessors listed in Annex 3 and, without advance notice, any additional or replacement provider in the categories of (a) AI model inference and orchestration, (b) meeting recording and transcription, and (c) cloud hosting and infrastructure, provided the provider is bound by written terms at least as protective as this Addendum, does not use Customer Content to train models, and processes Customer Content in the United States. Basiq keeps the current list at gettopiq.ai/subprocessors and updates it within 30 days of a change. For a new subprocessor outside those categories, Basiq will notify Customer's Notice Address at least 30 days in advance; Customer may object on reasonable data-protection grounds within that period, and if the objection is unresolved, may terminate the affected subscription and receive a prorated refund of prepaid Fees.
Breach notification	Basiq will notify Customer without undue delay, and in any event within 72 hours after confirming a Personal Data Breach affecting Customer's data.
Deletion after termination	As stated in Section E of the Topiq Terms of Service.
Data subject requests	Basiq will forward to Customer, without responding, any request Basiq receives directly from a data subject, and will assist Customer with access, export and erasure requests on written request within 30 days.
Audit	On reasonable written request no more than once per 12 months, Basiq will provide its current security documentation and answer a written security questionnaire. On-site or third-party audits only where required by Applicable Data Protection Laws or a regulator, at Customer's cost, on 30 days notice. Basiq does not currently hold third-party security certifications.
Governing Law	As in the Agreement, except where the Standard Contractual Clauses require otherwise.

Annex 1: Details of processing

Nature and purpose. Providing the Cloud Service: connecting to Customer's email, calendar, meeting, CRM and prospecting tools; capturing and transcribing meetings; storing and organizing account, contact and communication records; generating summaries, drafts, scores and recommendations with third-party AI models; sending communications on Users' instruction; and related support, security and billing.

Data subjects and categories.

Data subjects	Categories of Personal Data
Customer's own personnel (Users)	Name, business email, identity-provider subject ID (Google or Microsoft), workspace role, OAuth tokens for Connected Services, IP address and activity in audit logs. No passwords are stored; sign-in is by single sign-on only.
Customer's prospects, customers, partners and other business contacts	Name, business and personal email, phone, job title, employer, LinkedIn profile URL and public profile data, location, notes and interaction history written by Users, data returned by enrichment services Customer connects, inbound and outbound email and message content, and CRM record data synchronized from any CRM Customer connects.
Meeting participants	Name and email from calendar invites, speaker-attributed transcript text, meeting title and time, and automated per-participant indicators generated from the transcript. Audio and video are processed by the recording subprocessor.

Special categories and Prohibited Data. Not intended and not permitted by the Agreement. Basiq does not filter Connected Service content; if such data appears in a connected inbox or transcript it is processed as Customer Content under Customer's instructions and responsibility.

Duration. The term of the Agreement, plus the deletion periods in Section E of the Topiq Terms of Service.

Annex 2: Technical and organizational measures

Basiq hosts the Cloud Service on Amazon Web Services, primarily in the United States. Basiq will use commercially reasonable efforts to secure the Cloud Service from unauthorized access, alteration or use, including logical separation of each Customer's workspace, encryption of Connected Service credentials, role-based access control, and restriction of production access to named Basiq personnel bound by confidentiality obligations, or substantially equivalent or better measures. On request, Basiq will provide a current written overview of its security practices.

Annex 3: Subprocessors

3.1 Basiq subprocessors (Basiq's own accounts; process Customer Content for all workspaces; additions and replacements governed by the Subprocessor notice term in Section 2).

Subprocessor	Purpose	Data	Location
Amazon Web Services	Hosting, storage, backups, logging	All Customer Content	US
Anthropic	Large language model inference	Transcript, email and message text and record context sent in prompts	US
OpenAI	Large language model inference for specific workflows	Same as above, for those workflows	US
Musal (affiliate of Basiq)	Prompt orchestration and model routing to the providers above	Prompt content as above	US
Recall.ai	Meeting notetaker, recording and transcription	Meeting audio/video (transient), participant names, transcript	US
Stripe	Invoicing and payment processing	Billing contact and payment details (held by Stripe)	US

3.2 Connected Services authorized by Customer (Customer's own accounts and credentials; governed by Customer's agreements with those providers; disconnectable by Customer at any time). Any CRM, prospecting, enrichment or other service Customer connects from the list in the Documentation, such as Salesforce or HubSpot.

3.3 Connected Services authorized by individual Users (the individual's own identity; revocable by that User at any time). Google Calendar and Gmail, Microsoft 365 and Teams, Zoom. Basiq never uses one User's credential to access another User's data.