Data Processing Agreement

Version 2026-08.3 — Effective August 14, 2026

This Data Processing Agreement (the "DPA") sets out the terms on which Ploid AI Biotech, S.L., CIF B19786623, registered office at Avenida Diagonal, 612 - P. 1 PTA. 3, 08021 Barcelona, Spain ("Ploid", "Processor") processes personal data on behalf of a customer of the Ploid platform ("Customer", "Controller").

It gives effect to Article 28(3) of Regulation (EU) 2016/679 ("GDPR").

1. Scope and relationship to the other documents

1.1 What this DPA covers. It covers Ploid's processing of personal data contained in Customer Content — the datasets, files, scripts, workflow definitions, study materials, Conversations and generated results within the Customer's workspace. For that data the Customer is the controller (or itself a processor for its own controller) and Ploid is the processor.

1.2 How it applies. This DPA forms part of the End User License Agreement (the "Agreement") and applies automatically, without separate signature, wherever Customer Content contains personal data. A Customer who requires a separately executed instrument should contact legal@ploid.ai.

1.3 What this DPA does not cover. Data for which Ploid is itself the controller — account and identity data, workspace membership, usage, metering and billing records, and operational and security logs — is outside this DPA and is governed by the Privacy Policy. Section 1 of that Policy explains the boundary.

1.4 Order of precedence. For the subject matter of this DPA, this DPA prevails over the Agreement in the event of conflict. Where Ploid operates a dedicated deployment for the Customer, or the parties have a separate written data-processing agreement, that agreement prevails over this one.

1.5 Definitions. "Personal data", "processing", "controller", "processor", "sub-processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the GDPR. "Customer Content", "Conversations" and "Plan" have the meanings given in the Agreement.

2. Roles and subject matter

2.1 The Customer is the controller and determines the purposes and means of processing Customer Content. Ploid is the processor and processes it only as set out in Annex 1 and on the Customer's instructions.

2.2 The Customer's responsibilities. The Customer warrants that it has a lawful basis for the personal data it places in the Services, that it has provided any notices and obtained any consents required, and that its instructions to Ploid do not require Ploid to breach the GDPR.

2.3 Special-category data. The Services are designed for research data and are not configured as a clinical or diagnostic system. Their intended purpose is stated in Section 4A of the Agreement and in the AI Transparency Statement; Section 4.2 of the Agreement prohibits clinical and other high-risk uses.

The Customer may place identifiable human genetic, clinical or other special-category personal data (Art. 9 GDPR) into the Services only where:

(a) it has a valid legal basis under Art. 9(2) GDPR, and has given any notices and obtained any consents that basis requires;

(b) it has applied appropriate safeguards — such as pseudonymization or de-identification — before upload;

(d) the workspace has been configured for human data using the setting the Services provide for that purpose, before such data is placed in it.

Ploid does not inspect Customer Content and cannot detect a failure to meet these conditions. Determining that they are met is the Customer's decision as controller, and placing such data in the Services is the Customer's representation that they are.

The configuration in (d) is the Customer's declaration. An owner or administrator makes it against an express attestation of the Art. 9(2) basis, which Ploid records against that person, and Ploid relies on the declaration: it is what turns on the research-use-only notice the Services display and write into exported files. Leaving a workspace undeclared does not narrow any obligation in this Section — it only prevents Ploid from applying that notice.

2.4 High-risk deployment. The Customer must not deploy the Services, or their outputs, in a manner that would make the system a high-risk AI system under Regulation (EU) 2024/1689 without Ploid's prior written agreement. Section 9A of the Agreement sets out the consequences, including that the Customer may itself become the provider of that system.

3. Ploid's obligations

3.1 Processing only on instructions. Ploid processes Customer Content only on the Customer's documented instructions, which comprise this DPA, the Agreement, and the Customer's configuration and use of the Services. If Ploid is required by EU or Member State law to process otherwise, it will inform the Customer before doing so unless that law prohibits the notification.

3.2 No independent purposes. Ploid does not process Customer Content for its own purposes except as the Customer's Plan expressly permits (Annex 1, paragraph 4) and as necessary to operate, secure and support the Services.

3.3 Confidentiality. Ploid ensures that every person it authorizes to process Customer Content is bound by a duty of confidentiality and processes it only as needed for their role.

3.4 Security. Ploid implements and maintains the technical and organizational measures described in Annex 2, appropriate to the risk under Art. 32 GDPR. Ploid may change a measure provided the level of protection is not reduced.

3.5 Assistance. Taking account of the nature of the processing and the information available to it, Ploid assists the Customer in complying with Articles 32 to 36 GDPR, including with data-protection impact assessments and prior consultation, on reasonable request.

3.6 Data-subject requests. Where a data subject contacts Ploid about Customer Content — the address for this is privacy@ploid.ai — Ploid will not respond substantively; it will refer the request to the Customer without undue delay and identify the workspace concerned.

Ploid assists the Customer in responding. The nature of that assistance follows from Section 2.3: Ploid does not inspect Customer Content, and the Services index resource names rather than the contents of datasets, files and results, so Ploid cannot search Customer Content to find the personal data of a named individual. Locating it is the Customer's task as controller, using its knowledge of what it placed where. What Ploid provides is the means to act on it once located — per-resource export and deletion, and workspace deletion, all available to the Customer's own administrators — together with such further assistance as is reasonable, including retrieving material the Customer's own roles do not reach.

4. Sub-processors

4.1 General authorization. The Customer authorizes Ploid to engage sub-processors to provide the Services.

4.2 The current list. The sub-processors engaged at any time, with their role, the processing they perform and their location, are published at Subprocessors, which is incorporated into this DPA as Annex 3 and is kept current.

4.3 Flow-down. Ploid imposes on each sub-processor, by written contract, data-protection obligations no less protective than those in this DPA, and remains liable to the Customer for a sub-processor's performance.

4.4 Changes and objection. Ploid will give the Customer at least thirty (30) days' notice before a new sub-processor begins processing Customer Content, by updating the Subprocessors page and notifying the Customer in the application or by email. The Customer may object on reasonable data-protection grounds within that period; the parties will discuss it in good faith, and if no resolution is found the Customer may terminate the affected Services and receive a pro-rata refund of prepaid, unused fees.

5. AI models and third-party inference

5.1 Providing the AI-assisted features requires transmitting the relevant part of Customer Content and Conversations to a model inference provider. Those providers are sub-processors and appear on the Subprocessors page.

5.2 Model providers do not train on Customer Content. Ploid selects inference providers whose terms prohibit using data submitted through their API to train their own models, and configures the Services accordingly. This is independent of the Plan-based terms in Annex 1, paragraph 4, which concern Ploid's own use.

5.3 Residency. A workspace is created with a regional data residency, under which model calls are routed to inference endpoints within that region. On Ploid's own service that region is the European Union; a deployment operated for a single Customer in another region offers that region's setting instead — a US-hosted deployment offers US residency. Each deployment offers exactly one regional setting. A Customer administrator may change the workspace to global residency, which permits routing outside that region. That change is a controller decision and a Customer instruction under Section 3.1; Section 7 governs the resulting transfer.

Residency applies to model inference. It does not by itself confine other outbound requests an AI feature makes on the Customer's behalf; the web-search sub-processor identified on the Subprocessors page receives search queries under either regional setting, and Section 7 governs that transfer.

5.4 AI transparency is Ploid's own obligation, not processing on instruction. Ploid is the provider of the AI system made available through the Services, and owes the transparency duties in Article 50 of Regulation (EU) 2024/1689 in that capacity. Those duties — disclosing to a person that they are interacting with an AI system, identifying on whose behalf it acts, and marking generated content — are published at AI Transparency Statement and Instructions for Use.

They are distinct from Ploid's role as processor under this DPA, and the distinction runs in two directions:

(a) Ploid discharges them on its own account. They are not carried out on the Customer's instructions, and a Customer instruction cannot switch them off. The Customer must not disable, obscure or remove them.

(b) They are Ploid's duties as provider, not the Customer's as deployer. Where the Customer's own use of the Services engages obligations it owes to the people whose data it processes — including under Arts. 13, 14 and 22 GDPR, or as a deployer under Regulation (EU) 2024/1689 — those remain the Customer's, and Section 3.5 governs the assistance Ploid provides with them.

6. Personal data breaches

6.1 Ploid notifies the Customer of a personal data breach affecting Customer Content without undue delay, and in any event within forty-eight (48) hours of becoming aware of it, by email to the workspace's registered contact and in the application.

6.2 The notification describes, to the extent known: the nature of the breach, the categories and approximate volume of data and data subjects affected, the likely consequences, and the measures taken or proposed. Where the information is not all available at once, Ploid provides it in phases.

6.3 Ploid does not notify a supervisory authority or data subjects on the Customer's behalf, as that duty is the controller's, but assists the Customer in discharging it.

7. International transfers

7.1 Ploid's own multi-tenant production infrastructure for the Services is located in the European Union. A deployment operated for a single Customer is located in the region agreed with that Customer, which may be outside the EEA; where it is, the Customer has selected that location and the transfer is made on the basis in Section 7.2.

7.2 Where a transfer of Customer Content outside the EEA is necessary — in particular where the deployment is located outside the EEA under Section 7.1, where the Customer has selected global residency under Section 5.3, or where a sub-processor identified as non-EU on the Subprocessors page is involved — Ploid relies on the European Commission's Standard Contractual Clauses (Decision 2021/914) or another mechanism valid under Chapter V GDPR, together with any supplementary measures the transfer requires.

7.3 Where the Customer is established outside the EEA and the GDPR applies to its processing, the parties will, on the Customer's request, put in place the Standard Contractual Clauses appropriate to their roles (Module Four, processor to controller, where Ploid exports to the Customer).

8. Audit and information

8.1 Ploid makes available the information necessary to demonstrate compliance with this DPA, and will respond to a reasonable data-protection questionnaire once in any twelve-month period.

8.2 Where the Customer requires an audit or inspection under Art. 28(3)(h) GDPR, the parties will agree its scope, timing and duration in advance. Audits are limited to once in any twelve-month period unless a supervisory authority requires otherwise or a personal data breach has occurred; are conducted during business hours with at least thirty (30) days' notice; must not disrupt the Services or the confidentiality of other customers' data; and, where conducted by a third party, require that party to be bound by confidentiality and not to be a competitor of Ploid. The Customer bears its own costs and Ploid's reasonable costs of assistance.

9. Deletion and return

9.1 What the Customer can do itself, at any time. The Services provide export and deletion per resource: a dataset, script, workflow definition or run can be downloaded, and any resource can be deleted, which removes it from Ploid's storage. A workspace owner can delete a self-serve team workspace outright, which purges its Customer Content as described in 9.3.

There is no single export of a whole workspace or account, and this Agreement does not promise one. A Customer needing Customer Content returned in bulk, or an account closed, should ask at privacy@ploid.ai, and Ploid will carry it out under 9.2.

9.2 On termination of the Agreement, or on the Customer's instruction, Ploid deletes Customer Content, subject to 9.3 and 9.4.

9.3 Timing. Where a workspace owner deletes a self-serve team workspace, its Customer Content is purged as part of that deletion. Where a workspace is suspended, its Customer Content is retained for a grace period — 60 days by default on Ploid's own deployments — so that it can be restored, and is then purged. Data deleted from the live Services may persist in encrypted backups until those backups age out on their normal cycle.

9.4 Exception. Ploid may retain Customer Content to the extent, and for as long as, EU or Member State law requires. Such data remains subject to this DPA.

9.5 Ploid confirms deletion in writing on request.

10. Term

This DPA takes effect when the Customer first uses the Services and continues for as long as Ploid processes Customer Content, notwithstanding termination of the Agreement.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in Section 11 of the Agreement, except where the GDPR or other applicable law does not permit that limitation, in particular in respect of Art. 82 GDPR claims by data subjects.

12. Governing law

This DPA is governed by the laws of Spain and Section 14 of the Agreement applies to disputes arising from it, without prejudice to any mandatory rule of the GDPR.

Annex 1 — Details of the processing

1. Subject matter. Provision of the Ploid platform for bioinformatics and life-sciences analysis to the Customer.

2. Duration. For the term of the Agreement and the deletion periods in Section 9.

3. Nature of the processing. Storage; retrieval; execution of computational workflows and analysis code; execution of AI-assisted analysis, including transmission to model inference providers; generation of derived results; export; deletion; backup; and the logging and monitoring necessary to operate and secure the Services.

4. Purposes. To provide the Services the Customer requests. In addition, and only to the extent the Customer's Plan expressly permits, to train, evaluate and improve Ploid's models, features and services. Those Plan-based permissions are set out in Section 6 of the Agreement and are incorporated here rather than restated, so that a single statement of them governs. A Plan's permission constitutes a Customer instruction under Section 3.1 of this DPA; where a Plan grants no such permission, Ploid processes for no purpose beyond providing, securing and supporting the Services.

5. Categories of data subjects. The Customer's personnel, collaborators and authorized users; and any individuals whose personal data the Customer chooses to place in Customer Content — for example research participants or donors whose biological or phenotypic data the Customer analyses.

6. Categories of personal data. Identifiers and contact details of the Customer's users; the content of Conversations; and whatever personal data the Customer includes in datasets, files, scripts, workflow inputs, study materials and results. Ploid does not control or inspect that selection.

7. Special categories. Only on the four conditions in Section 2.3: a lawful basis under Art. 9(2) GDPR determined by the Customer, the safeguards that Section requires applied before upload, the processing remaining within the intended purpose and outside the prohibited uses of Sections 4A and 4.2 of the Agreement, and the workspace declared for human data before such data is placed in it. Genetic and health data are the categories most likely to be relevant in this context.

8. Frequency. Continuous, for as long as the Customer uses the Services.

Annex 2 — Technical and organizational measures (Art. 32 GDPR)

Encryption. Data in transit is encrypted with TLS. Data at rest — object storage, databases and volumes — is encrypted using managed keys.

Tenant isolation. Every request carries a verified workspace and organization context, validated against the caller's membership on the server before any data is returned. Stored objects are namespaced by workspace and organization.

Access control. Role-based permissions within each workspace. Administrative access to production systems is least-privilege, individually attributed, requires a session through a managed access path rather than direct network exposure, and is logged.

Network controls. Application services are not directly exposed; ingress is terminated at a reverse proxy and authenticated and authorized before it reaches a service. Environments that execute analysis code run with restricted egress, limited to an explicit allow-list of scientific data sources.

Secret management. Credentials and keys are held in a managed secrets store, delivered to hosts at deployment time, and are not committed to source control.

Segregation. Development, staging and production run in separate cloud accounts with separate data.

Resilience. Managed database backups with point-in-time recovery, and versioned object storage.

Monitoring and logging. Centralized logs, metrics and alerting covering availability, error rates and administrative actions.

Change management. Peer-reviewed changes, automated formatting, linting and tests in continuous integration, and staged release channels with a canary deployment ahead of the customer fleet.

Personnel. Confidentiality obligations for everyone with access, and access granted on the basis of role.

Vulnerability management. Pinned dependency versions, automated dependency and image rebuilds, and remediation prioritized by severity.

Annex 3 — Sub-processors

The current list of sub-processors, each with its role, the processing it performs and its location, is published at Subprocessors and forms part of this DPA. Section 4 governs changes to it.