Data Processing Agreement

As between the Parties, Customer is the Controller of the Personal Data, and Catalystium acts as Processor. Where Customer is itself acting as a processor on behalf of a third-party controller, Customer warrants it has the authority and instructions necessary for Catalystium to Process the Personal Data under this DPA.

Catalystium will Process Personal Data only on Customer's documented instructions, which consist of the Agreement, this DPA, the Order Form, the configuration choices Customer makes in the Service (including which data sources and channels are enabled), and any further written instructions Customer gives that the Parties agree to, except where Processing is required by law (in which case Catalystium will, where legally permitted, inform Customer of that requirement before Processing).

The subject matter, duration, nature and purpose of the Processing, the types of Personal Data, and the categories of Data Subjects are described in Annex 1.

Customer is responsible for the lawfulness of its instructions and of the Personal Data it provides or enables for Processing. Because the Service Processes data relating to Customer's personnel, Customer represents and warrants that it has provided all required notices to, and obtained all required consents and authorizations from, its personnel, and has established a lawful basis for the Processing, as further set out in the Agreement. Customer, and not Catalystium, determines whether any Personal Data constitutes Sensitive Data and instructs the Processing accordingly.

Catalystium will ensure that personnel authorized to Process Personal Data are bound by appropriate obligations of confidentiality and Process Personal Data only as necessary to provide and support the Service.

Catalystium will implement and maintain the technical and organizational measures described in Annex 2, designed to protect Personal Data against a Personal Data Breach, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing.

Customer authorizes Catalystium to engage the Subprocessors listed in Annex 3, and to engage additional Subprocessors subject to this Section. Catalystium will impose on each Subprocessor data-protection obligations no less protective than those in this DPA, and will remain responsible for each Subprocessor's performance. Catalystium will give Customer at least thirty (30) days' prior notice of any intended addition or replacement of a Subprocessor by updating Annex 3 and the published Subprocessor List at rhenari.com/trust/subprocessors and notifying Customer by email to the Customer's account administrator. If Customer reasonably objects on data-protection grounds, the Parties will work in good faith to resolve the objection; if they cannot, Customer may terminate the affected portion of the Service as its exclusive remedy.

Taking into account the nature of the Processing, Catalystium will provide reasonable assistance, by appropriate technical and organizational measures and insofar as possible, to enable Customer to respond to requests by Data Subjects to exercise their rights under Applicable Data Protection Laws. If Catalystium receives such a request directly, it will, unless legally prohibited, promptly inform the Data Subject to direct the request to Customer and notify Customer. Customer acknowledges that, because the Service pseudonymizes individual identifiers, surfaces only aggregated Outputs, and does not retain underlying content, Catalystium's ability to locate data relating to a specific individual may be limited.

Taking into account the nature of Processing and the information available to Catalystium, Catalystium will provide reasonable assistance to Customer with its obligations regarding security of Processing, Personal Data Breach notification, and data-protection impact assessments or analogous assessments required by Applicable Data Protection Laws.

Catalystium will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of and confirming a Personal Data Breach affecting Customer's Personal Data. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed. Notification is not an acknowledgment of fault or liability.

Upon expiration or termination of the Agreement, Catalystium will, at Customer's election and on request, make Customer Data available for export and then delete Personal Data in its possession, in accordance with the Agreement and Catalystium's retention practices. This obligation does not require deletion of (a) De-Identified Data, which Catalystium may retain and use as permitted by Section 7; (b) data Catalystium is required to retain by law; or (c) data in routine backups, which are overwritten or deleted in the ordinary course.

Catalystium will maintain records of its Processing sufficient to demonstrate compliance with this DPA and will make available to Customer information reasonably necessary to demonstrate that compliance. No more than once per twelve (12) months (or following a Personal Data Breach, or where required by a regulator), Customer may request an audit, which may be satisfied by Catalystium's then-current third-party audit reports, security certifications, or completed security questionnaires. Any on-site audit will be at Customer's expense, on reasonable prior notice, during business hours, subject to confidentiality, and conducted so as not to disrupt Catalystium's operations or compromise other customers' data.

Where Personal Data is subject to PIPEDA or Quebec Law 25, Catalystium will provide protection comparable to that required of an organization transferring personal information to a third party for processing, including the security measures in Annex 2 and the confidentiality obligations in this DPA.

Where Law 25 applies, Catalystium will assist Customer with its obligations regarding confidentiality incidents, including by notifying Customer of a confidentiality incident as set out in Section 3.6 so that Customer can assess risk of serious injury and meet any reporting obligations.

Catalystium will provide Customer, on reasonable request, information about the locations where Personal Data is Processed and the Subprocessors engaged, to support Customer's transparency obligations.

This Section mirrors and operationalizes the De-Identified and Derived Data license in the Agreement. Catalystium may create, retain, and use De-Identified Data derived from Customer Data and from the operation of the Service to (a) operate, maintain, secure, and improve the Service, and (b) conduct and publish research into organizational dynamics and cognitive sustainability in knowledge work, including the development and training of predictive models and algorithms. With respect to De-Identified Data, Catalystium will:

• take reasonable measures to ensure the data cannot be associated with, or reasonably linked to, an identified or identifiable individual;
• publicly commit to maintain and use the data in De-Identified form and not attempt to re-identify any individual, except where permitted to test the effectiveness of de-identification;
• contractually obligate any recipient of De-Identified Data to comply with equivalent commitments; and
• not disclose any individual’s data to that individual’s employer.

This license survives expiration or termination of the Agreement. Catalystium will not sell Customer Data.

Catalystium's rights under Section 7.1 are subject to the terms of the third-party platforms from which Customer Data originates. Where a connected source is governed by platform terms that restrict the use of data obtained from it, Catalystium will use data from that source only as those terms permit. In particular, with respect to Customer Data obtained through the Google Workspace APIs, and any data aggregated, anonymized, or derived from it: (a) Catalystium may use such data to provide, operate, secure, and maintain the Service, and to personalize and improve the Service for Customer's own organization; and (b) Catalystium will not use, retain, or transfer such data to create, train, or improve any generalized or non-personalized machine-learning or artificial-intelligence model, or any model, baseline, or parameter applied for the benefit of other customers, consistent with the Google API Services User Data Policy, including its Limited Use requirements. This restriction applies notwithstanding de-identification of the data.

In the event of a conflict between this DPA and the Agreement regarding the Processing of Personal Data, this DPA controls. In all other respects the Agreement remains in full force.

Each Party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.

This DPA takes effect on the effective date of the Agreement and continues until Catalystium has ceased all Processing of Personal Data under the Agreement and completed any return or deletion obligations, except for provisions that by their nature survive (including Section 7).

This DPA is governed by the law stated in the Agreement (the State of Delaware), except where Applicable Data Protection Laws require otherwise.

• Single sign-on through the customer’s own enterprise identity provider (for example, Microsoft Entra ID or Google Workspace) for user authentication; internal service-to-service authentication between platform components.
• Role-based access control with a defined role model; access scoped by tenant and by department.
• Strict tenant isolation: records and queries are scoped to a single tenant; analytical processing runs receive explicit tenant and department context; no cross-tenant data in a single processing operation.
• Restricted, audited production data access for Catalystium personnel; time-bound “break-glass” access requiring justification and producing an audit trail.

• Encryption in transit using TLS 1.2 or higher across application, integration, and bot traffic; encryption of data at rest.
• Integration secrets stored in a managed key vault, segregated from analytics datasets.

• Pseudonymization of individual identifiers before use in persistent analytics datasets wherever live identifiers are not required.
• Ephemeral content processing: enabled content is processed in memory to produce structured outputs and then discarded; underlying content is not written to persistent storage.
• Aggregation guardrails: outputs suppressed below a configurable minimum group size (default three); no individual-level behavioral analytics surfaced through dashboards or APIs; noise or differential-privacy controls applied where contractually or operationally required.
• Content access logging: every content-access event is logged (tenant, channel, item reference, timestamp, consent mode, requesting function, and output) and available to Customer administrators on request.

• Defined SaaS network boundary with private connectivity for platform-internal access, a web application firewall, approved-origin controls, and tenant-aware API rate limiting.
• Strict schema validation of configuration, workflow, and trigger payloads.

• Centralized monitoring, diagnostics, and audit logging of authentication, configuration, secret access, and administrative actions.
• Backup and recovery controls; multi-region resilience with a primary and disaster-recovery region.
• A defined incident-response process with severity levels, escalation timelines, and customer-notification procedures.

• Security-awareness and role-based operational controls for personnel; change-management and rollback controls for platform deployments.