Thỏa thuận xử lý dữ liệu

xCORE Data Processing Terms (DPA)

Version 2.0

Effective Date: 17 September 2026

These Data Processing Terms (this "DPA") are incorporated into, and form part of, the xCORE Business Terms (the "Business Terms") between PLUS IMPACT Pte. Ltd., a company incorporated in Singapore ("PLUS IMPACT", "we", "us"), and the Customer identified in the Order (the "Customer"), as a schedule to the Business Terms, and set out the terms on which Personal Data and other data are processed in connection with the Services. The Schedules at the end of this DPA form part of this DPA.

Article 1 (Purpose)

This DPA sets out the terms on which PLUS IMPACT processes Customer Data, Personal Data, My xCORE Data and xCORE Talk Data in connection with the Services.
This DPA applies together with the Business Terms and the Order as an integrated whole. Where the Business Terms, an Order or a Country Addendum refers to this DPA, this DPA is expressly incorporated into that document.

Article 2 (Definitions)

Terms used in this DPA have the meanings given to them in the Business Terms, unless otherwise defined in this DPA.

Article 3 (Roles)

Where the Customer uses the Services for its own recruitment, human resources, evaluation, interview, organisational management or other purposes, the Customer holds the status of Controller, business operator, organisation or an equivalent status under Applicable Data Protection Law in respect of Customer Data and the Personal Data processed for those purposes.
To the extent that PLUS IMPACT provides the Services for the Customer, PLUS IMPACT holds the status of Processor, entrusted service provider, data intermediary or an equivalent status that processes Personal Data on the Customer's instructions.
Notwithstanding the preceding two paragraphs, where an End User creates or saves My xCORE under the terms of use or consent prescribed by PLUS IMPACT, PLUS IMPACT may hold the status of an independent Controller, business operator, organisation or an equivalent status under Applicable Data Protection Law in respect of My xCORE Data.
xCORE Talk Data is, in principle, treated as data under the Customer's control and is kept separate from My xCORE Data.
The same CV/resume, work history, assessment result or other information may be treated as Customer Data in Customer-directed processing and, after the End User's own consent, as an independent copy treated as My xCORE Data. In that case, the Customer-directed data and the My xCORE Data are managed with separate purposes, access rights, recipients, and deletion and retention conditions.
In respect of Singapore, for Customer-directed processing, the Customer is treated as the organisation under the Singapore Personal Data Protection Act 2012 (the "PDPA") and PLUS IMPACT as a data intermediary processing on behalf of the Customer. For the processing of My xCORE Data for PLUS IMPACT's own purposes, PLUS IMPACT is an independent organisation as the provider of services to the relevant End User. Details are governed by the Singapore Country Addendum.
Even where a local subsidiary, local implementation support provider or local contact point performs referral, implementation support, local contact or other support functions, that subsidiary, local implementation support provider or local contact point is not an independent processing entity, contracting entity, invoicing entity, online sales entity or local providing entity in respect of Customer Data or Personal Data unless expressly stated in the Order. PLUS IMPACT shares information with them only to the extent necessary for those support functions and imposes on them reasonable obligations of confidentiality, data protection, information security and limitation of authority appropriate to their role.
Where the Customer uses the Services to make recruitment, employment, evaluation, placement, employee support or other decisions, the Customer bears primary responsibility for the purposes, legal basis, notices, explanations, human review, handling of objections and labour-related procedures relating to those decisions. PLUS IMPACT provides reasonable technical and contractual support within the scope of its processing for the Customer.

Article 4 (Data Processed)

The data processed under this DPA includes the following.

Customer Data
- the Customer's name, departments and Administrator information
- job postings, job requirements and evaluation criteria
- the names, email addresses, telephone numbers, addresses and other identification and contact information of candidates or employees that the individual enters or registers in the Services, or that is contained in CVs/resumes, work history documents or other submitted materials
- CVs/resumes, work history documents and other submitted materials, and the work history, education, qualifications, skills, desired conditions, self-introduction and other career or profile information contained in them
- evaluation results, scores, reports and logs
AI Interview Data
- interview answers
- audio or video recordings
- transcripts
- AI analysis results
- Customer-facing reports
- information necessary for identity verification, fraud prevention, the operation, troubleshooting and safety checks of the interview service, support and legal compliance
xCORE Personality data
- answers, assessment results, behavioural traits, job aptitude, organisational fit and reports
xCORE Talk Data
- conversations, audio, transcripts, summaries, KPI-related signals, engagement information and recommended actions in AI 1-on-1 sessions
My xCORE Data
- profile information that an End User saves or uses as My xCORE under the terms of use or consent prescribed by PLUS IMPACT. This may include identification information, contact information, career information and profile information that the End User enters or registers, or that is extracted from CVs/resumes, work history documents or other submitted materials.

Article 5 (Purposes of Processing)

PLUS IMPACT processes data for the following purposes.

providing, operating and maintaining the Services
producing the administration console, reports, scores, summaries, notifications, suggested questions and other outputs
account management, identity verification, authentication, fraud prevention and security
support, incident response, operational quality control and safety checks
legal compliance, audit, dispute handling, evidence preservation and contract management
processing based on the Order or the Customer's instructions
creation, storage and use of My xCORE based on the End User's terms of use or consent
PLUS IMPACT's internal service improvement, quality control and statistical analysis, kept separate from AI model training, using aggregated, statistical or anonymised data that cannot identify any individual or Customer; provided that, in accordance with Article 10, information derived from xCORE Talk Data is not used for purposes unrelated to the provision of the Services, third-party materials, advertising or marketing materials, or purposes that the Customer would not reasonably expect, except to the extent approved in advance by the Customer or expressly stated in the Order.

Article 6 (Customer Instructions)

PLUS IMPACT processes Customer Data and Personal Data under the Customer's control in accordance with the Business Terms, the Order, this DPA and the Customer's reasonable written instructions.
Where a Customer instruction is likely to infringe Applicable Data Protection Law, the Business Terms, the rights of a third party or the interests of End Users, PLUS IMPACT may refuse to carry out that instruction or ask the Customer to amend it.
The Customer must not instruct PLUS IMPACT to carry out unlawful or inappropriate data processing.

Article 7 (Customer Notices and Consents)

The Customer is responsible for notifying End Users of the use of the Services, processing by PLUS IMPACT, AI analysis, the Customer's use of reports, Cross-border Transfers, the use of external processors and any other matters required under Applicable Data Protection Law, and for obtaining any necessary consents.
Even where PLUS IMPACT presents terms of use, a privacy notice or a consent screen directly to End Users, the Customer is not released from its obligation to give notice of its own purposes of use and of decisions made by the Customer.
When introducing xCORE Talk to its employees, the Customer must carry out the explanations, consents and internal procedures required from the perspectives of the employment relationship, workplace monitoring, whistle-blowing, labour management, evaluation and other relevant matters.
Where reasonably necessary in light of the End Users' country of residence, language, employment relationship, recruitment process or other circumstances, the Customer must notify End Users, in a language and by a method that they can understand, of the Customer's purposes of use, the role of AI analysis, Cross-border Transfers, the use of external processors, the contact point for Data Subject Requests and other necessary matters.
The Customer must identify and comply with the legal obligations that apply to its use in the Applicable Country, including those relating to employment and labour, workplace monitoring, recruitment evaluation, electronic transactions, cybersecurity, online services, telecommunications, record-keeping, registration, filings, licences and permits.
Where the Customer uses AI recommendations, predictions, scores, summaries or other outputs as decision support in relation to End Users, the Customer must reasonably explain, in proportion to the risk of the relevant use case, the relevant features, the main data processed, the purposes of use, the fact that AI outputs are decision support, whether human review takes place, the contact point, and how to withdraw consent or raise an objection.
In production use of AI Interview and xCORE Talk, the Customer must notify End Users that recordings, video, audio, full transcripts, reports, evaluation results, identity-verification and fraud-prevention records and other related records are retained for a maximum of 24 months from collection or creation, unless otherwise provided in the Order, the End User-facing notice or a Country Addendum.
PLUS IMPACT provides, to the extent reasonably necessary for the Customer to give the explanations referred to in the preceding paragraph, general explanatory information such as the relevant features, the main data processed, an overview of the AI Processors, the nature of AI outputs, the no-training policy, security measures and other general explanatory information; provided that PLUS IMPACT is not obliged to disclose AI models, prompts, evaluation logic, source code, security configurations or other detailed information that constitutes a trade secret or must be protected for security reasons.

Article 8 (My xCORE)

Where an End User creates or saves My xCORE under the terms of use or consent prescribed by PLUS IMPACT, PLUS IMPACT may process My xCORE Data independently of its contractual relationship with the Customer.
My xCORE Data is used for the End User's own profile, career, assessments, profile management, service improvement and other purposes notified by PLUS IMPACT to the End User.
Customer-specific job requirements, the Customer's evaluation comments, answers to company-specific questions, company-specific fit scores, xCORE Talk Data and AI Interview Data are not included in My xCORE Data unless the End User separately consents.
PLUS IMPACT does not, without the End User's separate consent, provide My xCORE Data to third parties or use it for third-party-facing services that are materially different from the purposes notified to the End User.
The Customer acknowledges that PLUS IMPACT may retain or process My xCORE Data independently in its relationship with the End User.

Article 9 (Secondary Use of AI Interview)

During the initial trial, AI Interview Data is used for conducting interviews, audio or video recording, transcription, AI analysis, preparing Customer-facing reports, identity verification, fraud prevention, the operation, troubleshooting and safety checks of the interview service, support, legal compliance and other reasonably necessary operational purposes.
PLUS IMPACT does not, without the End User's separate consent, use AI Interview Data for My xCORE or any other End User-facing service for a different purpose.
PLUS IMPACT does not, without the End User's separate consent, use AI Interview audio, video, full transcripts, answers to company-specific questions or role-specific fit scores for evaluations for other customers or for provision to third parties.
If PLUS IMPACT in the future provides a feature that stores standardised interview summaries or scores in My xCORE, PLUS IMPACT will obtain a separate opt-in from the End User.

Article 10 (Separation of xCORE Talk)

Because xCORE Talk Data may contain the Customer's business, organisational, human resources and KPI information, employees' candid views, internal issues and other sensitive information, it is processed separately from My xCORE Data and other End User-facing profile data.
PLUS IMPACT uses xCORE Talk Data only for providing xCORE Talk, preparing reports approved by the Customer, security, incident response, legal compliance and other purposes expressly stated in this DPA or the Order, and does not, without the Customer's prior approval, use it for My xCORE or other End User-facing profiles, third-party-facing services, AI model training, advertising or marketing materials, or any other purpose that the Customer would not reasonably expect.
PLUS IMPACT applies reasonable access controls to xCORE Talk Data appropriate to the nature of the data.
Notwithstanding the preceding paragraph, PLUS IMPACT may carry out necessary processing, limited in purpose and scope, where justified by automated processing necessary to provide the Services, security, incident response, legal compliance, dispute handling or other legitimate grounds. PLUS IMPACT does not view the plain-text content of xCORE Talk for support or sales purposes.

Article 11 (AI Processors and Subprocessors)

PLUS IMPACT may use AI Processors and Subprocessors to the extent necessary to provide the Services.
PLUS IMPACT imposes on AI Processors and Subprocessors commercially reasonable contractual protections covering personal data protection, confidentiality, security, restrictions on use for AI model training purposes and other matters.
On the Customer's reasonable request, PLUS IMPACT provides summary information about its principal AI Processors and Subprocessors.
PLUS IMPACT selects external processors, including AI Processors, taking into account the nature of the relevant data, functional requirements, commercial availability and security requirements.
Where PLUS IMPACT, as a service provider of an AI system or AI feature, provides, configures, verifies or improves Customer-facing features using Personal Data held or controlled by the Customer, PLUS IMPACT applies reasonable management measures to that Personal Data in accordance with Applicable Data Protection Law and its contract with the Customer.

Article 12 (Cross-border Transfers)

PLUS IMPACT may, to the extent necessary to provide the Services, transfer Personal Data outside the Applicable Country to Singapore, Japan, the United States or other countries or regions, and may use AI Processors, Subprocessors and cloud services located in those countries or regions.
Where PLUS IMPACT makes a Cross-border Transfer, it takes, in accordance with Applicable Data Protection Law, legally enforceable contractual measures that require the transferee or external processor to provide an equivalent or comparable standard of protection, a DPA or data protection clauses, confidentiality, security measures, management of contractors and other reasonable measures.
The Customer gives End Users the necessary notices, and obtains the necessary consents, in relation to Cross-border Transfers.
PLUS IMPACT does not guarantee data storage, processing, backup or Subprocessor use within a specific country or region unless expressly stated in the Order or a Country Addendum.
Where the laws of the Applicable Country, or the interpretation of its authorities, may require data localisation, retention for a specific period, registration, filings, provision of information to authorities, designation of data storage locations or other additional measures, the parties will consult on the scope of application, the method of response, the allocation of costs and the impact on the Services. Unless prohibited by law, PLUS IMPACT notifies the Customer, to the extent reasonably practicable, of any request from an authority relating to Customer Data or Personal Data.

Article 13 (Security Measures)

PLUS IMPACT implements the following reasonable security measures, taking into account the nature of the data, the scope of processing, the state of the art, cost, risk and other circumstances.

encryption
access control
authentication management
permission management
network protection
backup
vulnerability management
incident response
management of contractors

Article 14 (Security Incident Notification)

Where PLUS IMPACT confirms a leak, loss, damage, unauthorised access or other Security Incident relating to Customer Data or Personal Data that may have a material impact on the Customer or End Users, PLUS IMPACT notifies the Customer without undue delay, to the extent permitted by law and reasonably practicable. Likewise, where, under the Singapore PDPA, PLUS IMPACT, as a data intermediary processing Personal Data on behalf of the Customer, becomes aware of a data breach relating to that Personal Data and has credible grounds to believe that the data breach has occurred, PLUS IMPACT notifies the Customer without undue delay.
PLUS IMPACT provides the Customer with the nature of the Security Incident, the date and time of discovery, the types of data that may have been affected, the scope of impact, the causes identified, the initial measures taken by PLUS IMPACT, the measures recommended for the Customer or End Users, measures to prevent recurrence and other information that can reasonably be provided.
Where notification to End Users or an authority is required, the Customer makes that notification on its own responsibility; provided that PLUS IMPACT cooperates reasonably. Likewise, where, under the Singapore PDPA, the Customer as an organisation must assess whether notification to the Personal Data Protection Commission (the "PDPC") or to affected individuals is required and make that notification, PLUS IMPACT cooperates in providing the necessary information to the extent technically possible and reasonable.

Article 15 (Data Subject Requests)

Where an End User makes a request for access, correction, deletion, suspension of use, withdrawal of consent or any other request, the parties respond in accordance with Applicable Data Protection Law, according to their respective roles.
For Data Subject Requests relating to Customer-controlled data, the Customer bears primary responsibility for responding. On the Customer's reasonable request, PLUS IMPACT cooperates to the extent technically possible and reasonable.
For Data Subject Requests relating to My xCORE Data, PLUS IMPACT may respond in its relationship with the End User.
When responding to a Data Subject Request, PLUS IMPACT may carry out identity verification, confirmation of the scope of the request, separation of Customer-controlled data from My xCORE Data, explanation of any legal or contractual reasons why deletion is not possible, and other reasonable procedures.

Article 16 (Return, Deletion and Retention)

After the Order ends, the Customer may reasonably request PLUS IMPACT to return or delete Customer Data. PLUS IMPACT returns or deletes Customer Data in accordance with applicable law, this DPA and Schedule 2 (Retention, Return and Deletion).
PLUS IMPACT may retain Customer Data only to the extent and for the period necessary for legal compliance, audit, dispute handling, security, backup, invoicing, accounting, internal control or other limited purposes.
My xCORE Data may be retained after the end of the contract with the Customer where the End User wishes it to be retained under the terms of use or consent prescribed by PLUS IMPACT.
Of the production Customer Data from AI Interview and xCORE Talk, recordings, video, audio, full transcripts, reports, evaluation results, identity-verification and fraud-prevention records and other related records may be retained for a maximum of 24 months from collection or creation, unless otherwise provided in the Order, the End User-facing notice or a Country Addendum.
The maximum of 24 months in the preceding paragraph does not mean that PLUS IMPACT is obliged to retain that data for 24 months. Where a Data Subject Request, a Customer instruction, law, security, audit, accounting, internal control, dispute handling, legal hold, backup rotation or another limited purpose requires shorter or longer retention or deletion, those conditions apply.
Data that has been anonymised, aggregated or otherwise processed into a form that cannot identify an individual may continue to be used by PLUS IMPACT after the Business Terms end.

Article 17 (Audit and Information)

On the Customer's reasonable request, PLUS IMPACT provides reasonable information about its compliance with this DPA.
Any audit by the Customer is conducted by a method reasonably designated by PLUS IMPACT, to the extent that it does not impair PLUS IMPACT's security, the confidentiality of other customers, trade secrets or system stability.
PLUS IMPACT may refuse excessive audits, third-party audits, on-site audits, disclosure of source code and disclosure of detailed security configurations requested by the Customer; provided that this does not prevent the parties from separately agreeing otherwise as an enterprise term.

Article 18 (Order of Precedence)

If there is a conflict between this DPA and the Business Terms, this DPA prevails in respect of matters relating to the processing of Personal Data; provided that the provisions of the Business Terms apply to limitation of liability, governing law, dispute resolution, fees and other general terms. Each Schedule to this DPA is interpreted together with this DPA as an integrated whole.

Schedule 1: My xCORE Data

1. Basic Principles

My xCORE is a profile for the End User's own benefit and is managed separately from Customer Data processed for the Customer's recruitment, evaluation, interviews and organisational management.

Where an End User consents to the creation or saving of My xCORE, PLUS IMPACT may create and retain a copy of the information covered by that consent as My xCORE Data, independent of Customer-directed processing.

Even where the processing necessary for an application or evaluation and the saving of My xCORE are presented in the same screen flow, PLUS IMPACT explains separately, through on-screen display or the privacy notice, what is saved, the purposes of use, whether data is provided to third parties, and how to request deletion or suspension of use. Where required by the laws of the Applicable Country or by Customer requirements, saving to My xCORE is confirmed by a separate checkbox or a separate screen.

2. Data That May Be Included in My xCORE

Based on the End User's consent, the following data may be included in My xCORE.

name, email address, telephone number, address, language, desired conditions and other identification, contact and basic information that the End User enters or registers, or that is extracted from CVs/resumes, work history documents or other submitted materials
CVs/resumes, work history documents and other submitted materials, and the work history, education, qualifications, skills, self-promotion statements, work experience and other career or profile information contained in them
work history, skills, experience, desired conditions and standardised profile information organised by Smart Filter
xCORE Personality answers, assessment results, behavioural traits, job aptitude and other assessment information standardised for the End User
profile information that the End User voluntarily adds, amends or saves
other End User-facing information that PLUS IMPACT expressly presents to the End User and to which the End User consents

Where a Country Addendum restricts saving to My xCORE because of a specific country's employment, recruitment or personal data regulations, local-language notice requirements, Cross-border Transfer rules, AI use rules or workplace monitoring rules, the provisions of that Country Addendum or of the Order prevail.

3. Data Not Included in My xCORE in Principle

The following data is not included in My xCORE unless the End User separately consents.

Customer-specific job requirements, role requirements, recruitment criteria and evaluation criteria
the Customer's evaluation comments, interview notes, internal decisions and rankings
company-specific fit scores, job-specific matching scores and role-specific scores
AI Interview audio, video, full transcripts, answers to company-specific questions and role-specific fit scores
xCORE Talk Data
the Customer's KPIs, organisational issues, employee support information and internal information
information whose saving to My xCORE is restricted by the contract with the Customer or by law

4. Use of AI Interview for Different Purposes

By default, AI Interview Data is not used for My xCORE or any other End User-facing service for a different purpose.

If, in the future, standardised summaries or certain scores created from AI Interview are to be saved to My xCORE, PLUS IMPACT will display what is saved, the purposes of use, whether data is provided to third parties and the expected impact, and will obtain a separate opt-in from the End User.

Audio, video, full transcripts and answers to company-specific questions are, in principle, not included in what is saved to My xCORE.

5. Provision to Third Parties and Use for Different Purposes

PLUS IMPACT does not, without the End User's separate consent, provide My xCORE Data to third parties or use it for third-party-facing services that are materially different from the purposes notified to the End User.

Where PLUS IMPACT provides data to a third party or uses it for a materially different purpose, PLUS IMPACT displays at least the following and obtains the End User's consent.

the recipient or the party that will use the data
the purpose of the provision or use
the data to be provided or used
the expected impact
how to withdraw
that complete retrieval may not be possible after provision
the recipient's purpose limitations, restrictions on onward sharing, retention period or contact point

Schedule 2: Retention, Return and Deletion

1. Basic Principles

PLUS IMPACT retains data for the period necessary to achieve the purposes of use, the period required by law, the period required by contract, and the period necessary for security, backup, audit, accounting, internal control, dispute handling and other limited purposes.

Customer Data is returned or deleted in accordance with the Customer's instructions, the Order, this DPA and applicable law. Data saved as My xCORE based on the End User's own consent is retained separately from Customer Data.

2. Retention Categories

For each data category below, the entry states, in order: the standard policy; the deletion or return rule; and the exceptions.

Customer Data: standard policy — the period necessary to provide the Services and manage the contract; deletion or return — returned or deleted in accordance with this DPA on the Customer's reasonable request or after the Order ends; exceptions — law, accounting, audit, security, dispute handling and backup.
My xCORE Data: standard policy — the period for which the End User wishes the data to be retained, or the period for which PLUS IMPACT reasonably retains it in accordance with applicable law and its notices; deletion or return — deleted, corrected or suspended from use in accordance with applicable law in response to the End User's request; exceptions — law, identity verification, security, dispute handling and backup.
AI Interview audio, video and full transcripts: standard policy — not saved to My xCORE by default; retained for a maximum of 24 months from collection or creation for conducting interviews, identity verification, fraud prevention, report preparation, and operation, troubleshooting and safety checks, unless otherwise provided in the Order or the End User-facing notice; deletion or return — deleted in accordance with Customer instructions, Data Subject Requests or the operational plan; exceptions — law, security, dispute handling and backup.
AI Interview standardised summaries and certain scores: standard policy — not saved to My xCORE by default; may in the future be saved to My xCORE only with the End User's separate consent; retained as Customer-facing reports and evaluation results for a maximum of 24 months from collection or creation; deletion or return — handled in response to Data Subject Requests, Customer instructions or the operational plan; exceptions — law, security, dispute handling and backup.
xCORE Talk Data: standard policy — treated as Customer-controlled data and kept separate from My xCORE and other End User-facing profiles; conversation content, audio, transcripts, summaries, scores, KPI-related signals, reports and other related records are retained for a maximum of 24 months from collection or creation, unless otherwise provided in the Order, the Activation Notice or the End User-facing notice; deletion or return — in accordance with Customer instructions, Data Subject Requests or separately agreed deletion conditions; exceptions — law, security, incident response, dispute handling and backup.
Logs and audit records: standard policy — the period necessary for security, access management, incident response and audit; deletion or return — in accordance with PLUS IMPACT's retention policy; exceptions — law, security and dispute handling.
Backups: standard policy — the period necessary for business continuity, disaster recovery and security; deletion or return — deleted in accordance with the normal backup rotation; exceptions — law, security and dispute handling.
Anonymised and aggregated data: standard policy — may be retained in a form that cannot identify an individual or Customer; deletion or return — may fall outside the scope of deletion; exceptions — no re-identification is carried out.

The maximum of 24 months above does not mean that PLUS IMPACT is obliged to retain that data for 24 months. Where a Data Subject Request, a Customer instruction, law, dispute handling, security, audit, accounting, internal control, legal hold, backup rotation or another limited purpose so requires, data may be deleted within a shorter period or retained for longer within a limited scope.

Where a Country Addendum, the Order or a Customer-facing security response expressly incorporated into this DPA sets out a retention period, deletion conditions, local storage, additional retention or handling of authority requests for a specific country, a specific Customer or a specific feature, those provisions prevail.

Anonymised and aggregated data derived from xCORE Talk Data is not used, except to the extent approved in advance by the Customer or expressly stated in the Order, for purposes unrelated to the provision of the Services, third-party materials, advertising or marketing materials, or the training, retraining, fine-tuning, model improvement or similar purposes of AI models of PLUS IMPACT, its Affiliates or external processors.

3. Relationship Between Deletion of Customer Data and My xCORE Data

Even where the Customer requests deletion of Customer Data, data that the End User has separately consented to save as My xCORE may be retained independently in the relationship with that End User.

Even in that case, Customer-specific job requirements, evaluation comments, company-specific scores, xCORE Talk Data and AI Interview Data are not included in My xCORE unless the End User separately consents.

4. Where Deletion Is Not Possible

PLUS IMPACT may retain data that would otherwise be deleted, only to the extent and for the period necessary, where there are legitimate reasons such as law, requests from courts or administrative authorities, accounting and tax, audit, security, backup, dispute handling, or the exercise or defence of rights.

Schedule 3: External Processors and AI Processing

PLUS IMPACT may, to the extent necessary to provide the Services, use cloud services, AI APIs, speech processing, translation, authentication, analytics, storage, monitoring, support and other external processors.

PLUS IMPACT imposes on external processors commercially reasonable contractual protections covering personal data protection, confidentiality, security, restrictions on use for AI model training purposes and other matters.

On the Customer's reasonable request, PLUS IMPACT provides information on the overview, relevant features, processing activities, processing regions and safeguards of its external processors in the form of a separate Subprocessor disclosure list, security response or equivalent document. Those documents do not constitute additional warranties or a service level agreement under this DPA except to the extent expressly agreed.

Language

This English version of this DPA is the authoritative text. Any translation of this DPA into another language is provided for convenience only. If there is any inconsistency between this English version and a translation, this English version prevails.