Data Processing
Addendum.

This Addendum applies where you use the Service as an organisation and your use involves personal data for which you are the controller, for example team member records, or personal data contained in briefs, measurements or reference images you upload.

• For that customer content you are the controller and Seamix AI is the processor.
• For your own account, billing, security and product analytics data we are the controller, and the Privacy Policy applies.
• This Addendum forms part of the Terms of Service and applies automatically, with no signature needed. A countersigned copy is available on request from privacy@seamix.ai.
• It is governed by the UK GDPR and the Data Protection Act 2018, and by the EU GDPR where that applies to you.

• We process customer content only on your documented instructions, which include your use of the features of the Service, and for no other purpose.
• We will tell you if in our opinion an instruction infringes data protection law, and may suspend that instruction.
• We keep customer content confidential and ensure that personnel authorised to access it are bound by confidentiality and are trained appropriately.
• We implement the technical and organisational measures described in the Privacy Policy and the Security Policy, and will not materially reduce them during your subscription.
• We assist you, at your cost where the work is substantial, in responding to data subject requests, and will forward to you without undue delay any request we receive that relates to your customer content.
• We provide the information reasonably necessary for you to carry out a data protection impact assessment or to consult a supervisory authority.
• We notify you without undue delay, and in any event within 48 hours of becoming aware, of any personal data breach affecting your customer content, with the information available to us at that point and updates as the investigation progresses.

You give general authorisation for us to engage the sub-processors listed on the Sub-processors page. We impose data protection obligations on each of them that are at least as protective as those in this Addendum, and we remain responsible to you for their performance. We will give at least 30 days notice of an addition or replacement, and you may object on reasonable data protection grounds and, if the objection cannot be resolved, terminate the affected subscription with a refund of the unused prepaid period.

Customer content is hosted in the United States as described in the Privacy Policy. Where the transfer requires a safeguard, the parties incorporate the European Commission Standard Contractual Clauses (Decision 2021/914), Module Two where you are a controller and we are your processor, together with the UK International Data Transfer Addendum issued under section 119A of the Data Protection Act 2018. The following selections apply: the data exporter is you, the data importer is Seamix AI, the optional docking clause applies, Clause 9 option (a) general written authorisation with 30 days notice applies, Clause 11 does not use the independent dispute resolution option, the governing law and forum are those stated in the Terms of Service, and Annexes I to III are populated by section 2 of this Addendum, the Privacy Policy and the Sub-processors page.

• We will make available the information reasonably necessary to demonstrate compliance with this Addendum. Because we are a small provider without a SOC 2 report, we satisfy audit rights by written response to a reasonable questionnaire, no more than once in any 12 months unless a breach or a regulator requires more.
• You may export your documents and content from the dashboard at any time.
• On termination we delete customer content from live systems in accordance with the Privacy Policy, and it is removed from routine backups on our providers' standard cycle, unless retention is required by law.

Liability under this Addendum is subject to the limitation of liability in the Terms of Service. Where this Addendum conflicts with the Terms of Service on the processing of customer content, this Addendum prevails.