This Data Processing Addendum ("DPA") forms part of the Agreement between Jarvis ("Provider") and Customer with respect to the Platform. It sets out the parties' obligations and rights regarding the Customer Personal Data that Provider processes through the Platform, for the purposes of the Protection of Privacy Law, 1981, Regulation 15 of the Protection of Privacy (Data Security) Regulations, 2017, and Registrar Guideline 2/2011. Terms defined in the Terms of Use have the same meaning here. Questions about this DPA: michael@jarvis-agents.com.
1.1 "Applicable Data Protection Law" means the data protection laws that apply to the processing, including the Israeli Protection of Privacy Law, 1981, the regulations under it, and, if and as applicable, the EU/UK General Data Protection Regulation.
1.2 "Customer Personal Data" means any Customer Data that is Personal Data.
1.3 "Controller" (בעל השליטה במאגר) means the entity that determines the purposes and means of processing Customer Personal Data, and equivalent concepts under Applicable Data Protection Law.
1.4 "Holder" (מחזיק) means the entity that processes Customer Personal Data on the Controller's behalf, and equivalent concepts such as "processor".
1.5 "Data Subject" means an individual to whom Customer Personal Data relates.
1.6 "Instructions" means (i) the Agreement; (ii) actions taken, settings enabled, and inputs provided by Customer or its Users through the Platform; and (iii) any documented instruction from Customer that Provider has expressly accepted in writing.
1.7 "Personal Data" means information relating to an identified or identifiable natural person, and equivalent concepts under Applicable Data Protection Law.
1.8 "Security Incident" means a breach of security that has resulted, or that Provider reasonably suspects has resulted, in unauthorized access to, or disclosure, alteration, loss, or destruction of, Customer Personal Data.
1.9 "Sub-processor" means an entity that Provider engages to process Customer Personal Data on Customer's behalf.
1.10 "Sub-processor List" means the list published at subprocessors, as updated from time to time.
1.11 "Supervisory Authority" means the Israeli Privacy Protection Authority or another public authority with data-protection jurisdiction over Customer.
2.1 Roles. As between the parties, Customer is the Controller and Provider is the Holder, processing Customer Personal Data on Customer's behalf.
2.2 Purpose. To operate, provide, customize, support, maintain, test, monitor, and secure the Platform and to provide Professional Services ordered by Customer, for the benefit of Customer and its Users (the "Purpose").
2.3 Data. Personal Data contained in Customer Data, including documents and their content, which may include medical, financial, and other specially sensitive information about Customer's clients and other individuals; User inputs; and Outputs.
2.4 Data Subjects. Individuals identified in Customer Personal Data, such as Users, Customer's clients, and other persons named in documents.
2.5 Systems. Provider processes Customer Personal Data only in the Platform's systems and those of the Sub-processors permitted under Section 4, as listed in the Security Annex and the Sub-processor List. Provider has no access to Customer's internal systems.
2.6 Types of processing. Storage; text extraction; analysis by an AI model operated by a Sub-processor; generation of Outputs with citations; retrieval and display to Customer's Users; deletion.
2.7 Duration. The Subscription term and the retention period in Section 14.
As Holder, Provider will:
3.1 process Customer Personal Data only for the Purpose, in accordance with the Instructions, and in compliance with Applicable Data Protection Law;
3.2 notify Customer in writing without undue delay if it cannot comply with this DPA or if, in its opinion, an Instruction violates Applicable Data Protection Law;
3.3 keep Customer Personal Data confidential and ensure that every person it authorizes to process Customer Personal Data has signed a confidentiality undertaking, has received data-security training before being given access, and uses the data only as this DPA allows;
3.4 not transfer Customer Personal Data to any third party other than the Sub-processors in Section 4, and not sell, share, or otherwise disclose it outside the direct relationship with Customer, unless required by law;
3.5 not use Customer Data or Outputs to train AI models, and ensure that its AI Sub-processors do not, except with Customer's prior written consent for models private to Customer;
3.6 not pool or combine Customer Personal Data or Outputs with data of other customers, and not make them available to other customers;
3.7 not attempt to re-identify de-identified data that Customer provides; and
3.8 not collect Personal Data directly from Customer's clients.
4.1 Customer permits Provider to engage the Sub-processors in the Sub-processor List and consents to the transfer of Customer Personal Data to them for the Purpose.
4.2 Provider carries out reasonable due diligence on each Sub-processor and binds it by contract to data-protection, security, confidentiality, and deletion obligations comparable to this DPA.
4.3 Provider remains responsible to Customer for the performance of each Sub-processor.
4.4 Provider gives at least 30 days' notice within the Platform, or by email, before adding or replacing a Sub-processor. Customer may object on reasonable grounds related to the protection of Customer Personal Data within 15 days of the notice, in writing to the address above. Provider may resolve the objection by not implementing the change for Customer or by taking corrective steps Customer requests. If neither is commercially feasible and the objection is unresolved within 30 days, either party may terminate the Subscription, and Customer receives a refund of fees paid for the period after termination.
Documents are analyzed by a third-party AI provider. Customer acknowledges and agrees that:
6.1 Customer Personal Data is stored in Israel, except for the prompts and generated content temporarily retained by the AI provider under Section 5. AI processing under Section 5 may involve a transfer outside Israel. Customer, as Controller, instructs Provider to carry out that transfer.
6.2 Customer confirms that it has a lawful basis for the transfer under the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 2001, including the consent of the Data Subjects where consent is the basis.
6.3 Provider undertakes to take sufficient measures to protect the privacy of Data Subjects, to apply to Customer Personal Data the conditions for holding and using data that apply to a database in Israel, and not to transfer Customer Personal Data to anyone other than the Sub-processors permitted in Section 4. Any other international transfer will comply with Applicable Data Protection Law and use a recognized transfer mechanism.
7.1 Provider implements the technical and organizational measures in the Security Annex, which describes how Provider meets the duties of a Holder under the Data Security Regulations, 2017, at the medium security level. Customer may refer to the Security Annex in its own security procedure.
7.2 Provider logically segregates each customer's data from every other customer's data. Access within Customer's account is managed by Customer through the Users it creates.
7.3 Provider takes appropriate steps to confirm that its personnel protect the security, privacy, and confidentiality of Customer Personal Data as this DPA requires.
8.1 In the event of a Security Incident, Provider will (i) notify Customer without undue delay after becoming aware of it, and in any event within 48 hours, so that Customer can meet its own notification deadlines; the first notice may be preliminary and Provider updates it as the investigation progresses; (ii) provide the information Customer needs to meet its own obligations to the Supervisory Authority and to Data Subjects, including a description of the nature of the incident, the data affected, and the measures taken or proposed; and (iii) take the steps reasonably required to contain, investigate, and mitigate it.
8.2 Provider documents each Security Incident sufficiently to enable Customer to demonstrate compliance with Applicable Data Protection Law.
8.3 Provider's notification is not an acknowledgement of fault or liability.
To the extent legally permitted, Provider informs Customer if it receives: (i) a legally binding request from a law-enforcement or other authority for disclosure of Customer Personal Data, unless Provider is prohibited from doing so; (ii) a notice, inquiry, or investigation by a Supervisory Authority concerning Customer Personal Data; or (iii) a complaint or request from a Data Subject concerning Customer Personal Data (a "Data Subject Request").
10.1 Customer is responsible for responding to Data Subject Requests. Other than to identify the Data Subject or to give the information in Section 10.2, Provider does not respond to a Data Subject Request without Customer's prior written authorization.
10.2 If a Data Subject contacts Provider directly, Provider tells them whether it holds data about them and gives them Customer's name and address, as the Protection of Privacy Law requires of a Holder, and forwards the request to Customer within 5 business days.
10.3 On Customer's written instruction, Provider assists with access, correction, and deletion within 14 days, at no additional cost for reasonable requests. Where a request can be fulfilled by Customer's Users within the Platform, Provider may direct Customer to that function. Data held in the AI provider's abuse-monitoring logs under Section 5 cannot be retrieved or deleted by Provider before the provider's retention period ends.
If Provider is required by law to process Customer Personal Data outside the Instructions, Provider informs Customer in advance, unless it reasonably believes the law prohibits it from doing so.
12.1 On Customer's written request, Provider gives reasonable assistance with information needed to respond to Data Subject Requests, to demonstrate compliance after a Security Incident, and, where appropriate, to prepare a data-protection impact assessment or a consultation with a Supervisory Authority.
12.2 At least once a year, Provider provides Customer, within the Platform, a written report on how it performed its duties under this DPA and the Data Security Regulations.
12.3 Customer may audit Provider's compliance with this DPA once a year, and additionally where Applicable Data Protection Law requires it, with 30 days' written notice, itself or through a qualified independent auditor approved by Provider, at Customer's cost and under appropriate confidentiality obligations. An audit consists of a review of documentation evidencing Provider's compliance, such as its security procedure, audit reports, and this DPA's records; it does not include access to other customers' data or to production systems. Reports and documentation provided in an audit are Provider's confidential information.
12.4 Nothing in this DPA limits the supervisory powers of the Privacy Protection Authority.
13.1 Customer represents that it has, and will maintain throughout the term, all rights, notices, and consents required to provide Customer Personal Data to Provider and to authorize the processing described in this DPA, including the transfer under Section 6, and that the consent of Data Subjects was obtained as required by Section 7 of the Terms of Use. Provider does not obtain consent from Data Subjects and does not check whether it was given.
13.2 Customer will use the Platform in compliance with Applicable Data Protection Law, including its own duties as Controller under the Data Security Regulations, 2017.
13.3 Customer is responsible for the configuration and design decisions it makes in using the Platform, including which Users it creates and which matters they may access, and for implementing them securely and lawfully.
13.4 Customer will provide Customer Personal Data to Provider only through the Platform, using secure means, and not by email, chat, or support requests, in which only necessary contact details may be included.
13.5 Customer will cooperate reasonably with Provider in relation to Data Subject Requests and Security Incidents.
14.1 This DPA remains in effect until the Subscription ends and Provider no longer processes Customer Personal Data on Customer's behalf.
14.2 Provider keeps Customer Personal Data only for as long as needed for the Purpose. Customer's Users can delete documents within the Platform at any time.
14.3 After termination, Customer may export its Customer Data for 30 days. Provider then permanently deletes Customer Personal Data from its systems within 30 days, and from backups within a further 30 days, unless retention of specific data is required by law, in which case only that data is retained and remains subject to this DPA. On request, Provider confirms the deletion in writing.
Provider's contact for data protection and security: michael@jarvis-agents.com. Customer's contact is the Owner of its Account.
Liability under this DPA is subject to the limitation of liability in the Terms of Use.