Insider’s data processing agreement changed.

−  **Last Updated: June, 2025**
− This Data Processing Addendum (“**DPA**”) forms part of the Master Subscription Agreement or other written or electronic agreements between Insider One and Customer (the “**Agreement**”) for the purchase of online services from Insider One (identified either as “**Services**” or otherwise in the applicable agreement, and hereinafter defined as “**Services**”) to reflect the parties’ agreement with regard to the Processing of Personal Data.
− In the course of providing the Services to Customer pursuant to the Agreement, Insider One may Process Personal Data on behalf of Customer, and the Parties agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith. For the avoidance of doubt, each reference to the DPA in this DPA means this DPA including its Schedules.
− ##### **DATA PROCESSING TERMS**
− - **DEFINITIONS**
− **“Authorized Affiliate” **means any of Customer’s Affiliate(s) which (i) is subject to the data protection laws and regulations of the European Union, the European Economic Area and/or their member states and/or the United Kingdom, and (ii) is permitted to use the Services pursuant to the Agreement between Customer and Insider One but has not signed its own Order Form with Insider One and is not a “Customer” as defined under the Agreement.
− **“CCPA” **means the California Consumer Privacy Act 2018, Cal. Civ. Code § 1798.100 et seq., and its implementing regulations, as the same may be amended from time to time.
− **“Controller” **means the entity which determines the purposes and means of the Processing of Personal Data.
− **“Customer Data” **means what is defined in the Agreement as “Customer Data.”
− **“Data Protection Laws and Regulations” **means all laws and regulations, including GDPR and CCPA, applicable to a Party in its use or provision of the Services, in connection with the Processing of Personal Data under the Agreement.
− **“Data Subject” **means the identified or identifiable natural person to whom Personal Data relates.
− **“Data Subject Right” **means any right afforded to a Data Subject under Data Protection Laws and Regulations, including the rights to access, rectify, restrict the Processing of Personal Data, erasure (including the right to be forgotten), data portability, objecting to the Processing, or to not be subject to an automated individual decision making.
− **“GDPR” **means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
− **“Personal Data” **means any information relating to an identified or identifiable natural person where such data is Customer Data. **“Processing” **means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
− **“Processor” **means the entity which Processes Personal Data on behalf of the Controller.
− **“Personal Data Breach” **means a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data, transmitted, stored or otherwise Processed by Insider One or its Sub-processors of which Insider One becomes aware.
− **“Security, Privacy and Architecture Datasheet” **means the Security, Privacy and Architecture Datasheet for the Insider One Services, as updated from time to time.
− **“Standard Contractual Clauses” **or **“SCC” **means the agreement by and between Customer and Insider One, pursuant to the European Commission’s decision on Standard Contractual Clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, a copy of which can be found at [https://www.insiderone.com/legal](https://www.useinsider.com/legal).
− **“Sub-processor” **means any Processor engaged by Insider One or its Affiliates engaged in the Processing of Personal Data.
− ** “AI Systems” **means any artificial‑intelligence models, machine‑learning algorithms, large‑language models, predictive‑analytics tools or similar technologies that Insider One uses, provides or otherwise makes available in connection with the Services.
− **“AI Outputs” **means any content, dataset, analysis, recommendation, classification, prediction, insight, report or other material that is generated, derived from or otherwise influenced by AI Systems.
− - **PROCESSING OF PERSONAL DATA**
− - **Details of the Processing. **The parties acknowledge and agree that with regard to the Processing of Personal Data, Customer is the Controller, Insider One is the Processor and that Insider One or its Affiliates engaged in the Processing of Personal Data will engage Sub-processors pursuant to the requirements set forth in Schedule 2 “Sub-processors” below. The subject- matter of Processing of Personal Data by Insider One is the performance of the Services pursuant to the Agreement. The duration of the Processing, the nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects Processed under this DPA are further specified in Schedule 3 (Details of the Processing) to this DPA.
− - **Customer’s Processing of Personal Data. **Customer shall, in its use of the Services, Process Personal Data in accordance with the requirements of Data Protection Laws and Regulations. For the avoidance of doubt, Customer’s instructions for the Processing of Personal Data shall comply with Data Protection Laws and Regulations. This DPA and the Agreement are, at the time of signature of the Agreement, Customer’s complete and final documented instructions to Insider One for the Processing of Personal Data, and Customer’s configuration of the Services shall constitute an additional instruction to Insider One. Any additional or alternate instructions must be agreed upon separately. Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired the Personal Data.
− - **Insider One’s Processing of Personal Data. **Insider One shall treat Personal Data as Confidential Information and shall only Process Personal Data on behalf of Customer and in accordance with Customer’s documented instructions for the following purposes: (i) Processing in accordance with the Agreement and applicable Order Form(s); (ii) Processing initiated by Users in their use of the Services; and (iii) Processing to comply with other documented reasonable instructions provided by Customer (e.g., via email) where such instructions are consistent with the terms of the Agreement. Insider One will Process Personal Data in compliance with applicable Data Protection Laws and Regulations, provided however that Insider One shall not be in violation of this contractual obligation in the event that Insider One’s Processing of Personal Data in non-compliance with applicable Data Protection Laws and Regulations is due to Customer. Insider One shall maintain and regularly update a comprehensive Register of Processing Activities (RoPA), including all processing activities related to the MindBehind service, clearly documenting Insider One’s deletion policies and its technical and organizational measures in accordance with Article 30(2) GDPR.
− ****
− ****
− -
− ##### **RIGHTS OF DATA SUBJECTS**
− - **Data Subject Requests. **Insider One shall, to the extent legally permitted and to the extent Insider One has been able to identify that the request comes from a Data Subject whose Personal Data was submitted to the Services by Customer, promptly notify Customer if Insider One receives a request from a Data Subject in relation to the exercise of any Data Subject Right (“**Data Subject Request**”). Insider One will confirm to the Data Subject that it has passed the request to the Customer, but Insider One shall not handle or execute the Data Subject Request.
− - Taking into account the nature of the Processing, Insider One shall assist Customer by providing appropriate and necessary technical and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to a Data Subject Request under Data Protection Laws and Regulations.
− ****
− ****
− -
− ##### **INSIDER ONE PERSONNEL**
− - **Confidentiality. **Insider One shall ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities and have executed written confidentiality agreements. Insider One shall ensure that such confidentiality obligations survive the termination of the personnel engagement.
− - **Reliability. **Insider One shall take commercially reasonable steps to ensure the reliability of any Insider One personnel engaged in the Processing of Personal Data.
− - **Limitation of Access. **Insider One shall ensure that Insider One’s access to Personal Data is limited to those personnel performing Services in accordance with the Agreement.
− - **Data Protection Officer. **Insider One has appointed a data protection officer for Insider One and its Affiliates. The appointed person can be reached at [[email protected]](/cdn-cgi/l/email-protection#b4c4c6ddc2d5d7cdf4c1c7d1dddac7ddd0d1c69ad7dbd9).
− ****
− ****
− -
− ##### **SUB-PROCESSORS**
− - **Appointment of Sub-processors. **Customer acknowledges and agrees that (a) Insider One’s Affiliates may be retained as Sub-processors; and (b) Insider One and Insider One’s Affiliates respectively may engage third-party Sub-processors in connection with the provision of the Services. Insider One or a Insider One’ Affiliates has entered into a written agreement with each Sub-processor containing data protection obligations not less protective than those in this DPA with respect to the protection of Personal Data to the extent applicable to the nature of the product or/and services provided by such Sub-processor.
− - **List of Current Sub-processors and Notification of New Sub-processors. **Attached hereto as Schedule 2 is a current list of Sub-processors for the Services. Such Sub-processors list shall include the identities of those Sub-processors, their country of location as well as the type of processing they perform. Insider One will notify Customer of a new Sub-processor(s) before authorizing any new Sub-processor(s) to Process Personal Data in connection with the provision of the applicable Services.
− - **Objection Right for New Sub-processors. **Customer may object to Insider One’s use of a new Sub-processor by notifying Insider One promptly in writing within ten (10) business days after receipt of Insider One’s notice in accordance with Schedule 2. In the event Customer objects to a new Sub-processor, as permitted in the preceding sentence, Insider One will use reasonable efforts to make available to Customer a change in the Services or recommend a commercially reasonable change to Customer’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new Sub-processor without unreasonably burdening Customer. If Insider One is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may terminate the applicable Order Form(s) with respect only to those Services which cannot be provided by Insider One without the use of the objected-to new Sub-processor, by providing written notice to Insider One. Insider One will refund to Customer any prepaid fees covering the remainder of the term of such Order Form(s) following the effective date of termination with respect to such terminated Services, without imposing a penalty for such termination on Customer.
− - **Liability for Sub-processors. **Insider One shall be liable for the acts and omissions of its Sub-processors to the same extent Insider One would be liable if performing the services of each Sub-processor directly under the terms of this DPA.
− ****
− ****
− -
− ##### **SECURITY**
− - **Controls for the Protection of Customer Data. **Insider One shall maintain appropriate technical and organizational measures for protection of the security (including protection against Personal Data Breach), confidentiality and integrity of Customer Data, as set forth in the Security, Privacy and Architecture Datasheet attached hereto as Schedule 1. Insider One regularly monitors compliance with these measures. Customer is responsible for reviewing the information made available by Insider One relating to data security and making an independent determination as to whether the Services meet Customer’s requirements and legal obligations under Data Protection Laws and Regulations. Customer acknowledges that the security measures described within the Security, Privacy and Architecture Datasheet are subject to technical progress and development and that Insider One may update or modify such document from time to time provided that such updates and modifications do not result in a material decrease of the overall security of the Services during a subscription term.
− - **Customer Data Incident Management and Notification. **Insider One maintains security incident management policies and procedures specified in the Security, Privacy and Architecture Datasheet and shall notify Customer without undue delay after becoming aware of a Personal Data Breach. Insider One shall provide information to Customer necessary to enable Customer to comply with its obligations under Data Protection Laws and Regulations in relation to such Personal Data Breach. The content of such communication to Customer will (i) include the nature of Processing and the information available to Insider One, and (ii) take into account that under applicable Data Protection Laws and Regulations, Customer may need to notify regulators or individuals of the following:
− (a) a description of the nature of the Personal Data Breach including, where possible, the categories and approximate number of individuals concerned and the categories and approximate number of Personal Data records concerned; (b) a description of the likely consequences of the Personal Data Breach; and (c) a description of the measures taken or proposed to be taken to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects. Insider One shall make commercially reasonable efforts to identify the cause of such Personal Data Breach and take those steps as Insider One deems necessary and reasonable in order to remediate the cause of such Personal Data Breach to the extent the remediation is within Insider One’s reasonable control. The obligation to remediate the cause of a Personal Data Breach shall not apply to Personal Data Breaches that are caused by Customer or Customer’s Users.
− **6.3. Third-Party Certifications and Audits. **Insider One has obtained the third-party certifications and audits set forth in the Security, Privacy and Architecture Datasheet. Upon Customer’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, Insider One shall make available to Customer (or Customer’s independent, third-party auditor that is not a competitor of Insider One and that is subject to confidentiality obligations substantially similar to those set forth in the Agreement) a copy of Insider One’s then most recent third-party audits or certifications, as applicable, that Insider One makes available to its customers generally.
− -
− ##### **RETURN AND DELETION OF CUSTOMER DATA**
− -
− ##### **AFFILIATES**
− - **Relationship between Insider One and Customer’s Authorized Affiliates. **The parties acknowledge and agree that, by executing the Agreement, the Customer enters into this DPA on behalf of itself and, as applicable, in the name and on behalf of its Authorized Affiliates, thereby establishing an independent DPA between Insider One and each such Authorized Affiliate, subject to the provisions of the Agreement and this Section 8 and Section 9. Each Authorized Affiliate agrees to be bound by the obligations under this DPA and, to the extent applicable, the Agreement. For sake of clarity, an Authorized Affiliate is not and does not become a party to the Agreement and is only a party to this DPA. All access to and use of the Services by Authorized Affiliates must comply with the terms and conditions of the Agreement and any violation of the terms and conditions of the Agreement by an Authorized Affiliate shall be deemed a violation by Customer.
− - **Communication. **The Customer that is the contracting party to the Agreement shall remain responsible for coordinating all communication with Insider One under this DPA and be entitled to make and receive any communication in relation to this DPA on behalf of its Affiliates and Authorized Affiliates.
− - **Data Controller Rights of Affiliates and Authorized Affiliates. **Any Affiliate or Authorized Affiliate shall, to the extent required under applicable Data Protection Laws and Regulations, be entitled to exercise the rights and seek remedies under this DPA, subject to the following:
− - solely the Customer that is the contracting party to the Agreement shall exercise any such right (including any Audit right) or seek any such remedy on behalf of such Affiliate or Authorized Affiliate,
− - the Customer that is the contracting party to the Agreement shall exercise any such rights under this DPA not separately for each Affiliate or Authorized Affiliate individually but in a combined manner for all of its Affiliate and Authorized Affiliates together, and
− - when carrying out an on-site Audit, take all reasonable measures to limit any impact on Insider One and its Sub- Processors by combining, to the extent reasonably possible, several Audit requests carried out on behalf of different Affiliate and Authorized Affiliates in one single Audit.
− -
− ##### **LIMITATION OF LIABILITY**
− - Each party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to this DPA, and all DPAs between Authorized Affiliates and Insider One, whether in contract, tort or under any other theory of liability, is subject to the ‘Limitation of Liability’ section of the Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and all DPAs together.
− **9.2. **Without prejudice to any other provision of this DPA and subject always to the “Limitation of Liability” section of the Agreement, and to the maximum extent permitted by applicable law, Insider One shall have no liability for any loss, damage, harm, penalty, cost, claim, or legal or regulatory violation—whether direct, indirect, incidental, consequential, exemplary, punitive, special, regulatory, or reputational—arising out of or in connection with the Customer’s use of, reliance upon, or disclosure of any output, insight, suggestion, recommendation, prediction, summary, classification, explanation, risk assessment, decision proposal, content generation, data transformation, or any other result, guidance, analysis, or information produced by the AI Systems (each, an “AI Output”).
− -
− ##### **USE OF ARTIFICIAL INTELLIGENCE**
− - **Customer Due Diligence Obligation. **The Customer acknowledges and accepts that any result, insight, suggestion, recommendation, prediction, summary, classification, explanation, risk assessment, decision proposal, content generation, data transformation, or other guidance, analysis, or information produced by the AI Systems (each, an “AI Output”) may be imprecise, inaccurate, misleading, contextually inappropriate, or non compliant with applicable laws or regulations. The Customer therefore agrees to exercise independent judgement, oversight, and due diligence before using, relying on, or distributing any AI Output.
− - **No AI Training on Customer Data. **Insider One shall not use any Customer Data—including prompts, inputs, AI Outputs, or other Personal Data—for the purpose of training, fine‑tuning, or otherwise developing or improving any artificial‑intelligence or machine‑learning models, whether proprietary to Insider One or provided by a third party, except where the Parties have expressly agreed otherwise, or where a contrary provision is set out in other documentation governing the Insider One Services. This restriction applies irrespective of whether the data is anonymised, pseudonymised, or aggregated, and will remain in effect for the Term of the Agreement.
− - **Permitted AI Processing. **Except where the Parties have expressly agreed otherwise or where a contrary provision is set out in other documentation governing the Insider One Services, any Processing of Customer Data by or through the AI Systems shall be undertaken solely (i) to deliver the Services under the Agreement, (ii) in accordance with the Customer’s documented instructions, and
− (iii) in full compliance with applicable Data Protection Laws and Regulations.
− - **Automated Decisions. **Where the use of AI Systems constitutes an Automated Decision Making operation that produces legal or similarly significant effects on Data Subjects, Insider One shall not perform such Processing unless expressly requested in writing by the Customer and subject to appropriate safeguards, such as human oversight, transparency, and—where required—data protection impact assessments.
− - **Documentation and Cooperation. **Upon the Customer’s reasonable written request, Insider One shall (i) provide available technical, organisational, and legal documentation regarding its AI related Processing activities and (ii) cooperate in good faith with the Customer in connection with any data protection impact assessment or regulatory inquiry concerning the AI Systems. Also, Insider One shall provide reasonable technical, administrative, and organizational assistance upon Customer’s request to facilitate the Customer’s conduct of Data Protection Impact Assessments (DPIAs), particularly regarding the use of AI-driven features such as MindBehind, in compliance with applicable Data Protection Laws.
− - **AI Transparency and Output Ownership**
− - **Model Transparency**. Upon the Customer’s reasonable written request, Insider One shall disclose the categories of artificial intelligence and machine learning models used within the Services and indicate whether such models are proprietary to Insider One or sourced from third party vendors, provided that Insider One is not required to reveal trade secrets, model architectures, or other commercially sensitive information.
− - **Material Changes. **Insider One shall give the Customer prior notice of any material change to the AI Systems that would significantly alter the scope or nature of the Processing of Customer Data, including switching AI providers, introducing new model types, or materially modifying automated decision logic.
− - **Output Ownership. **Except where the parties have expressly agreed otherwise or where a contrary provision is set out in other documentation governing the Insider One Services, Insider One shall not acquire any ownership rights in AI Outputs generated by or on behalf of the Customer through use of the Services. Insider One may use such AI Outputs solely to deliver the Services under the Agreement and shall not exploit them for any other purpose without the Customer’s prior written authorisation. Nothing in this clause restricts Insider One from enhancing or developing its Services, provided that such enhancements do not use—or are not derived from—Customer Data or Customer specific AI Outputs without the Customer’s prior written consent.
− ****
− ****
− -
− ##### **EUROPEAN SPECIFIC PROVISIONS**
− - **Data Protection Impact Assessment. **Upon Customer’s request, Insider One shall provide Customer with reasonable cooperation and assistance needed to fulfill Customer’s obligation under the GDPR to carry out a data protection impact assessment related to Customer’s use of the Services, to the extent Customer does not otherwise have access to the relevant information, and to the extent such information is available to Insider One. Insider One shall provide reasonable assistance to Customer in the cooperation or prior consultation with the Supervisory Authority (as defined in the GDPR) in the performance of its tasks relating to this Section 10.1 of this DPA, to the extent required under the GDPR.
− - **Infringing instructions. **Insider One shall immediately inform the Customer if, in its opinion, an instruction infringes GDPR.
− - **European audit right. **Where Customer or an Affiliate or an Authorized Affiliate is subject to the privacy laws of the European Union, Switzerland, the European Economic Area and/or their member states and the United Kingdom, Insider One shall allow for and contribute to audits and inspections (“Audits”) conducted by Customer (or Customer’s independent, third-party auditor that is not a competitor of Insider One and that is subject to confidentiality obligations substantially similar to those set forth in the Agreement), by providing any information regarding Insider One’s compliance with the obligations set forth in this DPA in the form of a copy of Insider One’s then most recent third-party audits or certifications, as applicable, that Insider One makes available to its customers generally. Where Customer wishes to perform an on-site Audit, Customer may do so up to one (1) time per year, with at least three (3) week’s advance written notice, unless otherwise required by Customer’s, or its Affiliate’s or Authorized Affiliate’s regulators or law applicable to either of them. If Customer requests an on-site Audit, the following terms shall apply: (a) such Audit shall be limited to facilities operated by Insider One, (b) such Audit shall not exceed one (1) business day; (c) before the commencement of any such Audit, Customer and Insider One shall mutually agree upon the scope, cost and timing of the Audit; and (d) Customer shall promptly notify Insider One
+  **Last Updated: October 2026**
+ This Data Processing Addendum (“DPA”) forms part of the Master Subscription Agreement or other written or electronic agreements between Insider One and Customer (the “Agreement”) for the purchase of online services from Insider One (identified either as “Services” or otherwise in the applicable agreement, and hereinafter defined as “Services”) to reflect the parties’ agreement with regard to the Processing of Personal Data.
+ In the course of providing the Services to Customer pursuant to the Agreement, Insider One may Process Personal Data on behalf of Customer, and the Parties agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith. For the avoidance of doubt, each reference to the DPA in this DPA means this DPA including its Schedules. In the event of any conflict between this DPA and the Agreement with respect to the Processing of Personal Data, this DPA shall prevail to the extent of the conflict.
+ **DATA PROCESSING TERMS**
+ - ** DEFINITIONS**
+ **“Authorized Affiliate”** means any of Customer’s Affiliate(s) which (i) is subject to the data protection laws and regulations of the European Union, the European Economic Area and/or their member states and/or the United Kingdom, and (ii) is permitted to use the Services pursuant to the Agreement between Customer and Insider One but has not signed its own Order Form with Insider One and is not a “Customer” as defined under the Agreement.
+ **“AI Act”** means Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), as amended from time to time; and “Provider” and “Deployer” have the meanings given to them in the AI Act.
+ **“CCPA”** means the California Consumer Privacy Act 2018, Cal. Civ. Code § 1798.100 et seq., and its implementing regulations, as the same may be amended from time to time.
+ **“Controller”** means the entity which determines the purposes and means of the Processing of Personal Data.
+ **“Customer Data”** means what is defined in the Agreement as “Customer Data.”
+ **“Data Protection Laws and Regulations”** means all laws and regulations, including GDPR and CCPA, applicable to a Party in its use or provision of the Services, in connection with the Processing of Personal Data under the Agreement.
+ **“Data Subject”** means the identified or identifiable natural person to whom Personal Data relates.
+ **“Data Subject Right”** means any right afforded to a Data Subject under Data Protection Laws and Regulations, including the rights to access, rectify, restrict the Processing of Personal Data, erasure (including the right to be forgotten), data portability, objecting to the Processing, or to not be subject to an automated individual decision making.
+ **“GDPR”** means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
+ **“Personal Data”** means any information relating to an identified or identifiable natural person where such data is Customer Data.
+ **“Processing”** means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
+ **“Processor”** means the entity which Processes Personal Data on behalf of the Controller.
+ **“Personal Data Breach”** means a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data, transmitted, stored or otherwise Processed by Insider One or its Sub-processors of which Insider One becomes aware.
+ **“Security, Privacy and Architecture Datasheet”** means the Security, Privacy and Architecture Datasheet for the Insider One Services, as updated from time to time.
+ **“Standard Contractual Clauses”** or “SCC” means the agreement by and between Customer and Insider One, pursuant to the European Commission’s decision on Standard Contractual Clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, a copy of which can be found at https://www.insiderone.com/legal.
+ **“Sub-processor”** means any Processor engaged by Insider One or its Affiliates engaged in the Processing of Personal Data.
+ **“AI Systems”** means any artificial‑intelligence models, machine‑learning algorithms, large‑language models, predictive‑analytics tools or similar technologies that Insider One uses, provides or otherwise makes available in connection with the Services.
+ **“AI Outputs”** means any content, dataset, analysis, recommendation, classification, prediction, insight, report or other material that is generated, derived from or otherwise influenced by AI Systems.
+ - ** PROCESSING OF PERSONAL DATA**
+ **2.1 Details of the Processing.** The parties acknowledge and agree that with regard to the Processing of Personal Data, Customer is the Controller, Insider One is the Processor and that Insider One or its Affiliates engaged in the Processing of Personal Data will engage Sub-processors pursuant to the requirements set forth in Schedule 2 “Sub-processors” below. The subject- matter of Processing of Personal Data by Insider One is the performance of the Services pursuant to the Agreement. The duration of the Processing, the nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects Processed under this DPA are further specified in Schedule 3 (Details of the Processing) to this DPA.
+ **2.2 Customer’s Processing of Personal Data.** Customer shall, in its use of the Services, Process Personal Data in accordance with the requirements of Data Protection Laws and Regulations. For the avoidance of doubt, Customer’s instructions for the Processing of Personal Data shall comply with Data Protection Laws and Regulations. This DPA and the Agreement are, at the time of signature of the Agreement, Customer’s complete and final documented instructions to Insider One for the Processing of Personal Data, and Customer’s configuration of the Services shall constitute an additional instruction to Insider One. Any additional or alternate instructions must be agreed upon separately. Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired the Personal Data.
+ **2.3 Insider One’s Processing of Personal Data.** Insider One shall treat Personal Data as Confidential Information and shall only Process Personal Data on behalf of Customer and in accordance with Customer’s documented instructions for the following purposes: (i) Processing in accordance with the Agreement and applicable Order Form(s); (ii) Processing initiated by Users in their use of the Services; and (iii) Processing to comply with other documented reasonable instructions provided by Customer (e.g., via email) where such instructions are consistent with the terms of the Agreement. Insider One will Process Personal Data in compliance with applicable Data Protection Laws and Regulations, provided however that Insider One shall not be in violation of this contractual obligation in the event that Insider One’s Processing of Personal Data in non-compliance with applicable Data Protection Laws and Regulations is due to Customer. Insider One shall maintain and regularly update a comprehensive Register of Processing Activities (RoPA), including all processing activities related to the MindBehind service, clearly documenting Insider One’s deletion policies and its technical and organizational measures in accordance with Article 30(2) GDPR.
+ **2.4 Customer Responsibilities. **Without prejudice to Section 2.2, Customer shall be solely responsible for: (a) establishing and documenting a valid legal basis under Data Protection Laws and Regulations for the Processing of Personal Data through the Services, whether through AI Systems or otherwise, including obtaining, recording and maintaining any consents required for both AI-enabled and non-AI Processing (including consents for the use of tracking technologies and for the sending of Messages), and honouring withdrawals of consent and opt-outs; (b) the lawfulness of any Personal Data that Customer obtains from third parties (including Affiliates, business partners, data providers and acquired lists) and submits to the Services, including that such data was lawfully collected and transferred , that the relevant Data Subjects have been informed as required, and that Customer is entitled to transfer such data to Insider One for Processing as contemplated by the Agreement; (c) the accuracy and currency of the consent, opt-in, subscription and preference status transmitted to or configured in the Services, on which Insider One relies without independent verification and the content, wording, scope and validity of which Insider One has no means of knowing and/or is under no obligation to independently verify ; (d) its configuration and use of the Services, including any settings, features or instructions that cause Messages to be sent irrespective of subscription status, the activation and use of AI Systems, retention and deletion settings, and the selection of channels; (e) providing Data Subjects with the information required under Data Protection Laws and Regulations, including privacy notices that identify Insider One or the categories of its processors where required; (f) not submitting to the Services any Restricted Information (as defined in the Agreement) or special categories of Personal Data unless expressly agreed in writing; and (g) determining whether the Services, including any particular feature, channel or configuration, are suitable for and compliant with the laws applicable to Customer’s industry and jurisdiction and (h) implementing and maintaining all appropriate technical and organisational security measures within Customer’s control in connection with the Processing of Personal Data through the Services, including but not limited to safeguarding access credentials (such as passwords, API keys and access tokens), preventing their disclosure to or use by unauthorised persons, implementing appropriate authentication and access controls, managing and promptly revoking user access rights when necessary, and ensuring the security of Customer’s own devices, systems, networks and integrations used in connection with the Services. Insider One shall not be in breach of this DPA, and shall have no liability under this DPA or the Agreement, to the extent that any non-compliance results from Customer’s instructions or configuration, Customer’s breach of Section 2.2 or this Section 2.4, or Customer’s failure to comply with the use guidelines and customer responsibilities set out in the Agreement.
+ - ** RIGHTS OF DATA SUBJECTS**
+ **3.1 Data Subject Requests.** Insider One shall, to the extent legally permitted and to the extent Insider One has been able to identify that the request comes from a Data Subject whose Personal Data was submitted to the Services by Customer, promptly notify Customer if Insider One receives a request from a Data Subject in relation to the exercise of any Data Subject Right (“Data Subject Request”). Insider One will confirm to the Data Subject that it has passed the request to the Customer, but Insider One shall not handle or execute the Data Subject Request.
+ 3.2 Taking into account the nature of the Processing, Insider One shall assist Customer by providing appropriate and necessary technical and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to a Data Subject Request under Data Protection Laws and Regulations.
+ - ** INSIDER ONE PERSONNEL**
+ **4.1 Confidentiality.** Insider One shall ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities and have executed written confidentiality agreements. Insider One shall ensure that such confidentiality obligations survive the termination of the personnel engagement.
+ **4.2 Reliability.** Insider One shall take commercially reasonable steps to ensure the reliability of any Insider One personnel engaged in the Processing of Personal Data.
+ **4.3 Limitation of Access.** Insider One shall ensure that Insider One’s access to Personal Data is limited to those personnel performing Services in accordance with the Agreement.
+ **4.4 Data Protection Officer.** Insider One has appointed a data protection officer for Insider One and its Affiliates. The appointed person can be reached at [[email protected]](/cdn-cgi/l/email-protection).
+ - ** SUB-PROCESSORS**
+ **5.1 Appointment of Sub-processors.** Customer acknowledges and agrees that (a) Insider One’s Affiliates may be retained as Sub-processors; and (b) Insider One and Insider One’s Affiliates respectively may engage third-party Sub-processors in connection with the provision of the Services. Insider One or an Insider One Affiliate has entered into a written agreement with each Sub-processor containing data protection obligations not less protective than those in this DPA with respect to the protection of Personal Data to the extent applicable to the nature of the product or/and services provided by such Sub-processor.
+ **5.2 List of Current Sub-processors and Notification of New Sub-processors.** Attached hereto as Schedule 2 is a current list of Sub-processors for the Services. Such Sub-processors list shall include the identities of those Sub-processors, their country of location (and, where applicable, hosting region), the type of processing they perform and the Services in connection with which they are engaged. Insider One will notify Customer of a new Sub-processor(s) before authorizing any new Sub-processor(s) to Process Personal Data in connection with the provision of the applicable Services.
+ **5.3 Objection Right for New Sub-processors.** Customer may object to Insider One’s use of a new Sub-processor by notifying Insider One promptly in writing within ten (10) business days after receipt of Insider One’s notice in accordance with Schedule 2. In the event Customer objects to a new Sub-processor, as permitted in the preceding sentence, Insider One will use reasonable efforts to make available to Customer a change in the Services or recommend a commercially reasonable change to Customer’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new Sub-processor without unreasonably burdening Customer. If Insider One is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may terminate the applicable Order Form(s) with respect only to those Services which cannot be provided by Insider One without the use of the objected-to new Sub-processor, by providing written notice to Insider One. Insider One will refund to Customer any prepaid fees covering the remainder of the term of such Order Form(s) following the effective date of termination with respect to such terminated Services, without imposing a penalty for such termination on Customer.
+ **5.4 Liability for Sub-processors.** Insider One shall be liable for the acts and omissions of its Sub-processors to the same extent Insider One would be liable if performing the services of each Sub-processor directly under the terms of this DPA.
+ - ** SECURITY**
+ **6.1 Controls for the Protection of Customer Data.** Insider One shall maintain appropriate technical and organizational measures for protection of the security (including protection against Personal Data Breach), confidentiality and integrity of Customer Data, as set forth in the Security, Privacy and Architecture Datasheet attached hereto as Schedule 1. Insider One regularly monitors compliance with these measures. Customer is responsible for reviewing the information made available by Insider One relating to data security and making an independent determination as to whether the Services meet Customer’s requirements and legal obligations under Data Protection Laws and Regulations. Customer acknowledges that the security measures described within the Security, Privacy and Architecture Datasheet are subject to technical progress and development and that Insider One may update or modify such document from time to time provided that such updates and modifications do not result in a material decrease of the overall security of the Services during a subscription term.
+ **6.2 Customer Data Incident Management and Notification.** Insider One maintains security incident management policies and procedures specified in the Security, Privacy and Architecture Datasheet and shall notify Customer without undue delay, and in any event no later than seventy-two (72) hours, after becoming aware of a Personal Data Breach. Insider One shall provide information to Customer necessary to enable Customer to comply with its obligations under Data Protection Laws and Regulations in relation to such Personal Data Breach. The content of such communication to Customer will (i) include the nature of Processing and the information available to Insider One, and (ii) take into account that under applicable Data Protection Laws and Regulations, Customer may need to notify regulators or individuals of the following: (a) a description of the nature of the Personal Data Breach including, where possible, the categories and approximate number of individuals concerned and the categories and approximate number of Personal Data records concerned; (b) a description of the likely consequences of the Personal Data Breach; and (c) a description of the measures taken or proposed to be taken to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.Where, and insofar as, it is not possible to provide all of the foregoing information at the same time, Insider One may provide the information in phases as it becomes available, without undue further delay. Insider One’s notification of, or response to, a Personal Data Breach shall not be construed as an acknowledgement by Insider One of any fault or liability with respect to such Personal Data Breach. Customer shall, where reasonably practicable and to the extent permitted by Data Protection Laws and Regulations, consult with Insider One before naming Insider One in any notification to a supervisory authority, Data Subjects or the public concerning a Personal Data Breach. Insider One shall make commercially reasonable efforts to identify the cause of such Personal Data Breach and take those steps as Insider One deems necessary and reasonable in order to remediate the cause of such Personal Data Breach to the extent the remediation is within Insider One’s reasonable control. The obligation to remediate the cause of a Personal Data Breach shall not apply to Personal Data Breaches that are caused by Customer or Customer’s Users.
+ **6.3. Third-Party Certifications and Audits.** Insider One has obtained the third-party certifications and audits set forth in the Security, Privacy and Architecture Datasheet. Upon Customer’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, Insider One shall make available to Customer (or Customer’s independent, third-party auditor that is not a competitor of Insider One and that is subject to confidentiality obligations substantially similar to those set forth in the Agreement) a copy of Insider One’s then most recent third-party audits or certifications, as applicable, that Insider One makes available to its customers generally.
+ - ** RETURN AND DELETION OF CUSTOMER DATA**
+ - ** AFFILIATES**
+ **8.1 Relationship between Insider One and Customer’s Authorized Affiliates.** The parties acknowledge and agree that, by executing the Agreement, the Customer enters into this DPA on behalf of itself and, as applicable, in the name and on behalf of its Authorized Affiliates, thereby establishing an independent DPA between Insider One and each such Authorized Affiliate, subject to the provisions of the Agreement and this Section 8 and Section 9. Each Authorized Affiliate agrees to be bound by the obligations under this DPA and, to the extent applicable, the Agreement. For sake of clarity, an Authorized Affiliate is not and does not become a party to the Agreement and is only a party to this DPA. All access to and use of the Services by Authorized Affiliates must comply with the terms and conditions of the Agreement and any violation of the terms and conditions of the Agreement by an Authorized Affiliate shall be deemed a violation by Customer.
+ **8.2 Communication.** The Customer that is the contracting party to the Agreement shall remain responsible for coordinating all communication with Insider One under this DPA and be entitled to make and receive any communication in relation to this DPA on behalf of its Affiliates and Authorized Affiliates.
+ **8.3 Data Controller Rights of Affiliates and Authorized Affiliates.** Any Affiliate or Authorized Affiliate shall, to the extent required under applicable Data Protection Laws and Regulations, be entitled to exercise the rights and seek remedies under this DPA, subject to the following:
+ (i) solely the Customer that is the contracting party to the Agreement shall exercise any such right (including any Audit right) or seek any such remedy on behalf of such Affiliate or Authorized Affiliate,
+ (ii) the Customer that is the contracting party to the Agreement shall exercise any such rights under this DPA not separately for each Affiliate or Authorized Affiliate individually but in a combined manner for all of its Affiliate and Authorized Affiliates together, and
+ (iii) when carrying out an on-site Audit, take all reasonable measures to limit any impact on Insider One and its Sub-Processors by combining, to the extent reasonably possible, several Audit requests carried out on behalf of different Affiliate and Authorized Affiliates in one single Audit.
+ - ** LIMITATION OF LIABILITY**
+ 9.1 Each party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to this DPA, and all DPAs between Authorized Affiliates and Insider One, whether in contract, tort or under any other theory of liability, is subject to the ‘Limitation of Liability’ section of the Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and all DPAs together.
+ 9.2. Without prejudice to any other provision of this DPA and subject always to the “Limitation of Liability” section of the Agreement, and to the maximum extent permitted by applicable law, Insider One shall have no liability for any loss, damage, harm, penalty, cost, claim, or legal or regulatory violation—whether direct, indirect, incidental, consequential, exemplary, punitive, special, regulatory, or reputational—arising out of or in connection with the Customer’s use of, reliance upon, or disclosure of any output, insight, suggestion, recommendation, prediction, summary, classification, explanation, risk assessment, decision proposal, content generation, data transformation, or any other result, guidance, analysis, or information produced by the AI Systems.
+ 9.3. Customer Responsibility. Customer shall be responsible for, and shall defend, indemnify and hold harmless Insider One and its Affiliates from and against, all damages, fines, penalties, costs (including reasonable legal fees) and claims, including claims by Data Subjects, supervisory authorities, telecommunications carriers and Channel Providers (as defined in the Agreement), to the extent arising from (i) Customer’s breach of Section 2.2 or Section 2.4 of this DPA; (ii) Customer’s instructions or configuration of the Services; (iii) Messages sent to Data Subjects who have not validly consented or who have opted out, where such sending results from the consent, subscription or preference status provided or configured by Customer or from Customer’s instructions; or (iv) Customer’s use of, reliance on or distribution of AI Outputs. This Section 9.3 applies in addition to, and without limiting, Customer’s indemnification obligations under the Agreement, and is excluded from the limitations of liability to the extent provided in the “Limitation of Liability” section of the Agreement.
+ - ** USE OF ARTIFICIAL INTELLIGENCE**
+ **10.1 Customer Due Diligence Obligation.** The Customer acknowledges and accepts that any result, insight, suggestion, recommendation, prediction, summary, classification, explanation, risk assessment, decision proposal, content generation, data transformation, or other guidance, analysis, or information produced by the AI Systems may be imprecise, inaccurate, misleading, contextually inappropriate, or non compliant with applicable laws or regulations. The Customer therefore agrees to exercise independent judgement, oversight, and due diligence before using, relying on, or distributing any AI Output.
+ **10.2 No AI Training on Customer Data.** Insider One shall not use any Customer Data—including prompts, inputs, AI Outputs, or other Personal Data—for the purpose of training, fine‑tuning, or otherwise developing or improving any artificial‑intelligence or machine‑learning models, whether proprietary to Insider One or provided by a third party, except where the Parties have expressly agreed otherwise, or where a contrary provision is set out in other documentation governing the Insider One Services. This restriction applies irrespective of whether the data is anonymised, pseudonymised, or aggregated, and will remain in effect for the Term of the Agreement.
+ **10.3 Permitted AI Processing.** Except where the Parties have expressly agreed otherwise or where a contrary provision is set out in other documentation governing the Insider One Services, any Processing of Customer Data by or through the AI Systems shall be undertaken solely (i) to deliver the Services under the Agreement, (ii) in accordance with the Customer’s documented instructions, and (iii) in full compliance with applicable Data Protection Laws and Regulations.
+ **10.4 Automated Decisions.** Where the use of AI Systems constitutes an Automated Decision Making operation that produces legal or similarly significant effects on Data Subjects, Insider One shall not perform such Processing unless expressly requested in writing by the Customer and subject to appropriate safeguards, such as human oversight, transparency, and—where required—data protection impact assessments.
+ **10.5 Documentation and Cooperation.** Upon the Customer’s reasonable written request, Insider One shall (i) provide available technical, organisational, and legal documentation regarding its AI related Processing activities and (ii) cooperate in good faith with the Customer in connection with any data protection impact assessment or regulatory inquiry concerning the AI Systems. Also, Insider One shall provide reasonable technical, administrative, and organizational assistance upon Customer’s request to facilitate the Customer’s conduct of Data Protection Impact Assessments (DPIAs), particularly regarding the use of AI-driven features such as MindBehind, in compliance with applicable Data Protection Laws.
+ **10.6 AI Transparency and Output Ownership**
+ **10.6.1 Model Transparency.** Upon the Customer’s reasonable written request, Insider One shall disclose the categories of artificial intelligence and machine learning models used within the Services and indicate whether such models are proprietary to Insider One or sourced from third party vendors, provided that Insider One is not required to reveal trade secrets, model architectures, or other commercially sensitive information.
+ **10.6.2 Material Changes.** Insider One shall give the Customer prior notice of any material change to the AI Systems that would significantly alter the scope or nature of the Processing of Customer Data, including switching AI providers, introducing new model types, or materially modifying automated decision logic.
+ **10.6.3 Output Ownership.** Except where the parties have expressly agreed otherwise or where a contrary provision is set out in other documentation governing the Insider One Services, Insider One shall not acquire any ownership rights in AI Outputs generated by or on behalf of the Customer through use of the Services. Insider One may use such AI Outputs solely to deliver the Services under the Agreement and shall not exploit them for any other purpose without the Customer’s prior written authorisation. Nothing in this clause restricts Insider One from enhancing or developing its Services, provided that such enhancements do not use—or are not derived from—Customer Data (other than Aggregated Data, as defined in and to the extent permitted under the Agreement) or Customer specific AI Outputs without the Customer’s prior written consent.
+ **10.7 EU AI Act**
+ **10.7.1 Roles.** The parties acknowledge that, for the purposes of the AI Act and to the extent the AI Act applies to the Processing or use in question, (i) Insider One is the Provider of the AI Systems that it develops and makes available under its own name as part of the Services, including where such AI Systems are built on general-purpose AI models supplied by third-party Sub-processors; and (ii) Customer is the Deployer of such AI Systems when it uses them in the course of its business. Each party shall comply with the obligations applicable to its role under the AI Act. Nothing in this DPA transfers to Insider One any obligation that the AI Act imposes on Customer as Deployer, including obligations relating to human oversight, the monitoring of the operation of the AI Systems in Customer’s context, the information of Customer’s employees, workers’ representatives or End Users where required, and the transparency of Customer’s own use of AI Outputs.
+ **10.7.2 Intended Purpose and Permitted Use.** The AI Systems are designed, developed and made available by Insider One solely for marketing, customer engagement and support, personalisation, content generation, analytics and related purposes as described in the Documentation, and are not intended for use as, or as a component of, a high-risk AI system within the meaning of Article 6 of the AI Act. Customer shall not use, and shall not permit its Users or Affiliates to use, the AI Systems or AI Outputs: (a) for any practice prohibited under Article 5 of the AI Act, including the use of subliminal, manipulative or deceptive techniques, the exploitation of the vulnerabilities of natural persons due to their age, disability or social or economic situation, social scoring, emotion recognition in the workplace or in educational institutions, or biometric categorisation on the basis of sensitive attributes; (b) for any purpose listed in Annex III of the AI Act or that would otherwise cause an AI System to qualify as a high-risk AI system, including to evaluate the creditworthiness of natural persons, to determine access to or eligibility for insurance, credit, employment, education, housing, healthcare or essential public or private services, or for law enforcement, migration, asylum, border control or judicial purposes; (c) to make decisions producing legal or similarly significant effects on Data Subjects otherwise than in accordance with Section 10.4; or (d) in a manner that changes the intended purpose of an AI System or substantially modifies an AI System. Any such use shall be at Customer’s sole risk; Customer acknowledges that it may thereby become a Provider within the meaning of Article 25 of the AI Act and shall be solely responsible for all obligations arising therefrom.
+ **10.7.3 Transparency.** Where an AI System is designed to interact directly with natural persons (i.e. conversational or chatbot features), Insider One will design and develop such AI System so that the natural persons concerned can be informed that they are interacting with an AI system, in accordance with Article 50(1) of the AI Act. Where an AI System generates synthetic text, image, audio or video content, Insider One will implement the marking measures required of it as Provider under Article 50(2) of the AI Act, to the extent applicable and technically feasible. Customer shall (i) not remove, disable or circumvent any AI notice, label or marking implemented by Insider One; (ii) comply with the transparency obligations that apply to it as Deployer under Article 50 of the AI Act and under any other applicable law, including the disclosure to End Users, where required, that content has been artificially generated or manipulated; and (iii) configure and use the AI Systems so that End Users are informed of the use of AI where such information is required by applicable law.
+ **10.7.4 Human Oversight and AI Literacy.** Customer shall ensure that the Users who operate or rely on the AI Systems have a sufficient level of AI literacy, taking into account their technical knowledge, experience, education and training and the context in which the AI Systems are used, and shall apply appropriate human oversight and review before acting on or publishing AI Outputs. Insider One will make available Documentation and instructions of use describing the capabilities, limitations and intended purpose of the AI Systems and will support Customer’s AI literacy efforts by providing reasonable information about the AI Systems upon request.
+ **10.7.5 Cooperation and Incidents.** Each party shall provide the other with reasonable cooperation and information to enable the other party to comply with its obligations under the AI Act, including in responding to requests or inquiries from competent market surveillance or supervisory authorities. Customer shall promptly inform Insider One if it becomes aware of any serious incident, malfunction or risk to health, safety or fundamental rights involving an AI System, or of any use of an AI System that may be inconsistent with this Section 10.7. Insider One shall inform Customer, in accordance with Section 10.6.2, of material changes to the AI Systems, and shall notify Customer of any serious incident involving an AI System that Insider One is required to report under the AI Act and that affects Customer’s use of the Services.
+ **10.7.6 Records and Regulatory Developments.** Insider One shall maintain such technical documentation and records relating to the AI Systems as are required of it as Provider under the AI Act. The parties acknowledge that the obligations under the AI Act become applicable in stages and may be amended or supplemented by delegated acts, guidelines, harmonised standards and codes of practice; Insider One may update the AI Systems, the Documentation and this Section 10.7 in accordance with Section 12 of this DPA to reflect such developments.
+ **10.7.7 White-Label Deployment. **Where Customer makes an AI System available to End Users or other third parties under its own name or trademark, including by re-branding or embedding the AI System in a Customer Application without identifying Insider One as its provider, or otherwise places an AI System on the market or puts it into service under its own name or trademark, Customer shall be the Provider of such AI System for the purposes of the AI Act and shall be solely responsible for all obligations attaching to the Provider, including the transparency obligations under Article 50(1) and (2) of the AI Act, the preparation and maintenance of technical documentation and instructions of use, and the assessment of the risk classification of the AI System in the context of Customer’s deployment. In such case, Insider One acts solely as a supplier of the underlying technology, and Insider One’s obligations under Sections 10.7.3 and 10.7.6 apply only to the functionality made available by Insider One. Upon Customer’s reasonable written request and subject to Section 10.6.1, Insider One shall provide the information and technical assistance reasonably necessary for Customer to comply with its obligations as Provider. Customer’s obligations as Provider are subject to Section 9.3. The Parties confirm that Insider One does not assume any obligations as a Provider towards Customer’s End Users.
+ **10.7.8 Instructions of Use.** The Documentation constitutes the instructions of use of the AI Systems for the purposes of the AI Act. Customer shall use the AI Systems in accordance with the Documentation and shall ensure that its Affiliates, Users and any agency or other third party acting on its behalf do so, and shall remain liable for their acts and omissions. The parties acknowledge that the AI Systems, when used in accordance with the Documentation, are not high-risk AI systems within the meaning of Article 6 of the AI Act, and that Insider One’s obligations under this Section 10.7 do not extend to any use of the AI Systems outside the Documentation or their intended purpose.