Data Processing Addendum (DPA) – CRM

1.1 This Addendum forms an integral part of the Agreement (the “Agreement” or the “Terms of Use”). In the event of a conflict between the documents – the order of precedence set out in clause 18 of the Agreement shall apply; with respect to privacy protection/information security – the Customer shall rely on this Addendum and it shall prevail.

1.2 The Customer acts as data Controller and the Company as data Processor with respect to the “Customer Data” as defined in the Agreement.

1.3 Purpose: processing of personal information for the purpose of providing the services under the Agreement, including support, maintenance, security and operational improvement. Personal information may also be processed for the purpose of: generating simulations and computations, filling in forms, creating reasoning documents (מסמך הנמקה), advisory / pre-advisory reports, monthly reports, call summaries, extraction of information from documents and generation of AI/OCR-based outputs, and more.

1.4 Geographic scope: Israeli law (the Protection of Privacy Law, 5741-1981 and the Protection of Privacy Regulations (Information Security), 5777-2017).

2.1 Data subjects (subject to the Customer’s use): End Clients (insureds/members/taxpayers/borrowers and the like), leads, attorneys-in-fact, family members/beneficiaries, the Customer’s employees, and Authorized Users.

2.2 Categories of information (according to the Customer’s use, the required minimum): identification and contact details (name, ID number, passport, addresses, telephone, email), financial/insurance/pension client data (policy number, institutional body, coverages, management fees, action history), documents and records of enquiries, operational logs, a generated report, a saved simulation, a completed form, a reasoning document created, AI output, handling notes, an approval log, template/formula/parameter version.

2.3 Sensitive information (to the extent the Customer enters/imports it): health/pension/biometric/consumption-habit information – only in accordance with law, on an appropriate lawful basis and to a minimal extent.

2.4 Duration of processing: for as long as the Agreement continues and for the retention periods required by law or under clause 10 below.

3.1 The Company shall process personal information solely in accordance with documented instructions of the Customer (as arising from the Agreement, the configuration in the System, support tickets or written directions), unless processing is required by law – in which case notice will be given to the Customer if that is possible.

3.2 Instructions of Authorized Users. Any action or instruction given in the System by an Authorized User of the Customer, including an employee, referent, office manager, sub-agent or subcontractor, shall be deemed a documented instruction of the Customer to the Company for the purpose of processing the information, subject to the permissions defined in the System. The Customer is responsible for managing the permissions of its users, determining access levels, supervising their actions, revoking access of users who are no longer authorized, and ensuring that all use of personal information by its users is lawful and in accordance with the permitted purposes.

3.3 The Customer declares that it has a lawful basis for processing (consent/law/contract/legitimate interest), that it has informed data subjects as required by law, and that it will not instruct the Company to carry out unlawful processing.

4.1 Access of Company employees to personal information shall be limited to the “need to know” principle and shall be conditional upon an appropriate confidentiality undertaking and privacy/security training.

4.2 The Company shall maintain an internal record of processing activities as required by law.

5.1 The Company shall implement commercially reasonable measures consistent with the law.

6.1 Upon becoming aware of a security incident materially affecting the Customer’s personal information, the Company shall notify the Customer as soon as possible and without unreasonable delay, and no later than 72 hours, and shall provide (so far as known at that time): a description of the incident, types of data, scope of those affected, consequences, mitigation steps and recommended steps.

6.2 The parties shall cooperate in the investigation, the mitigation and in notifications to authorities/data subjects; the Customer is responsible for the mandatory notifications to data subjects/the regulator.

7.1 The Company shall assist the Customer – so far as technically possible and to a reasonable extent – in responding to data subject requests (right of access/rectification/erasure/portability/restriction/objection), including by providing tools for export/search/deletion.

7.2 The Company shall assist the Customer in meeting regulatory obligations/consultations, as required and so far as actually possible.

8.1 The Customer authorizes the Company to engage sub-processors for the purpose of providing the Service, including providers of cloud, storage, email, SMS, WhatsApp, telephony, monitoring, information security, digital signature, forms, extraction of information from documents (OCR), AI tools, language models, automation, support, operations and additional providers required to operate the Service.

8.2 The Company shall engage sub-processors under a data processing agreement or appropriate contractual undertakings, at a level of protection not materially lower than the provisions of this DPA.

8.3 The Company shall publish/make available to the Customer an up-to-date list of sub-processors and shall give 15 days’ prior notice before adding a new sub-processor; the Customer may object on reasonable grounds.

8.4 Processing/storage location: Israel, Germany.

9.1 The Customer’s use of third-party services (including the Pension Clearing House, Har HaBituach, transmission providers) is subject to their terms and to law; the Customer is responsible for obtaining valid consents/permissions, and for managing and documenting them. Disclosure of data to these providers shall be deemed a transfer by the Customer; the Company shall transfer information to them only in accordance with the Customer’s instructions and within the framework of the built-in integration.

9.2 To the extent the Customer uses the System for the purpose of sending reports, forms, documents, simulations, a reasoning document, advisory reports, notices or other outputs to an End Client, a product manufacturer, an institutional body, a pension clearing house, Har HaBituach, a bank or any other third party, such sending shall be deemed processing and a transfer of information at the Customer’s instruction. The Customer is responsible for ensuring that a lawful basis, permission, consent, power of attorney or appropriate contractual obligation exists for every such sending or disclosure, and that the recipient’s details, the content of the document and the scope of the information sent are correct, necessary and permitted under law.

9.3 The Company is not responsible for the processing of the information at the recipient after it has been sent at the Customer’s instruction, including at product manufacturers, institutional bodies, End Clients or third-party providers.

10.1 The Company shall retain personal information only for as long as required to provide the Service and in accordance with law.

10.2 Upon termination of the engagement or at the Customer’s request, the Company shall enable data export; thereafter it shall carry out deletion from the production environments within 60 days and deletion/anonymization from the backups in their regular cycle (without ongoing use), unless retention is required by law or for the purpose of legal defence.

10.3 The Customer is responsible for downloading/retaining copies for lawful compliance purposes.

10.4 Retention of outputs and logs. Reports, forms, simulations, generated documents, AI outputs, statuses, handling notes, approval records, logs and template or formula versions may be retained as part of the Customer Data, for the purpose of operating the Service, documenting actions, control, information security, support, export, compliance with law and defence against claims. The Customer is responsible for determining whether and how to retain copies of outputs for the purpose of meeting its professional and regulatory obligations, including documentation obligations, document retention and disclosure to End Clients. Deletion of information from the System shall not derogate from the Customer’s obligation to retain documents or records to the extent such obligation applies to it under law.

11.1 At the Customer’s request, and at a frequency not exceeding once every 12 months (or in the event of a material security incident), the Company shall provide reasonable information to demonstrate its compliance (security reports, security questionnaires, relevant third-party standards).

11.2 An on-site audit shall be conducted only if required and after alternative means have been exhausted (questionnaire/evidence), upon 45 days’ prior coordination, during working hours, without disclosing trade secrets/information of other customers, and at the Customer’s expense.

12.1 The Customer shall define and enforce RBAC, MFA, a password policy, and a retention/deletion policy.

12.2 The Customer shall ensure a lawful basis for processing (including processing of sensitive information), the drafting of privacy notices, obtaining consents, responding to data subject rights and documenting actions.

12.3 The Customer shall refrain from uploading information exceeding what is required, and shall not enter secrets/keys/passwords into AI features — contrary to clause 11 of the Agreement.

12.4 The Customer is responsible for ensuring that any personal information entered, uploaded, synchronized, processed, analysed, sent or generated through the System is based on an appropriate lawful basis, relevant to the purpose of processing, accurate as required, current, minimal and does not exceed what is required for the Service.

12.5 The Customer is responsible for checking the correctness of the information and the outputs before using them vis-à-vis End Clients or third parties, including simulations, forms, reports, a reasoning document, advisory reports, pre-advisory reports, monthly reports and AI/OCR-based outputs.

12.6 The Customer is responsible for ensuring that use of automated tools, AI, OCR, classification, information extraction, auto-fill, technical recommendations or generated outputs does not cause unlawful processing of information, excessive information, discrimination, infringement of privacy, infringement of data subject rights or use of information beyond the purpose for which it was collected.

13.1 The limitations of liability under clause 16 of the Agreement shall apply, subject to the provisions of law.

13.2 The Customer shall indemnify the Company for damage/fines arising from its unlawful/incorrect instructions or from unlawful processing on its initiative.

13.3 This Addendum shall prevail over the Terms of Use in all matters relating to the processing of personal information, security, sub-processors and international transfers.

14.1 The Company’s information security and privacy officer, by email: support@shavve.io

14.2 The Customer shall designate a contact person on its behalf and shall send their contact details upon joining the Service.