Data Processing Addendum (DPA)

1. Definitions & Construction

Capitalized terms used but not defined herein shall have the meanings ascribed to them in the CadreGPT Terms of Service or applicable Data Protection Legislation:

• "Controller", "Processor", "Data Subject", "Personal Data", "Processing", and "Appropriate Technical and Organizational Measures" have the meanings given in Regulation (EU) 2016/679 (GDPR).
• "Customer Personal Data" means any Personal Data processed by CadreGPT or its autonomous agent execution workers on behalf of Customer pursuant to or in connection with the Agreement.
• "Data Protection Legislation" means all applicable worldwide privacy and data protection legislation, including the European Union General Data Protection Regulation (EU 2016/679), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (CCPA/CPRA), and any applicable national implementing legislations.
• "Standard Contractual Clauses" ("SCCs") means Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679.
• "Subprocessor" means any third party engaged by CadreGPT to assist in providing data processing services or infrastructure on behalf of Customer, as identified in our Subprocessors Directory.

2. Scope, Roles & Instructions

2.1 Role Designation: The parties acknowledge and agree that with respect to the processing of Customer Personal Data, Customer is the Data Controller (or a Processor acting on behalf of a third-party Controller), and CadreGPT acts strictly as the Data Processor.

2.2 Documented Instructions: CadreGPT shall process Customer Personal Data solely on documented instructions from Customer—including with respect to transfers of personal data to a third country or an international organization—unless required to do so by applicable European Union or Member State law to which CadreGPT is subject. In such a case, CadreGPT shall inform Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

2.3 Execution of Autonomous Agent Tasks: Customer’s configuration of workspace agents, integration connectors, human-in-the-loop triggers, and prompt dispatches constitute documented instructions to process data for the purpose of executing autonomous workflows.

3. Obligations of the Processor

3.1 Confidentiality of Personnel: CadreGPT shall ensure that persons authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to production systems is strictly restricted under principles of least privilege.

3.2 Security Measures (GDPR Article 32): Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, CadreGPT implements and maintains technical and organizational measures to ensure a level of security appropriate to the risk. These measures include:

• AES-256-GCM envelope encryption with per-tenant salted keys for all stored integration credentials and tokens.
• Ephemeral, isolated sandboxed execution runtimes for autonomous task workers.
• Automated redaction pipelines that strip sensitive PII and API keys from telemetry and error traces.
• Cryptographic Human-in-the-Loop approval gates halting execution on sensitive state mutations.

Full technical controls are specified in Annex II and our Security Architecture.

4. Subprocessors & International Transfers

4.1 General Authorization: Customer provides general written authorization for CadreGPT to engage third-party Subprocessors. The list of currently approved Subprocessors is published at cadregpt.com/subprocessors.

4.2 Notice of Changes: CadreGPT shall provide at least thirty (30) calendar days prior written notice of any intended appointment of a new Subprocessor or replacement of an existing Subprocessor. Customer may object to such changes on reasonable data protection grounds within fourteen (14) days of notice.

4.3 Pass-Through Obligations: Where CadreGPT engages a Subprocessor, it shall impose data protection terms that offer at least the same level of protection for Customer Personal Data as those set out in this DPA. CadreGPT remains fully liable to Customer for the performance of the Subprocessor’s obligations.

4.4 International Data Transfers (SCCs): To the extent that the provision of services involves a transfer of Customer Personal Data originating in the European Economic Area (EEA), Switzerland, or the United Kingdom to countries that do not ensure an adequate level of data protection, the parties agree to be bound by the EU Standard Contractual Clauses (Module 2: Controller to Processor, or Module 3: Processor to Processor) and the UK International Data Transfer Addendum, which are hereby incorporated into this DPA.

5. Personal Data Breach Notification

5.1 48-Hour Notification SLA: CadreGPT shall notify Customer without undue delay and, where feasible, not later than forty-eight (48) hours after becoming aware of a verified Personal Data Breach affecting Customer Personal Data.

5.2 Notification Content: The notification shall describe: (a) the nature of the breach, including categories and approximate number of data subjects affected; (b) the name and contact details of CadreGPT's security officer; (c) the likely consequences of the incident; and (d) measures taken or proposed to remediate the breach and mitigate potential adverse effects.

5.3 Mitigation & Cooperation: CadreGPT shall take reasonable commercial steps to contain and mitigate the breach and cooperate with Customer in fulfilling any mandatory statutory breach reporting obligations to supervisory authorities or affected data subjects.

6. Data Deletion, Return & Retention

6.1 Immediate Secret Purge on Disconnection: When Customer revokes an integration or deletes an API connection in the CadreGPT dashboard, all associated encrypted credentials, initialization vectors, and tenant-salted ciphertext in our WorkspaceIntegration envelope vault are permanently purged from active storage immediately.

6.2 Account Termination Purge: Upon termination or expiration of the Agreement, CadreGPT shall retain workspace data for a maximum soft-retention period of thirty (30) days to allow for data export. Following this window, all Customer Personal Data, agent state machines, execution histories, and telemetry records are permanently overwritten and purged from all active and backup databases, unless European Union or Member State law requires continued storage.

6.3 Cryptographic Sanitization: Storage deletion conforms to NIST Special Publication 800-88 Revision 1 (Guidelines for Media Sanitization) standards.

7. Data Subject Rights & Regulatory Assistance

Taking into account the nature of the processing, CadreGPT assists Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer's obligation to respond to requests for exercising Data Subject rights under Chapter III of the GDPR (including rights of access, rectification, erasure, restriction, portability, and objection). If CadreGPT receives a request directly from a Data Subject, it shall promptly redirect the Data Subject to Customer.

ANNEX I: Description of the Transfer

A. List of Parties

Data Exporter / Controller: The Customer entity subscribing to the CadreGPT Platform.
Data Importer / Processor: Cadre Technologies Inc. (CadreGPT), providing the enterprise autonomous AI agent platform, execution runtimes, and model gateway. Contact: [email protected].

B. Categories of Data Subjects

Employees, contractors, agents, and business collaborators of the Customer; and any third-party individuals whose personal data is uploaded, inputted, or referenced in autonomous agent tasks by Customer.

C. Categories of Personal Data

Names, email addresses, job titles, workspace IDs, third-party integration access tokens, agent execution prompts, task logs, and any unstructured textual data provided by Customer to autonomous agents.

D. Nature and Frequency of the Transfer

Continuous, automated transfer of data for the duration of Customer’s active subscription to allow the execution, telemetry streaming, and human governance of AI agent workflows.

E. Competent Supervisory Authority

The supervisory authority of the EU Member State in which the Customer is established, or where Customer has designated an EU representative pursuant to Article 27 of the GDPR.

ANNEX II: Technical and Organizational Measures (TOMs)

Pursuant to Article 32 of Regulation (EU) 2016/679, CadreGPT maintains the following technical and organizational security controls across all production environments:

Complete technical architecture diagrams and controls matrices are available at cadregpt.com/security.