Data Processing Addendum

1. Parties and incorporation

1.1 This Data Processing Addendum ("Addendum") is between detumble.ai LLC, Arab Republic of Egypt ("detumble" or "Processor") and the customer identified in the account or Enterprise Agreement ("Customer" or "Controller").

1.2 This Addendum forms part of the Terms of Service (or the Enterprise Agreement, together the "Agreement") and applies automatically whenever detumble processes Personal Data on Customer's behalf. No signature is needed for it to bind both parties; a customer who needs a countersigned copy for its own records may use the signature block in Annex 4. If the Agreement and this Addendum conflict about Personal Data, this Addendum prevails.

1.3 Where Customer is itself a processor for its client (for example, a contractor processing an owner's drawings), Customer warrants that its client has authorised the engagement of detumble as a sub-processor on these terms, and detumble's obligations to Customer under this Addendum are its obligations as a sub-processor.

2. Definitions

2.1 "Applicable Data Protection Law" means all laws that apply to the processing of Personal Data under the Agreement, including Regulation (EU) 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, Egypt's Personal Data Protection Law No. 151 of 2020 and its Executive Regulations issued by Prime Ministerial Decree No. 816 of 2025 ("PDPL"), and where applicable the data protection laws of the Gulf states in which Customer operates.

2.2 "Personal Data", "Controller", "Processor", "Data Subject", "Processing", "Personal Data Breach" and "Supervisory Authority" have the meanings given in the GDPR or, where the PDPL applies, the corresponding meanings in the PDPL.

2.3 "Customer Personal Data" means Personal Data contained in Customer Content or Outputs (as defined in the Agreement) that detumble processes on Customer's behalf. It does not include account, billing or usage data about Customer's Users, for which detumble is the controller under the Privacy Policy.

2.4 "Subprocessor" means a third party engaged by detumble to process Customer Personal Data.

2.5 "Standard Contractual Clauses" or "SCCs" means the clauses adopted by European Commission Implementing Decision (EU) 2021/914, and "UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner.

3. Roles and scope

3.1 Customer is the Controller (or a processor acting for a controller) and detumble is the Processor of Customer Personal Data.

3.2 Subject matter and duration. The processing of drawing sets and related content to produce Outputs, for the term of the Agreement plus the deletion period in Section 11.

3.3 Nature and purpose. Hosting, storage, parsing, extraction, indexing, analysis by deterministic software and large language models, rendering, and display of Customer Content and Outputs, solely to provide the Service to Customer.

3.4 Categories of Data Subjects. Customer's employees and Users; architects, engineers, draughtsmen, checkers and approvers named on drawings; Customer's clients and their staff; site owners and occupiers; contractors, suppliers and consultants named in schedules or notes.

3.5 Categories of Personal Data. Names, job titles, professional registration numbers, signatures, initials, e-mail addresses, phone numbers, company names and addresses, site addresses, and any other personal data Customer includes in drawings, schedules, notes or chat. No special categories are intended to be processed; Customer must not upload them.

3.6 Annex 1 records these details in the form required by the SCCs.

4. Customer's obligations

4.1 Customer is responsible for the lawfulness of its instructions and of the Personal Data it uploads, including having a lawful basis, giving any required notices to Data Subjects, obtaining any required consents and authorisations (including from the rights-holder in the drawings), and complying with the PDPL licensing and cross-border transfer requirements that apply to Customer as controller.

4.2 Customer's instructions to detumble are: the Agreement, this Addendum, the settings Customer chooses in the Service, and any further written instruction agreed by both parties. Customer will not instruct detumble to process Personal Data in a way that breaches Applicable Data Protection Law.

4.3 Customer will minimise Personal Data in uploads and will not upload special-category data, data about children, or data subject to a legal regime detumble has not agreed in writing to support.

5. detumble's obligations

detumble will:

5.1 process Customer Personal Data only on Customer's documented instructions (Section 4.2), including with regard to transfers, unless required to do otherwise by law that applies to detumble, in which case detumble will inform Customer of that requirement before processing unless the law prohibits it;

5.2 inform Customer immediately if, in detumble's opinion, an instruction infringes Applicable Data Protection Law;

5.3 ensure that every person authorised to process Customer Personal Data (the founders, any staff or contractors) is bound by a contractual or statutory duty of confidentiality and receives appropriate training;

5.4 implement and maintain the technical and organisational measures in Annex 2, and not reduce their overall level of protection during the term;

5.5 not access Customer Content or Outputs except as needed to provide the Service, to support Customer at Customer's request, to investigate a security incident, an abuse report or a billing dispute, or as required by law; log every such access; and make the log available to Customer on request;

5.6 not use Customer Personal Data, Customer Content or Outputs to train, fine-tune or evaluate any machine learning or AI model, and ensure by contract that no Subprocessor does so, except with Customer's prior written consent;

5.7 not sell Customer Personal Data or share it for advertising, and not combine it with data from other customers except in de-identified, aggregated statistics that cannot identify Customer, any Data Subject or any drawing;

5.8 keep records of processing activities carried out on Customer's behalf as required by Applicable Data Protection Law and make them available to a Supervisory Authority on request; and

5.9 assist Customer as set out in Sections 8, 9 and 10.

6. Subprocessors

6.1 Authorisation. Customer authorises detumble to engage the Subprocessors listed in Annex 3 and to engage further Subprocessors under this Section.

6.2 Notice of changes. detumble will publish the current Subprocessor list at the address in Annex 3 and will notify Customer by e-mail at least 30 days before authorising a new Subprocessor to process Customer Personal Data, describing the Subprocessor, the processing and the location. Emergency replacement of a Subprocessor for security or continuity reasons may be notified with shorter notice, with reasons.

6.3 Objection. Customer may object in writing within the notice period on reasonable data-protection grounds. The parties will discuss in good faith. If detumble cannot accommodate the objection (for example because the Subprocessor is essential to the Service), Customer may terminate the affected Projects or the Agreement on notice and receive a refund of unused prepaid fees and unused top-up credits.

6.4 Flow-down. detumble will impose on each Subprocessor, by written contract, data-protection obligations at least as protective as those in this Addendum, including the training prohibition in Section 5.6, and will remain fully liable to Customer for the Subprocessor's performance.

7. International transfers

7.1 Storage. Customer Personal Data is stored and backed up exclusively in Amazon Web Services region eu-north-1 (Stockholm, Sweden).

7.2 Transfers to Subprocessors outside the EEA. Where a Subprocessor processes Customer Personal Data outside the EEA, the UK or Egypt, detumble relies on: the SCCs (Module 3, processor to processor) or the Subprocessor's own SCC-based DPA, and the UK Addendum where UK data is involved; an adequacy decision where one exists; or another mechanism permitted by Applicable Data Protection Law. Anthropic processes extracted drawing data and chat in the United States under its Data Processing Addendum incorporating the SCCs.

7.3 Access from Egypt. detumble's founders operate the Service from Egypt. Remote access to Customer Personal Data stored in the EU from Egypt is limited to the purposes in Section 5.5 and is logged. Egypt is not the subject of an EU adequacy decision.

7.4 Incorporation of SCCs. To the extent the GDPR applies and a transfer from Customer to detumble requires a transfer mechanism, the SCCs Module 2 (controller to processor) are incorporated by reference, with: Clause 7 (docking) included; Clause 9 option 2 (general authorisation) with the 30-day notice in Section 6.2; Clause 11 optional language not included; Clause 13 supervisory authority of the member state where Customer is established; Clause 17 governed by the law of Ireland; Clause 18 courts of Ireland; Annex I completed by Annex 1 of this Addendum; Annex II by Annex 2; Annex III by Annex 3. For UK data, the UK Addendum applies with Table 2 selecting those modules and options.

8. Data Subject requests

8.1 detumble will notify Customer without undue delay, and within 3 business days, if it receives a request from a Data Subject relating to Customer Personal Data, and will not respond except to direct the Data Subject to Customer, unless the law requires otherwise.

8.2 The Service allows Customer to access, export, correct (by re-uploading) and delete Customer Content and Outputs at any time, which is detumble's primary means of assisting with Data Subject requests. Where that is not sufficient, detumble will provide reasonable further assistance at Customer's request, within the time Customer needs to meet its statutory deadline (one month under the GDPR; the shorter period the PDPL Executive Regulations prescribe, reported as six working days).

9. Personal Data Breach

9.1 detumble will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point, and will be updated as information becomes available.

9.2 detumble will cooperate with Customer's investigation and with Customer's own notifications to Supervisory Authorities and Data Subjects. detumble will not notify a Supervisory Authority or Data Subjects on Customer's behalf unless Customer asks it to or the law requires it. Where the PDPL applies to detumble directly, detumble will also make its own notification to the Personal Data Protection Centre within 72 hours and to affected individuals within three days after that.

10. Assistance, impact assessments and audits

10.1 detumble will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with Supervisory Authorities, taking into account the nature of the processing and the information available to detumble.

10.2 detumble will make available the information necessary to demonstrate compliance with this Addendum, including: this Addendum and its annexes, the Subprocessor list, summaries of security tests, the results of the platform's isolation and money checks run on each release, and the access log for Customer's Projects.

10.3 Customer (or an independent auditor appointed by Customer and bound by confidentiality) may audit detumble's compliance once in any 12-month period, or after a Personal Data Breach, on 30 days' written notice, during business hours, without disrupting the Service, and at Customer's cost. detumble may satisfy an audit request by providing a recent third-party audit report or certification covering the relevant controls where one exists. Audit findings are Confidential Information of both parties.

11. Return and deletion

11.1 Customer can delete any Project or its whole account from the Service at any time. A deleted Project is removed from live systems within 30 days and from backups on the backup cycle (35 days).

11.2 On termination or expiry of the Agreement, Customer has 30 days to export Customer Content and Outputs in the formats the Service provides. After that period, detumble will delete all Customer Personal Data from live systems within 90 days and from backups on the backup cycle, and will certify deletion in writing on request, except for data that detumble must retain under law (in which case detumble will continue to protect it and process it only for that purpose).

12. Liability

Each party's liability under this Addendum is subject to the exclusions and limitations in the Agreement, except that nothing limits a party's liability to Data Subjects or to a Supervisory Authority where Applicable Data Protection Law does not permit it to be limited.

13. Term and precedence

This Addendum applies for as long as detumble processes Customer Personal Data. If any provision is invalid, the rest remains in effect and the parties will replace it with a valid provision that achieves the same purpose. For customers to whom the GDPR applies, the SCCs prevail over this Addendum in the event of conflict.

Annex 1: Description of the processing

Annex 2: Technical and organisational measures

Annex 3: Subprocessors

Current list, also published at detumble.ai/legal/subprocessors. Changes are notified under Section 6.2.

Annex 4: Signature block (enterprise customers only)

This Addendum is effective on acceptance of the Agreement. Enterprise customers who require a countersigned copy, or who require SCCs Module 2 to be executed between themselves and detumble, may sign below.