Data Processing Agreement

• This Data Processing Agreement forms part of, and is incorporated by reference into, the Terms of Service (and any applicable Order Form) entered into between the Parties governing Clam's provision of the Services (the “Agreement”). In the event of a conflict between this DPA and the Agreement as regards the Processing of Personal Data, this DPA shall prevail. Capitalized terms not defined in this DPA have the meaning given to them in the Agreement.

1. Definitions and Interpretation

• "Agreement" means the Terms of Service between Clam and Customer under which Clam provides the Services, together with any applicable Order Form.
• "Applicable Data Protection Law" means any data protection or privacy law, regulation, or other legally binding instrument applicable to the Processing of Personal Data under this DPA, including the EU General Data Protection Regulation (Regulation (EU) 2016/679), the UK General Data Protection Regulation (as incorporated into UK law by the Data Protection Act 2018 and as amended), the California Consumer Privacy Act (as amended by the California Privacy Rights Act), and any other law that applies by reference to the location of the Data Subject, the Controller, or the Processor, as in force and as amended, replaced, or superseded from time to time.
• "Controller" means the entity that determines the purposes and means of the Processing of Personal Data.
• "Customer" means the party identified as such in the Agreement, being the entity (or, where applicable, individual) on whose behalf Clam Processes Customer Data.
• "Customer Data" means the Personal Data Processed by Clam on Customer's behalf in the course of providing the Services, as further described in Annex 1.
• "Data Subject" means an identified or identifiable natural person to whom Personal Data relates.
• "EEA" means the European Economic Area.
• "Personal Data" means any information relating to a Data Subject (including, under the CCPA, "personal information").
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
• "Processing" means any operation performed on Personal Data, whether or not by automated means.
• "Processor" means an entity that Processes Personal Data on behalf of, and under the instructions of, a Controller.
• "Restricted Transfer" means a transfer of Personal Data from the EEA (or another jurisdiction to which Applicable Data Protection Law extends equivalent protection) to a country not benefiting from an adequacy decision of the European Commission under Article 45 GDPR.
• "Services" means the Processing activity described in Clause 2.1 and Annex 1.
• "Standard Contractual Clauses or SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission under Commission Implementing Decision (EU) 2021/914, as amended, replaced or superseded from time to time.
• "Sub-processor" means any Processor engaged by Clam, or by another Sub-processor, to Process Customer Data in connection with the Services.
• "Supervisory Authority" has the meaning given in Article 4(21) GDPR.
• "Technical and Organisational Measures" means the measures described in Annex 3.

2. Processing Overview

2.1. Scope

• This DPA governs the Processing of Personal Data by Clam on Customer's behalf in connection with the Services — namely, Clam's provision of a Gmail-connected platform that classifies email and executes permissioned actions through a delegated AI agent ("Shell"). The nature, purpose, duration, categories of Data Subjects, and categories of Personal Data involved are described in detail in Annex 1.

2.2. Roles

• For the provision of its Services, Customer is the Controller of the Customer Data, and Clam Processes Customer Data solely as a Data Processor. As a Data Processor, Clam processes Personal Data solely to execute Customer's instructions, as reflected in Customer’s configuration within the product, and does not use Customer Data for any purpose of its own, including model training. Customer warrants that it has a lawful basis for the processing it instructs, that its instructions comply with applicable data protection law, and that it has provided, or will provide, all information required under the applicable legislation to the data subjects whose personal data is processed under this DPA.
• Where Customer itself acts as Processor on behalf of another Controller in respect of some or all of the Customer Data, Clam shall act as a Sub-Processor. When Clam acts as a Sub-Processor, Customer represents that it is authorized to give the instructions and grant the sub-processor authorizations set out in this DPA in respect of the Controller's Personal Data.
• When Processing Personal Data in regards to carrying out its own account-management and authentication purposes, billing, support correspondence, error-monitoring telemetry, marketing and analytics, Clam acts as independent Controller. That Processing is described in Clam's Privacy Policy, available on Clam’s official website, and does not fall within the scope of this DPA.

3. Processor Obligations

3.1. Instructions

• Clam shall Process Customer Data only on Customer's documented instructions, including as regards transfers of Personal Data to a third country, unless required to do otherwise by the applicable law; in such a case, Clam shall inform Customer of that legal requirement before Processing, unless the law prohibits such information on important grounds of public interest. Customer's instructions are given through the Agreement, this DPA, and Customer’s configuration within the product. If Clam considers that an instruction infringes Applicable Data Protection Law, it shall promptly inform Customer.

3.2. Confidentiality

• Clam shall ensure that persons authorized to Process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.3. Security

• Clam shall implement the Technical and Organisational Measures set out in Annex 3, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of Processing, and the risk to the rights and freedoms of natural persons.

3.4. Data Deletion

• On termination of the provision of the Service, Clam shall delete all Customer Data in accordance with the retention periods set out in Clause 7, unless the applicable law requires their continued storage.

4. Sub-processors

• 4.1. Customer grants Clam a general written authorization to engage the Sub-processors listed in Annex 2 for the purposes described there. Clam shall enter into a written agreement with each Sub-processor imposing data protection obligations equivalent to those set out in this DPA, in particular providing sufficient guarantees to implement appropriate Technical and Organisational Measures. Clam remains fully liable to Customer for the performance of each Sub-processor's obligations.
• 4.2. Where a prior notice is required by the applicable legislation for any change in its approved list of Sub-processors, Clam shall give Customer at least 15 days' prior notice of any intended addition or replacement of a Sub-processor, by notice to Customer's designated contact. Customer may object to such a change on reasonable data-protection grounds within that notice period; the Parties shall discuss the objection in good faith, and if it is not resolved, Customer may, as its sole remedy, terminate the affected Services without penalty.

5. International Transfers

• 5.1. Before any Restricted Transfer of Customer Data takes place, Clam shall ensure an appropriate transfer mechanism is in place — in particular the Standard Contractual Clauses, incorporated by reference as Annex 4 (Module Two: Controller to Processor, or Module Three: Processor to Processor, as applicable to the Sub-processor concerned) — together with such supplementary measures as Clam determines to be necessary following its transfer impact assessment for that Sub-processor.

6. Personal Data Breach

• 6.1. Clam shall notify Customer without undue delay, and in any event within 72 hours of becoming aware, after becoming aware of a Personal Data Breach affecting Customer Data.
• 6.2. The notification shall, to the extent the information is available to Clam, describe: the nature of the breach, including where possible the categories and approximate number of Data Subjects and Customer Data categories concerned; the likely consequences of the breach; and the measures taken or proposed to address the breach and mitigate its possible adverse effects; and shall identify a contact point for further information.

7. Retention and Deletion

• 7.1. Clam Processes Customer Data only for as long as necessary to provide the Services and shall delete or irreversibly anonymize Customer Data on the earliest of: (a) expiry or termination of the Agreement and any post-termination access window agreed by the Parties; (b) Customer's explicit deletion request; or (c) 90 days of account inactivity following expiry of Customer's trial or subscription, preceded by a prior warning to Customer.
• 7.2. Notwithstanding Clause 7.1, Clam may retain Customer Data beyond the periods described there, or following deletion or termination, solely to the extent and for so long as necessary to: (a) comply with a legal obligation to which Clam is subject; (b) establish, exercise, or defend legal claims; or (c) investigate suspected misuse of, or a security incident affecting, Clam's platform. For the limited purpose of this Clause 7.2, Clam Processes such retained data as an independent controller and not as Customer's Processor, and shall delete or anonymize it once it is no longer necessary for the purpose for which it was retained.

8. Audit and Information Rights

• On reasonable prior written notice, Clam shall make available to Customer such information as is reasonably necessary to demonstrate compliance with the applicable legislation, which Clam may satisfy by providing a current security and compliance summary, relevant certifications, or independent third-party audit reports, where available.

9. Data Subject Requests

• If Clam receives a request directly from a Data Subject relating to Customer Data, Clam shall not itself respond to that request, save to redirect the Data Subject to Customer, unless legally required to do otherwise or instructed by Customer. Clam shall promptly notify Customer of the request and provide reasonable assistance to enable Customer to respond.

10. Liability

• Each Party's liability arising out of or in connection with this DPA, whether in contract, tort or otherwise, is subject to the limitations and exclusions of liability set out in the Agreement, except that nothing in this DPA or the Agreement limits or excludes either Party's liability where such limitation or exclusion is not permitted under Applicable Data Protection Law.

11. Term and Termination

• This DPA takes effect on the Effective Date and remains in force for as long as Clam Processes Customer Data under the Agreement, and shall automatically terminate on completion of Clam's deletion or return obligations under Clause 7.

12. Miscellaneous

• 12.1. In the event of any conflict between this DPA and the Agreement regarding the Processing of Personal Data, this DPA prevails.
• 12.2. This DPA is governed by, and shall be construed in accordance with, the governing law provision of the Agreement, and the Parties submit to the dispute-resolution mechanism set therein.
• 12.3. Notices under this DPA shall be given in accordance with the notices clause of the Agreement.
• 12.4. This DPA may be executed and amended only in accordance with the amendment mechanism set out in the Agreement, save that Annex 2 (Sub-processors) may be updated by Clam in accordance with Clause 4.2 without requiring a formal amendment.

ANNEX 1 — DETAILS OF PROCESSING

A. List of Parties

• Data Exporter

• Data Importer

B. Description of Processing

• Categories of data subjects whose personal data is processed
• Customer's authorized users (mailbox account holders); senders and recipients of email processed through the connected mailbox.
• Categories of personal data processed
• Email header data (sender, recipient(s) including To, Cc and, where present, Bcc and Reply-To addresses; subject line; sender-set date; Message-ID and References threading identifiers); mailbox message metadata as supplied by the email provider (message and thread identifiers, label assignments, read/unread state, provider receipt timestamp, preview snippet, and mailbox change-history cursor); email body content and attachments, including attachment file names, MIME types and sizes (processed transiently for policy evaluation, classification and, on forwarding, transmission of the full original message source; not persisted as a standing archive); classification labels/hints; audit metadata (action type, timestamp, user identifiers, and a bounded record of the targeted message limited to subject, sender, recipient addresses, labels, message date and search query, never body content); user's email address and mailbox label names; WhatsApp mobile number.
• Sensitive data transferred (if applicable) and applied restrictions or safeguards
• N/A
• The frequency of the processing
• Continuous, for as long as the Services are provided.
• Nature of the processing
• Automated classification of incoming and outgoing email; translation of Customer's plain-language access instructions into a machine-enforced policy; evaluation of action requests against that policy; execution, logging, and reporting of permitted actions; generation of approval notifications.
• Purpose(s) of the data transfer and further processing
• Provision of the Services as described in Clause 2.1 of this DPA.
• The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
• As set out in Clause 7: Customer Data are deleted or anonymized on the earliest of termination, an explicit deletion request, or 90 days of account inactivity following a prior warning.
• For transfers to (sub-)processors, also specify subject matter, nature and duration of the processing
• Sub-processors listed in Annex 2 process Customer Data for the subject matter, nature, and duration set out above, for the duration of the Agreement, in accordance with Clause 4.

ANNEX 2 — AUTHORIZED SUB-PROCESSORS

• The following Sub-processors are authorized to Process Customer Data in connection with the Service:

ANNEX 3 — TECHNICAL AND ORGANISATIONAL MEASURES

• This Annex describes measures actually in place. It does not commit Clam to any security certification, penetration-testing schedule, or specific audit standard not separately agreed in writing.
• Logical access control
  • • Secure passwords, including the use of strong passwords.
  • • Two-factor authentication for all key systems.
  • • Encryption of personal data whenever possible.
  • • Staff do not have routine access to mailbox content; support-related access to Customer Data requires Customer's specific permission for the individual request, except where access is legally required.
  • • Actions Customer has designated as requiring approval are blocked pending Customer authorization; approval requests expire after 24 hours unexecuted; any change to the underlying action, policy, or Shell access invalidates a pending approval. Quiet-hours settings block all Shell access, including previously approved actions, for the configured period, independent of background classification.
• Data access control
  • • Role-based access control.
  • • Need-based rights of access (only on a need-to-know basis).
  • • Error-monitoring tooling is configured to exclude mailbox content and metadata, Policies, classification hints, credentials, and request/response bodies, and session replay is disabled.
• Events logging
  • • System time clocks are synchronized to trusted time sources.
  • • Log records are created, protected and retained to the extent needed to enable monitoring, analysis, investigation and reporting of unlawful, unauthorized or inappropriate information system activity.
  • • Shell actions are logged to an audit trail (retained 12 months) enabling Customer to review what was accessed or processed; operational and error events are logged separately (retained 30 days).
• Isolation and separation
  • • Client data is logically segregated from other clients' data.
  • • Database rights are centrally managed and set as granular as possible.
• Encryption of personal data
• Personal data is encrypted by default, applied at rest, in-app, and in transit across untrusted networks.
• Security
  • • Clam has implemented corporate information security practices and standards designed to safeguard the corporate environment and to address business objectives across information security, system and asset management, development, and governance.
  • • These practices and standards are approved by Clam's executive management and are periodically reviewed and updated where necessary.
  • • Clam maintains an appropriate data privacy and information security program, including policies and procedures for physical and logical access restrictions, data classification, access rights, credentialing programs, record retention, data privacy, information security, and the treatment of personal data and sensitive personal data throughout its lifecycle.
  • • Security policies are reviewed annually.
  • • Clam imposes data protection obligations on Sub-processors equivalent to this DPA and maintains the Sub-processor list in Annex 2.
  • • Clam does not use Customer Data to train Clam's own models.
• Data transmission and transport control
  • • Controls are implemented to detect and remediate workstation compliance deviations.
  • • All data is encrypted in transit and at rest.
• Data during storage
  • • Application of encryption for data at rest.
  • • Access control adheres to the principle of least privilege.
  • • Data assets are subject to backup and recovery processes.
  • • Clam does not persist email bodies or attachments as a mailbox archive; Customer Data processed for classification and execution is not retained by Clam beyond what is necessary to provide the Service and the logging described above.
• Limited data retention
  • • Data is retained no longer than required for Clam to comply with its obligations under the Agreement, this DPA and applicable law, and subject to secure data destruction practices.
• Security incidents
• In the case of an incident, Clam follows documented incident response procedures to comply with applicable laws and regulations.

ANNEX 4 — STANDARD CONTRACTUAL CLAUSES

• Where a Restricted Transfer of Customer Data occurs under Clause 5, the Standard Contractual Clauses are incorporated by reference and apply as follows, completed as indicated:
  • (a) Module. Module Two (Controller to Processor) applies where Customer is Controller and Clam or a Sub-processor is the data importer; Module Three (Processor to Processor) applies where Customer itself acts as Processor.
  • (b) Clause 7 (docking clause). Not used.
  • (c) Clause 9 (use of sub-processors). Option 2 (general written authorization) applies, with the notice period set out in Clause 4.2 of this DPA.
  • (d) Clause 11(a) (redress). The optional language is not used.
  • (e) Clause 13 and Annex I.C. The competent Supervisory Authority is determined in accordance with Clause 13 and Annex I.C of the SCCs, by reference to Customer's establishment or, failing that, the Supervisory Authority of the EU Member State in which the representative within the meaning of Article 27(1) GDPR has been appointed.
  • (f) Clause 17 (governing law). The SCCs are governed by the law of Greece, being the law of an EU Member State that permits third-party beneficiary rights.
  • (g) Clause 18(b) (choice of forum and jurisdiction). Disputes shall be resolved before the courts of Athens, Greece.
  • (h) Annex I.A, I.B, II. Completed by reference to Annex 1 (Details of Processing) and Annex 3 (Technical and Organisational Measures) of this DPA.