Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service and, where applicable, the Numen Books Service Terms (together, the "Agreement") between AICY, Inc. ("AICY", "we") and the Customer ("you"). It applies whenever AICY processes Customer Personal Data on your behalf in providing Numen (the "Services"). It takes effect automatically when you accept the Agreement; no signature is required. If you need a countersigned copy, email numen-support@aicy.ai.

1. Definitions

• "Data Protection Laws" means all laws applicable to the processing of Customer Personal Data under the Agreement, which may include the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (CCPA) and other US state privacy laws, and the Korean Personal Information Protection Act (PIPA).

• "Customer Personal Data" means personal data contained in Customer Content that AICY processes on your behalf.

• "Subprocessor" means a third party engaged by AICY that processes Customer Personal Data.

• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

• Terms such as controller, processor, data subject, and processing have the meanings given in the GDPR (and their equivalents under other Data Protection Laws, including business and service provider under the CCPA).

2. Roles and scope

You are the controller (or a processor acting for your own controller), and AICY is your processor (and, under the CCPA, your service provider) for Customer Personal Data. AICY is a controller only for account, billing, support, and website data, which is governed by our Privacy Policy. Annex I describes the processing.

3. Your instructions

AICY processes Customer Personal Data only on your documented instructions. The Agreement, this DPA, and your use and configuration of the Services are your complete instructions. AICY will tell you if, in its opinion, an instruction infringes Data Protection Laws. You are responsible for the lawfulness of your instructions and for having a lawful basis, and giving any required notices, for the Customer Personal Data you provide — including data about your personnel and financial accounts you connect.

4. AICY's obligations

• Confidentiality. Personnel authorised to process Customer Personal Data are bound by confidentiality obligations.

• Assistance. Taking into account the nature of the processing, AICY will provide reasonable assistance with data-subject requests, data protection impact assessments, and prior consultations, to the extent you cannot reasonably do so yourself using the Services. AICY will forward to you any data-subject request it receives about Customer Personal Data and will not respond substantively without your authorisation.

• No sale or secondary use. AICY will not sell or share Customer Personal Data (as those terms are defined in the CCPA), will not retain, use, or disclose it for any purpose other than providing the Services or outside the direct business relationship with you, and will not combine it with personal data from other sources except as permitted by Data Protection Laws. AICY does not use Customer Personal Data to train AI models.

• Legal requests. If a public authority requests Customer Personal Data, AICY will, unless legally prohibited, notify you and seek to redirect the request to you.

5. Security

AICY implements the technical and organisational measures in Annex II, which are designed to protect Customer Personal Data against Security Incidents. AICY may update these measures provided the overall level of protection is not reduced.

6. Security Incidents

AICY will notify you without undue delay after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, to the extent then known, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. AICY will supplement the notice as further information becomes available and take reasonable steps to contain and remediate the incident. Notification is not an acknowledgement of fault or liability.

7. Subprocessors

• You give AICY general authorisation to engage Subprocessors. The current Subprocessors are listed in Annex III and in our Privacy Policy.

• AICY will give at least 30 days' notice before adding or replacing a Subprocessor, by updating the Privacy Policy and notifying account administrators by email.

• You may object on reasonable data-protection grounds within that notice period. The parties will discuss the objection in good faith. If it is not resolved, you may terminate the affected Services by written notice before the change takes effect.

• AICY imposes data-protection obligations on each Subprocessor that are no less protective than those in this DPA, and remains responsible for its Subprocessors' performance as required by Data Protection Laws.

8. International transfers

• AICY is established in the Republic of Korea, which is the subject of an adequacy decision of the European Commission (17 December 2021) and adequacy regulations of the United Kingdom (2022). Transfers of Customer Personal Data from the EEA and the UK to AICY rely on those decisions.

• Customer Personal Data of workspaces in our US region is stored in the United States (see Annex III). Where AICY transfers Customer Personal Data onward to a Subprocessor in a country without an adequacy decision, AICY ensures the transfer is protected by an appropriate safeguard under Data Protection Laws, such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) in its contract with that Subprocessor, or the Subprocessor's certification under the EU–US Data Privacy Framework.

• Fallback. If an adequacy decision relied on above ceases to apply to a transfer to AICY, the Standard Contractual Clauses (Module 2, or Module 3 where you are a processor) are incorporated into this DPA for that transfer, with Annexes I–III completing their appendices, the optional docking clause and Clause 11 option omitted, Clause 9 Option 2 (general authorisation, with the notice period in Section 7), and, for Clauses 17 and 18, the law and courts of Ireland. For transfers from the UK or Switzerland, the UK Addendum and the necessary Swiss adaptations apply in the same way.

9. Audits

On written request, and no more than once in any 12-month period, AICY will make available information reasonably necessary to demonstrate compliance with this DPA — such as security documentation, completed security questionnaires, and, once issued, its SOC 2 report (SOC 2 Type II is in progress). Information provided is AICY's confidential information. An on-site audit will take place only where required by Data Protection Laws or a competent supervisory authority, on reasonable prior notice, during business hours, in a manner that does not compromise other customers' data, and at your cost.

10. Return and deletion

You may export Customer Content at any time during your subscription and for 30 days after it ends. After that, AICY deletes Customer Personal Data from active systems; residual copies in backups are overwritten in the ordinary 14-day backup cycle. AICY may retain data only where required by applicable law, in which case this DPA continues to apply to it.

11. Korean customers

Where PIPA applies, this DPA is the written entrustment document under Article 26 of PIPA, and covers the prohibition on processing for purposes other than the entrusted work, technical and managerial safeguards, restrictions on re-entrustment, supervision, and liability. The Korean-language 개인정보 처리업무 위탁 부속서 applies to it.

12. Liability and precedence

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Laws do not permit them to be limited. If this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA prevails; if the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail. This DPA ends when AICY stops processing Customer Personal Data under the Agreement.

Annex I — Description of processing

Annex II — Technical and organisational measures

• Access control — least-privilege, role-based access for personnel; periodic removal of unnecessary access; controls against unauthorised external access.

• Tenant isolation — data access separated per customer organisation, with database-level policies that block queries not scoped to a verified organisation.

• Encryption — TLS for data in transit; data at rest encrypted; passwords stored with one-way hashing.

• Logging — access logs for processing systems retained and protected against alteration.

• Vulnerability management — security configuration against intrusion and management of vulnerabilities in software dependencies.

• Resilience — backups retained for 14 days.

• AI processing — AI providers accessed only through their APIs, whose terms do not use submitted content for training by default; AI outputs are proposals confirmed by your users.

• Physical security — infrastructure operated in cloud providers' data centres under their physical access controls.

• Assurance — SOC 2 Type II in progress.

Annex III — Subprocessors

Contact

• Legal entity: AICY, Inc. (아이씨 주식회사)

• Business registration no.: 331-81-02537

• E-commerce filing no.: 2022-Seongnam Bundang A-1007

• Address: 180 Bangbae-ro, Seocho-gu, Seoul, Republic of Korea

• Email: numen-support@aicy.ai