Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between Primagery AI (“Processor,” “Primagery”) and the client entity (“Controller,” “Client”) when Primagery processes personal data on behalf of the Client in connection with the Services. It supplements the Terms of Service and Privacy Policy.

Execution: For enterprise clients, a countersigned copy may be requested at info@primagery.com. For standard engagements, use of the Services after this DPA is published constitutes acceptance where permitted by applicable law and the Client Agreement.

1. Roles and scope

• Client is the Controller (or Processor acting as Controller) for Client Data.
• Primagery is the Processor for Client Data processed in the portal, vault, and delivery workflows.
• Primagery is an independent Controller for its own business data (billing contacts, Primagery staff accounts).
• This DPA applies to personal data subject to GDPR, UK GDPR, Swiss FADP, and similar laws.

2. Subject matter and duration

Processing supports provision of consulting, portal software, document management, messaging, onboarding, and related Services for the term of the Client Agreement and any post-termination wind-down period specified herein.

3. Nature and purpose of processing

• Storage, organization, and retrieval of Client Data in the document vault
• User authentication and access control for Client authorized users
• Workflow automation, notifications, and project delivery
• Security monitoring, backup, and disaster recovery
• Support and troubleshooting at Client request

4. Categories of data subjects

Client employees, contractors, vendors, and — depending on Client uploads — end customers, guests, or other individuals whose data Client chooses to store in the Services.

5. Types of personal data

Contact details, account credentials (hashed), professional information, communications, documents (contracts, IDs, tax forms, operational records), usage logs, and metadata associated with portal activity. Special category data may appear in Client uploads; Client is responsible for lawful basis and minimization.

6. Client instructions

Primagery will process Client Data only on documented instructions from the Client, including as necessary to provide the Services, comply with law, or prevent security incidents — unless prohibited by law (in which case Primagery will inform Client where permitted).

7. Confidentiality

Primagery ensures personnel authorized to process Client Data are bound by confidentiality obligations.

8. Security

Primagery implements appropriate technical and organizational measures per Article 32 GDPR, including encryption in transit, access controls, audit logging, and incident response. Details available on request and in security documentation.

9. Subprocessors

Client authorizes Primagery to engage subprocessors listed at Subprocessors. Primagery will impose data protection obligations substantially similar to this DPA. Primagery will notify Client of new subprocessors with reasonable opportunity to object for material changes where required.

10. International transfers

Where Client Data is transferred outside the EEA/UK, Primagery will implement appropriate safeguards, including EU Standard Contractual Clauses (2021/914) Module 2 (Controller to Processor) and, where applicable, Module 3 (Processor to Processor), and the UK International Data Transfer Addendum. Client may request signed SCCs via info@primagery.com.

11. Assistance with data subject rights

Primagery will assist Client, through appropriate technical and organizational measures, in responding to data subject requests (access, deletion, etc.) where Client cannot fulfill requests without Primagery's assistance, considering the nature of processing.

12. Assistance with DPIAs and consultations

Primagery will provide reasonable assistance for data protection impact assessments and prior consultations with supervisory authorities where required, based on processing performed by Primagery.

13. Personal data breach

Primagery will notify Client without undue delay after becoming aware of a personal data breach affecting Client Data, providing information reasonably available to assist Client in meeting regulatory notification obligations.

14. Deletion and return

Upon termination, Primagery will delete or return Client Data per Client instructions and Client Agreement, subject to legal retention requirements and backup cycles (typically purged on rolling schedule). Client may export data during the notice period where features allow.

15. Audits

Upon reasonable written request and subject to confidentiality, Primagery will provide information necessary to demonstrate compliance and allow audits no more than once annually (unless required by regulator or material incident), coordinated to minimize disruption. Client bears audit costs unless material non-compliance is found.

16. Liability

Liability under this DPA is subject to the limitation of liability in the Terms or Client Agreement, except where prohibited by GDPR Article 82.

17. Order of precedence

If conflict between this DPA and Terms regarding processing of Client Data, this DPA controls. If conflict between this DPA and a signed enterprise agreement, the signed agreement controls.

18. Contact

Data protection inquiries: info@primagery.com