Baseten’s data processing agreement changed.

− - **Definitions**
− - **Scope**
− - **Roles of the Parties**
− - **Roles**. The Parties acknowledge and agree that with regard to the Processing of Customer Personal Data: (a) Baseten acts as a Processor; (b) Customer acts as a Controller, or as a Processor on behalf of its own controllers; and (c) Baseten will engage Sub-Processors pursuant to Section 7.
− - **Customer's Role.** Customer shall, in its use of the Services and provision of instructions, Process Customer Personal Data in accordance with Applicable Data Protection Laws. Customer has sole responsibility for the accuracy, quality, and legality of Customer Personal Data and the means by which Customer acquired it. Where Customer is acting as a Processor on behalf of its own controllers, Customer represents and warrants that it has all necessary authority to instruct Baseten to Process such Customer Personal Data on the same terms set forth in this DPA, including the right to engage Baseten and Sub-Processors as authorized hereunder.
− - **Baseten's Role.** Baseten shall Process Customer Personal Data only on Customer's Documented Instructions (defined in Section 4.1) or as required by applicable law.
− - **Processing of Customer Personal Data**
− - **Documented Instructions.** The Parties agree that this DPA, the Agreement (including any Order Form), and Customer's configuration and use of the Services through the interfaces and APIs made available by Baseten constitute Customer's documented instructions to Baseten regarding the Processing of Customer Personal Data ("**Documented Instructions**"). Baseten will Process Customer Personal Data only in accordance with Documented Instructions (which, if Customer is acting as a Processor, may be based on the instructions of Customer's own controllers) or as required by applicable law. Additional instructions outside the scope of the Documented Instructions require prior written agreement between the Parties, including agreement on any additional fees payable for carrying out such instructions. If Baseten declines to follow instructions requested by Customer that are outside the scope of, or changed from, those given in or agreed to under this DPA, Customer may terminate this DPA and the Agreement in accordance with the termination provisions of the Agreement.
− - **Instructions Conflicting with Law.** If Baseten forms the opinion that an instruction from Customer infringes Applicable Data Protection Laws, Baseten will promptly inform Customer, in which case Customer is entitled to withdraw or modify its instruction. Customer acknowledges that, taking into account the nature of the Processing, it is unlikely Baseten will be able to form an opinion on whether a Documented Instruction infringes Applicable Data Protection Laws.
− - **Details of Processing.** The details of Processing are described in Annex A (Data Processing Details).
− - **No Training.** Consistent with the Agreement, Baseten will not use Customer Personal Data to train, fine-tune, or otherwise develop machine learning or artificial intelligence models.
− - **Data Retention.** Where the Services are provided under a Zero Data Retention posture (as described in the Security Practices https://www.baseten.co/security-practices), Baseten shall not log, record, or save Customer Personal Data contained in model inputs or outputs to persistent storage after real-time processing, subject to the product-specific practices and limited exceptions described in the Security Practices. Baseten may retain Usage Information (as defined in the Agreement) and metadata necessary for billing and technical operations, provided such information does not contain Customer Personal Data.
− - **Baseten Personnel**
− - **Security**
− - **Sub-Processing**
− - **Subprocessors.** Customer generally authorizes Baseten to appoint Sub-Processors, including those listed at [https://trust.baseten.co/](https://trust.baseten.co/) (the "**Sub-Processor List**"). Baseten will ensure each Sub-Processor is bound by a written agreement with data protection obligations substantially similar to this DPA. Baseten will be liable for any breach caused by a Sub-Processor to the extent Baseten would have been liable had the breach been caused by Baseten. Baseten shall notify Customer at least fifteen (15) days prior to engaging a new Sub-Processor by updating the Sub-Processor List or sending notification.
− - **Objection Right for New Subprocessors.** Customer may object in writing to a new Sub-Processor based on reasonable data protection concerns by emailing [privacy@baseten.co](mailto:privacy@baseten.co) within ten (10) calendar days of notice. The Parties will discuss in good faith and if unable to resolve, Baseten will either (a) use reasonable efforts to make a commercially reasonable change to avoid use of that Sub-Processor; or (b) where such change is not feasible within thirty (30) days, either Party may terminate the affected portion of the Agreement, and Baseten will refund prepaid fees allocable to the period after termination. Infrastructure Providers (as defined in the Agreement) are not Sub-Processors under this DPA unless they have logical access to Customer Personal Data.
− - **Data Subject Rights**
− - **Personal Data Breach; Return and Deletion**
− - **Breach Notification.** Baseten shall notify Customer without undue delay, and in any event within forty-eight (48) hours, upon discovering a Personal Data Breach affecting Customer Personal Data. Baseten shall provide information to assist Customer in meeting obligations under Applicable Data Protection Laws.
− - **Cooperation.** Baseten shall reasonably cooperate with Customer and take commercially reasonable steps to assist in investigation and mitigation of any Personal Data Breach. Customer is solely responsible for complying with notification laws and fulfilling third-party notification obligations. If Customer's notification identifies Baseten, Customer agrees to notify Baseten in advance and consider reasonable clarifications.
− - **Return and Deletion.** Upon cessation of Services involving Processing of Customer Personal Data, Baseten shall cease Processing except for storage or as permitted under this DPA. For thirty (30) days following cessation (the "**Post-Term Period**"), Customer may retrieve Customer Personal Data via the Services. On written request during the Post-Term Period, Baseten shall within thirty (30) days either (a) return a complete copy by secure transfer, or (b) delete all Customer Personal Data. If Customer does not instruct Baseten during the Post-Term Period, Baseten shall promptly delete all Customer Personal Data following expiry of the Post-Term Period. Baseten may retain Customer Personal Data where required by applicable law, subject to confidentiality and purpose limitation.
− - **Audit Rights**
− - **Liability**
− - **Cross-Border Transfers**
− - **Precedence**
− - When Customer is acting as a Controller, the Controller-to-Processor Clauses (Module Two) apply.
− - Baseten acts as a "service provider." Baseten acknowledges that Customer Personal Data is disclosed only for the limited purposes described in the Agreement.
+ - [1. Definitions](#1-definitions)
+ - [2. Scope](#2-scope)
+ - [3. Roles of the Parties](#3-roles-of-the-parties)
+ - [4. Processing of Customer Personal Data](#4-processing-of-customer-personal-data)
+ - [5. Baseten Personnel](#5-baseten-personnel)
+ - [6. Security](#6-security)
+ - [7. Sub-Processing](#7-sub-processing)
+ - [8. Data Subject Rights](#8-data-subject-rights)
+ - [9. Personal Data Breach; Return and Deletion](#9-personal-data-breach-return-and-deletion)
+ - [10. Audit Rights](#10-audit-rights)
+ - [11. Liability](#11-liability)
+ - [12. Cross-Border Transfers](#12-cross-border-transfers)
+ - [13. Precedence](#13-precedence)
+ ### **1. Definitions**[](#1-definitions)
+ ### **2. Scope**[](#2-scope)
+ ### **3. Roles of the Parties**[](#3-roles-of-the-parties)
+ **3.1. Roles**. The Parties acknowledge and agree that with regard to the Processing of Customer Personal Data: (a) Baseten acts as a Processor; (b) Customer acts as a Controller, or as a Processor on behalf of its own controllers; and (c) Baseten will engage Sub-Processors pursuant to Section 7.
+ **3.2. Customer's Role.** Customer shall, in its use of the Services and provision of instructions, Process Customer Personal Data in accordance with Applicable Data Protection Laws. Customer has sole responsibility for the accuracy, quality, and legality of Customer Personal Data and the means by which Customer acquired it. Where Customer is acting as a Processor on behalf of its own controllers, Customer represents and warrants that it has all necessary authority to instruct Baseten to Process such Customer Personal Data on the same terms set forth in this DPA, including the right to engage Baseten and Sub-Processors as authorized hereunder.
+ **3.3. Baseten's Role.** Baseten shall Process Customer Personal Data only on Customer's Documented Instructions (defined in Section 4.1) or as required by applicable law.
+ ### **4. Processing of Customer Personal Data**[](#4-processing-of-customer-personal-data)
+ **4.1. Documented Instructions.** The Parties agree that this DPA, the Agreement (including any Order Form), and Customer's configuration and use of the Services through the interfaces and APIs made available by Baseten constitute Customer's documented instructions to Baseten regarding the Processing of Customer Personal Data ("**Documented Instructions**"). Baseten will Process Customer Personal Data only in accordance with Documented Instructions (which, if Customer is acting as a Processor, may be based on the instructions of Customer's own controllers) or as required by applicable law. Additional instructions outside the scope of the Documented Instructions require prior written agreement between the Parties, including agreement on any additional fees payable for carrying out such instructions. If Baseten declines to follow instructions requested by Customer that are outside the scope of, or changed from, those given in or agreed to under this DPA, Customer may terminate this DPA and the Agreement in accordance with the termination provisions of the Agreement.
+ **4.2. Instructions Conflicting with Law.** If Baseten forms the opinion that an instruction from Customer infringes Applicable Data Protection Laws, Baseten will promptly inform Customer, in which case Customer is entitled to withdraw or modify its instruction. Customer acknowledges that, taking into account the nature of the Processing, it is unlikely Baseten will be able to form an opinion on whether a Documented Instruction infringes Applicable Data Protection Laws.
+ **4.3. Details of Processing.** The details of Processing are described in Annex A (Data Processing Details).
+ **4.4. No Training.** Consistent with the Agreement, Baseten will not use Customer Personal Data to train, fine-tune, or otherwise develop machine learning or artificial intelligence models.
+ **4.5. Data Retention.** Where the Services are provided under a Zero Data Retention posture (as described in the Security Practices https://www.baseten.co/security-practices), Baseten shall not log, record, or save Customer Personal Data contained in model inputs or outputs to persistent storage after real-time processing, subject to the product-specific practices and limited exceptions described in the Security Practices. Baseten may retain Usage Information (as defined in the Agreement) and metadata necessary for billing and technical operations, provided such information does not contain Customer Personal Data.
+ ### **5. Baseten Personnel**[](#5-baseten-personnel)
+ ### **6. Security**[](#6-security)
+ ### **7. Sub-Processing**[](#7-sub-processing)
+ **7.1. Subprocessors.** Customer generally authorizes Baseten to appoint Sub-Processors, including those listed at [https://trust.baseten.co/](https://trust.baseten.co/) (the "**Sub-Processor List**"). Baseten will ensure each Sub-Processor is bound by a written agreement with data protection obligations substantially similar to this DPA. Baseten will be liable for any breach caused by a Sub-Processor to the extent Baseten would have been liable had the breach been caused by Baseten. Baseten shall notify Customer at least fifteen (15) days prior to engaging a new Sub-Processor by updating the Sub-Processor List or sending notification.
+ **7.2. Objection Right for New Subprocessors.** Customer may object in writing to a new Sub-Processor based on reasonable data protection concerns by emailing [privacy@baseten.co](mailto:privacy@baseten.co) within ten (10) calendar days of notice. The Parties will discuss in good faith and if unable to resolve, Baseten will either (a) use reasonable efforts to make a commercially reasonable change to avoid use of that Sub-Processor; or (b) where such change is not feasible within thirty (30) days, either Party may terminate the affected portion of the Agreement, and Baseten will refund prepaid fees allocable to the period after termination. Infrastructure Providers (as defined in the Agreement) are not Sub-Processors under this DPA unless they have logical access to Customer Personal Data.
+ ### **8. Data Subject Rights**[](#8-data-subject-rights)
+ ### **9. Personal Data Breach; Return and Deletion**[](#9-personal-data-breach-return-and-deletion)
+ **9.1. Breach Notification.** Baseten shall notify Customer without undue delay, and in any event within forty-eight (48) hours, upon discovering a Personal Data Breach affecting Customer Personal Data. Baseten shall provide information to assist Customer in meeting obligations under Applicable Data Protection Laws.
+ **9.2. Cooperation.** Baseten shall reasonably cooperate with Customer and take commercially reasonable steps to assist in investigation and mitigation of any Personal Data Breach. Customer is solely responsible for complying with notification laws and fulfilling third-party notification obligations. If Customer's notification identifies Baseten, Customer agrees to notify Baseten in advance and consider reasonable clarifications.
+ **9.3. Return and Deletion.** Upon cessation of Services involving Processing of Customer Personal Data, Baseten shall cease Processing except for storage or as permitted under this DPA. For thirty (30) days following cessation (the "**Post-Term Period**"), Customer may retrieve Customer Personal Data via the Services. On written request during the Post-Term Period, Baseten shall within thirty (30) days either (a) return a complete copy by secure transfer, or (b) delete all Customer Personal Data. If Customer does not instruct Baseten during the Post-Term Period, Baseten shall promptly delete all Customer Personal Data following expiry of the Post-Term Period. Baseten may retain Customer Personal Data where required by applicable law, subject to confidentiality and purpose limitation.
+ ### **10. Audit Rights**[](#10-audit-rights)
+ ### **11. Liability**[](#11-liability)
+ ### **12. Cross-Border Transfers**[](#12-cross-border-transfers)
+ ### **13. Precedence**[](#13-precedence)
+ When Customer is acting as a Controller, the Controller-to-Processor Clauses (Module Two) apply.
+ Baseten acts as a "service provider." Baseten acknowledges that Customer Personal Data is disclosed only for the limited purposes described in the Agreement.