1.Application, roles and processing instructions

1.1This Data Processing Addendum (DPA), version 2026-09-30-cw4, is incorporated into an accepted Interaction OS, Website Concierge or Conference & Association Order when OneHolo processes personal information on the customer's behalf. It is supplied before acceptance with the product Terms and does not require a separate DocuSign signature for the standard checkout route. Customer determines permitted purposes and acts as controller or business where applicable; OneHolo acts as processor, service provider or contractor as the law assigns. The household Legacy service is governed by its own privacy and Subject-authorization provisions, not by presuming a family payer is a regulated business controller.

1.2The completed Deployment Details identifies the specific purpose, nature, duration, data categories, affected individuals, operations, approved providers and processing locations. The Order and subsequent lawful documented instructions define the processing. If a required entry is unknown, processing of the affected data must not start. OneHolo will inform Customer when an instruction appears unlawful and may pause that instruction while the parties resolve it. OneHolo will disclose any legally compelled departure where lawful.

2.Restricted purposes and customer control

2.1OneHolo will process only as necessary for the specified contracted purposes and documented instructions. It will not sell or share the personal information for cross-context behavioral advertising; retain, use or disclose it outside the direct business relationship or specified business purposes except as law permits; or combine it with information from other clients or its own consumer interactions except as law expressly permits for a service provider. OneHolo will not train a generalized model on private Customer Data without separate lawful explicit authorization.

2.2OneHolo certifies that it understands and will comply with these restrictions where applicable. It will provide the legally required level of privacy protection and notify Customer if it can no longer comply. Customer may take reasonable and appropriate steps to verify compliant use and stop and remediate unauthorized use, through the information and audit process below. OneHolo's independent billing/security/legal records remain subject to a separate disclosed lawful basis and privacy notice and are not a pretext to repurpose service content.

3.Confidentiality and safeguards

3.1OneHolo will limit personal-information access to trained authorized personnel with a need to know and enforceable confidentiality duties. It will maintain risk-appropriate encryption in transit and at rest, unique accounts and privileged-access protections, least-privilege permissions, separation of customer environments, secrets management, audit logging, vulnerability and patch management, malware protection, secure development, tested recovery and incident-response procedures. Customer-specific measures, encryption boundaries, retention and support access are specified in the Deployment Details.

3.2OneHolo will periodically assess the effectiveness of its safeguards and remedy material deficiencies. No SOC 2, ISO, HIPAA, data-residency, penetration-test result or recovery-time certification is represented unless separately supplied and verified. Customer is responsible for its own endpoints, permissions and lawful instructions; OneHolo remains responsible for its controlled systems and providers. Each party will cooperate in minimizing unnecessary personal information.

4.Subprocessors and locations

4.1The actual authorized subprocessors, functions, data access, countries and relevant retention/no-training terms must be listed in the completed Deployment Details or its immutable incorporated register before processing. OneHolo will use written subprocessor terms providing protection materially equivalent to these obligations and remains responsible for their performance to the same extent as its own. Customer-selected independent platforms must be distinguished from OneHolo subprocessors.

4.2For a new or replacement subprocessor, OneHolo will give at least 15 days' notice before access, identifying its role and location, unless a shorter interval is necessary for security or continuity and the law permits. Customer may promptly raise a reasonable data-protection objection. OneHolo will work on a reasonable alternative; absent a resolution, Customer may end the affected processing and receive prepaid unused recurring fees for that service. No objection procedure authorizes an unlawful transfer or overrides consent required for a material new use.

5.Individual rights and regulatory assistance

5.1OneHolo will promptly forward requests relating to Customer-controlled information to Customer and will not respond substantively except on Customer's documented instruction or as law requires. It will provide reasonable technical assistance with lawful access, correction, deletion, restriction, portability, opt-out and other applicable rights, within enough time for Customer to meet applicable deadlines. Customer will verify requests proportionately and identify the proper records. A contractual fee dispute will not block a lawful rights request.

5.2OneHolo will reasonably assist Customer with required assessments, regulatory inquiries and security or privacy documentation relating to the Services, taking account of the information available to it. Ordinary assistance is included. Extraordinary bespoke work may be separately quoted and approved, but OneHolo cannot condition a legally required response or remediation of its own breach on payment of a new fee. No independent automated legally significant decision-making, profiling, biometric identification or special-category processing is approved merely by this DPA.

6.Incidents and cooperation

6.1OneHolo will notify Customer without undue delay and in any event within 48 hours after discovering a confirmed Security Incident involving Customer Data, subject to a legally required restriction; a shorter law or BAA deadline controls. Initial notice will give available information on the affected systems, known data/individual categories, likely consequences, containment and contact. It need not await a final count or completed investigation and will be supplemented as information becomes available.

6.2OneHolo will promptly investigate, contain, preserve appropriate evidence and remedy the incident within its control, cooperate with Customer and provide information reasonably needed for required notices. Each party controls notices it is legally required to make, after reasonable coordination where practicable. OneHolo must not publicly identify Customer unnecessarily or prevent lawful regulatory reporting. Reasonable incident costs attributable to a party's breach are that party's responsibility subject to the applicable product Terms' liability provisions. Notice is not itself an admission of liability.

7.Verification and audit

7.1On reasonable request, OneHolo will provide relevant security and compliance information, available independent reports and responses sufficient for Customer to assess these obligations. Sensitive information may be disclosed under confidentiality and with other tenants' data removed. Unless incident response or law requires more, routine verification occurs no more than once annually with at least 15 days' notice, during reasonable hours and without harmful testing.

7.2If documentation is insufficient, the parties will arrange a proportionate audit by Customer or a qualified independent auditor subject to confidentiality, security and conflict controls. OneHolo may offer a suitable equivalent independent report but may not categorically prohibit legally required verification. Customer pays its routine auditor costs; OneHolo pays reasonable extra audit costs needed to verify remediation of its substantiated material breach. Unrestricted access to production secrets, model weights or other tenants is not required.

8.Return, deletion and retained records

8.1At termination or lawful earlier instruction, OneHolo will return or delete personal information as Customer elects, following the applicable product Terms' standard 30-day export, active-system deletion within 60 days after termination and routine-backup deletion within 90 days after termination. A shorter legal or expressly selected retention period controls. Restoring a backup must reapply prior deletion instructions before production use.

8.2Information retained because law requires it or because of a documented lawful hold remains limited to that purpose, access restricted, and protected until lawful destruction. OneHolo will identify the relevant categories and basis and confirm destruction on request. It will require equivalent subprocessor handling. A BAA's PHI return/destruction requirements prevail for PHI, and consumer/Subject rights are not expanded into rights to another person's private records.

9.International and regulated deployments

9.1This DPA does not itself supply European Union Standard Contractual Clauses, a United Kingdom transfer addendum, a transfer impact assessment or every jurisdiction's mandatory terms. Where such measures are needed, the affected collection or transfer is blocked until the correct parties, modules, annexes and supplementary protections are completed and incorporated. Selecting a country in a web form is not transfer authorization. An unsupported international deployment must use a separate reviewed order.

9.2PHI may be processed only under an executed BAA, approved scope and verified eligible provider chain. Payment authentication data, credentials, biometric identification and children's sensitive data remain prohibited unless an expressly reviewed separate arrangement authorizes the actual process. Changes of model or vendor must not silently expand allowed data types.

10.Term and priority

10.1This DPA applies for as long as OneHolo processes the covered information, including required wind-down or lawful retention. It prevails over conflicting general terms on personal-data processing; the BAA controls PHI and mandatory law controls both. The Agreement's liability allocation applies and does not restrict an individual's or regulator's nonwaivable rights. No general indemnity, new fee, certification or broader data license is created by this DPA.