Email Agent Data Processing Agreement (DPA)

This Data Processing Addendum, including its Annexes, ("DPA") is supplemental to and forms part of the Terms of Service and any applicable order forms or statements of work (collectively, the "Agreement"), entered into between Limitless Now Ltd ("Processor", "we", "us") and the customer entity that has accepted the Agreement ("Controller", "you").

This DPA applies where we process Personal Data on your behalf in the course of providing the Services.

1. Definitions
   "Applicable Data Protection Laws" means all data protection and privacy laws applicable to the processing of Personal Data under the Agreement, including, where applicable, the UK GDPR and European Data Protection Laws.

"Controller" means the entity that determines the purposes and means of the processing of Personal Data. For the purposes of this DPA, the Customer is the Controller.

"Data Subject" means the identified or identifiable natural person to whom Personal Data relates.

"EEA" means the European Economic Area.

"EU GDPR" means the General Data Protection Regulation (Regulation (EU) 2016/679).

"European Data Protection Laws" means the EU GDPR and the data protection or privacy laws of any EU Member State.

"Personal Data" means any information relating to a Data Subject that is processed by the Processor on behalf of the Controller in connection with the Services.

"Processing", "processes", or "process" mean any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

"Processor" means the entity that processes Personal Data on behalf of the Controller. For the purposes of this DPA, Limitless Now Ltd is the Processor.

"Restricted Transfer" means a transfer of Personal Data from the UK to a country not covered by UK adequacy regulations, or from the EEA to a country not subject to an adequacy determination by the European Commission.

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed by the Processor.

"Services" means the AI-powered productivity services provided by the Processor to the Controller under the Agreement.

"Sub-processor" means any third-party processor engaged by the Processor to process Personal Data in connection with the Services.

"UK GDPR" means the EU GDPR as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.

2. Roles and Responsibilities
   2.1. Parties' Roles. The parties acknowledge and agree that for the purposes of Applicable Data Protection Laws, the Customer is the Controller and Limitless Now Ltd is the Processor.

2.2. Processor's Obligations. The Processor shall:
a. Process Personal Data only on the documented instructions of the Controller, as set out in the Agreement and this DPA, unless required to do otherwise by applicable law.
b. Inform the Controller if, in its opinion, an instruction infringes Applicable Data Protection Laws.
c. Not retain, use, or disclose the Personal Data for any purpose other than for the specific purpose of performing the Services, including not selling or sharing the Personal Data.

2.3. Controller's Obligations. The Controller represents and warrants that:
a. It has complied with all applicable laws, including Applicable Data Protection Laws, in collecting and providing the Personal Data to the Processor.
b. It has a valid legal basis for the processing of Personal Data as contemplated by the Agreement.
c. Its instructions to the Processor for the processing of Personal Data shall comply with all applicable laws.

3. Security Measures
   3.1. Technical and Organisational Measures. The Processor shall implement and maintain appropriate technical and organizational measures to protect the Personal Data against Security Incidents. These measures are detailed in Annex 2 ("Technical and Organisational Measures").

3.2. Confidentiality. The Processor shall ensure that any person authorized to process the Personal Data is subject to a strict duty of confidentiality (whether a contractual or statutory duty).

3.3. Security Incidents. Upon becoming aware of a Security Incident, the Processor shall notify the Controller without undue delay. The Processor shall provide the Controller with timely information and cooperation as the Controller may reasonably require to fulfill its own data breach notification obligations under Applicable Data Protection Laws.

4. Sub-processing
   4.1. General Authorization. The Controller provides a general written authorization for the Processor to engage Sub-processors to perform the Services. The Processor shall maintain an up-to-date list of its Sub-processors, which is provided in Annex 3.

4.2. New Sub-processors. The Processor will provide the Controller with at least 30 days' prior written notice of the appointment of any new Sub-processor. The Controller may object to the appointment in writing within this period on reasonable grounds relating to data protection. If the parties cannot reach a resolution, the Controller may terminate the portion of the Service provided by that Sub-processor.

4.3. Sub-processor Obligations. The Processor shall enter into a written agreement with each Sub-processor imposing data protection obligations that are at least as protective as those set out in this DPA. The Processor shall remain fully liable to the Controller for the performance of the Sub-processor's obligations.

5. International Transfers
   5.1. Data Transfers. The Processor may transfer Personal Data to countries outside the UK and the EEA, subject to the implementation of appropriate safeguards.

5.2. Safeguards. For any Restricted Transfer, the Processor shall ensure that the transfer is governed by a valid legal mechanism, as detailed in Annex 3. This may include:
a. Reliance on the UK-US Data Bridge for transfers to certified US entities.
b. Execution of the UK's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU's Standard Contractual Clauses (SCCs).
c. Conducting a Transfer Risk Assessment (TRA) where required.

6. Data Subject Rights and Audits
   6.1. Assistance. Taking into account the nature of the processing, the Processor shall assist the Controller by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Laws.

6.2. Audits. The Controller may audit the Processor's compliance with this DPA once per year. The audit must be:
a. Notified to the Processor with at least 30 days' written notice.
b. Conducted by an independent, third-party auditor approved by both parties, at the Controller's expense.
c. In lieu of a direct audit, the Processor may provide copies of relevant third-party audit reports (e.g., SOC 2 report) if available.

7. Data Deletion
   Upon termination of the Agreement, the Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller. The Processor shall delete existing copies unless applicable law requires storage of the Personal Data. The deletion process is further detailed in Annex 2.

8. General Provisions
   8.1. Precedence. In the event of a conflict between this DPA and the Agreement, this DPA shall prevail in matters of data protection.

8.2. Governing Law. This DPA and any disputes arising from it shall be governed by the laws of England and Wales, subject to any mandatory local rights for EU customers as outlined in the Agreement.