Jua Data Processing Agreement

Effective date: October 27th, 2026

1. Parties

This data processing agreement (the DPA) is entered into by Jua.ai AG (we or Processor) and the Customer (Controller) when concluding a contract in connection with the conclusion of a contract for use of the Jua Platform. This DPA forms an integral part of the Jua Customer terms and any individual written agreement between the Customer and us (the Parties) relating to the Jua Platform (together or individually Customer Terms).

2. Details of the Processing

Subject matter	The provision of the Jua Platform, including the Processor's software-as-a-service solutions and APIs, by the Processor to the Customer under the Customer Terms.
Duration of the processing	The Term of this Agreement.
Nature and purpose	The Processor hosts and processes Customer Personal Data in the Jua Platform to provide, operate, secure and support the Jua Platform for the Customer, including investigating errors and monitoring the quality of the service for the Customer. The Processor does not use Customer Personal Data to train or improve AI models.
Categories of data	Any personal data that the Customer's users upload to or enter into the Jua Platform, such as files, messages and prompts, and the names and email addresses of the Customer's users as linked to that data, for example as the author of a message.
Sensitive data	None. The Customer will not upload to or enter into the Jua Platform any special categories of personal data, personal data relating to criminal convictions and offences, or other sensitive personal data.
Frequency of the transfer to the Processor	Continuous
Data subjects	The Customer's users, such as its employees and contractors, and any other individuals whose personal data the Customer's users upload to or enter into the Jua Platform.

3. Technical and Organizational Security Measures

The Processor runs an information security management system certified to ISO/IEC 27001:2022.
Personal data is encrypted in transit and at rest.
Personal data is hosted with Subprocessors, mainly in the EU. The Subprocessors are responsible for the physical security of their data centres.
Access to Customer Personal Data is limited to personnel who need it for their role.
Information is classified by protection need.
Changes to systems and their configuration follow a change management process.
Data is backed up, and the Processor has a business continuity process.
Security-relevant events are logged.
Security incidents are handled through an incident process.
The Processor manages information security risks and carries out internal audits of its information security management system.
Employees are bound by confidentiality and receive security awareness training.

4. Subprocessors

The Subprocessors engaged by the Processor at the Effective Date, with their name, location and a description of the processing, are listed at Jua Subprocessors (the "Subprocessor Page"). The Processor keeps this list up to date in accordance with Section 5.4.

1. Parties

2. Details of the Processing

3. Technical and Organizational Security Measures

4. Subprocessors

5. Data Processing Terms