Motivs.ai Data Processing Agreement

Effective date: 7 October 2026
Document identifier: DPA-2026-10-07

Part A — Supplemental / Commercial DPA Terms

A1. Incorporation and parties

This Data Processing Agreement ("DPA") applies between MOTIVS OÜ ("Motivs") and the legal entity identified as Customer in the applicable Order, contracting record, account/business contact record, electronic acceptance record or other agreement expressly incorporating this DPA ("Customer"). The Customer must be identifiable as a legal entity; an individual user's account alone does not establish the identity of the contracting Customer.

The DPA forms part of the parties' agreement for Motivs.ai and Motivs Flow ("Service"). Terms defined in the applicable Motivs Terms of Service ("Terms") have the same meaning here unless this DPA states otherwise. For this DPA, "Customer Data" means personal data within Customer Data as defined in the Terms that Motivs processes on the Customer's behalf.

The parties may execute this DPA electronically: through affirmative acceptance of Terms expressly incorporating this DPA, through an Order expressly incorporating the Terms and DPA, or through a separately signed written or electronic agreement. The acceptance or signature must bind both parties and include Annex I by reference. No wet-ink signature is required. The contracting record must identify the Customer, its address and contact, the accepting representative and authority, organization, acceptance date/time and incorporated document versions. The DPA is identified by DPA-2026-10-07, whether recorded in a separate version field where supported or in the incorporated agreement and retained document copy.

Each Customer's acceptance creates a separate agreement with Motivs, not an agreement with other unrelated Customers. Additional parties may accede under Clause 5 of Part B only with all existing parties' agreement, completion of the relevant Annexes and execution of Annex I.

A2. Scope, roles and instructions

The Customer acts as controller and Motivs as processor for the processing described in Annex II. This DPA does not change the roles for processing for which Motivs independently acts as controller, including its own account/business administration, billing, legal compliance, website activity and corporate operations, and its own security and correspondence processing where it determines the purposes and essential means. Roles follow the actual activity. Security, access support and support actions undertaken on the Customer's instructions remain within this DPA to that extent.

Documented instructions comprise this DPA, the applicable Terms and Order, the Customer's recorded configuration and use of the Service, and documented instructions from authorized Customer representatives through agreed support channels, insofar as lawful and consistent with this DPA. Further instructions must be documented and retained with the contracting or support record. Motivs must immediately inform the Customer if, in its opinion, an instruction infringes applicable data-protection law. Part B governs any suspension or termination on that ground.

The Customer is responsible for determining its processing purposes and lawful bases, lawfully collecting Customer Data, providing required notices, satisfying applicable sensitive-data requirements, issuing lawful instructions and assessing the Service's suitability. These responsibilities do not exclude or reduce Motivs' own duties as processor.

A3. Commission clauses and hierarchy

Part B contains the controller–processor standard contractual clauses adopted under European Commission Implementing Decision (EU) 2021/915, C(2021) 3701 ("Commission Clauses"). The GDPR option, Regulation (EU) 2016/679, is selected. The optional docking clause is retained. Annexes I–IV form part of the Commission Clauses. Annex IV is marked not applicable to the selected general written authorisation; the agreed list is in the separate Schedule 1.

The Commission Clauses prevail over conflicting provisions. Subject to that priority, this DPA governs processor-processing matters; an expressly negotiated Order may supplement the relationship without contradicting the Commission Clauses; the Terms govern the remainder. The Privacy Policy is a transparency notice. Neither the Terms' amendment procedure nor publication of an updated webpage alone changes agreed Commission Clauses or documented processing instructions.

A4. Subprocessor authorization and notices

The Customer gives general written authorization only for the subprocessors listed in Schedule 1 by entering into this DPA. This DPA and Schedule 1 constitute the agreed list under Clause 7.7.

Motivs must actively give at least 30 calendar days' advance written notice of an intended addition or replacement, identifying the provider, processing, locations and relevant safeguards. Notice is sent to the Customer's recorded administrator or business/data-protection contact; merely changing a public list is not notice. The Customer may object during that period on reasonable data-protection grounds by emailing team@motivs.ai.

The parties must work in good faith to address the objection. Motivs must not engage the objected-to subprocessor for that Customer's affected processing while the objection remains unresolved. If no reasonable solution is available, the Customer may terminate the affected processing or Service component without requiring either party to breach data-protection law. Urgency does not dispense with the advance-notice and authorization requirements of Clause 7.7. Motivs remains fully responsible for its subprocessors under that Clause.

Customer-selected Anthropic or OpenAI accounts are not automatically Motivs subprocessors. Their processing is governed by the Customer's separate provider relationship and the particular activity, as described in Annex II.

A5. Contacts and cooperation

Data-protection instructions, requests, audit arrangements, subprocessor objections and breach correspondence to Motivs may be sent to team@motivs.ai. Routine product support may be sent to support@motivs.ai. The Customer must keep its authorized contact details current. Motivs sends breach notifications and other DPA communications to the relevant contact recorded in Annex I or subsequently designated in writing.

Requests should identify the affected organization, workflow, records and requested action without unnecessarily transmitting sensitive contents. Annex III specifies assistance, breach information, audits and deletion arrangements. Contact mechanics do not delay notification without undue delay or restrict statutory or Commission-Clause rights.

A6. International transfers

The Commission Clauses in Part B do not themselves satisfy Chapter V GDPR. Motivs may transfer Customer Data to a third country or international organization only on documented Customer instructions or the specific legal basis described in Clause 7.8, and in compliance with Chapter V.

For each actual transfer, Motivs must establish an applicable mechanism, such as an adequacy decision covering the recipient and processing, appropriate Commission transfer SCCs under Decision (EU) 2021/914 where their conditions are met, or another valid Chapter V mechanism. Provider incorporation, EU storage or availability of standard provider terms alone does not establish the applicable mechanism.

Where Motivs-to-subprocessor transfers require transfer SCCs, the relevant arrangements must be implemented at that processor–subprocessor level. Required transfer assessments and supplementary measures must be documented for the actual transfer; neither this DPA nor the backup-encryption description represents that such an assessment has already been completed. Relevant safeguard information and copies must be made available to the Customer, with permitted confidentiality redactions. No blanket Customer-to-Motivs transfer-SCC appendix is incorporated by this DPA.

A7. Liability and supplemental governing framework

The applicable Terms/Order liability provisions apply to the extent legally permissible. Nothing in them or this DPA limits liability or rights where that would contradict mandatory data-protection law or the Commission Clauses, including Motivs' responsibility for subprocessors.

The supplemental terms are governed by Estonian law, without conflict-of-law rules requiring another law, and Harju County Court (Harju Maakohus), Estonia, has exclusive jurisdiction over contractual B2B disputes, subject to mandatory law. This does not displace GDPR rights, supervisory-authority competence, mandatory jurisdiction rules or any controlling Commission-Clause provision.

Part B — European Commission Article 28 Standard Contractual Clauses

SECTION I

Clause 1 — Purpose and scope

(a) The purpose of these Standard Contractual Clauses (the Clauses) is to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

(b) The controllers and processors listed in Annex I have agreed to these Clauses in order to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679.

(c) These Clauses apply to the processing of personal data as specified in Annex II.

(d) Annexes I to IV are an integral part of the Clauses.

(e) These Clauses are without prejudice to obligations to which the controller is subject by virtue of Regulation (EU) 2016/679.

(f) These Clauses do not by themselves ensure compliance with obligations related to international transfers in accordance with Chapter V of Regulation (EU) 2016/679.

Clause 2 — Invariability of the Clauses

(a) The Parties undertake not to modify the Clauses, except for adding information to the Annexes or updating information in them.

(b) This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a broader contract, or from adding other clauses or additional safeguards provided that they do not directly or indirectly contradict the Clauses or detract from the fundamental rights or freedoms of data subjects.

Clause 3 — Interpretation

(a) Where these Clauses use the terms defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

(c) These Clauses shall not be interpreted in a way that runs counter to the rights and obligations provided for in Regulation (EU) 2016/679 or in a way that prejudices the fundamental rights or freedoms of the data subjects.

Clause 4 — Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties existing at the time when these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 5 - Optional — Docking clause

(a) Any entity that is not a Party to these Clauses may, with the agreement of all the Parties, accede to these Clauses at any time as a controller or a processor by completing the Annexes and signing Annex I.

(b) Once the Annexes in (a) are completed and signed, the acceding entity shall be treated as a Party to these Clauses and have the rights and obligations of a controller or a processor, in accordance with its designation in Annex I.

(c) The acceding entity shall have no rights or obligations resulting from these Clauses from the period prior to becoming a Party.

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 6 — Description of processing(s)

The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Annex II.

Clause7 — Obligations of the Parties

7.1. Instructions

(a) The processor shall process personal data only on documented instructions from the controller, unless required to do so by Union or Member State law to which the processor is subject. In this case, the processor shall inform the controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. Subsequent instructions may also be given by the controller throughout the duration of the processing of personal data. These instructions shall always be documented.

(b) The processor shall immediately inform the controller if, in the processor’s opinion, instructions given by the controller infringe Regulation (EU) 2016/679 or the applicable Union or Member State data protection provisions.

7.2. Purpose limitation

The processor shall process the personal data only for the specific purpose(s) of the processing, as set out in Annex II, unless it receives further instructions from the controller.

7.3. Duration of the processing of personal data

Processing by the processor shall only take place for the duration specified in Annex II.

7.4. Security of processing

(a) The processor shall at least implement the technical and organisational measures specified in Annex III to ensure the security of the personal data. This includes protecting the data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to the data (personal data breach). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks involved for the data subjects.

(b) The processor shall grant access to the personal data undergoing processing to members of its personnel only to the extent strictly necessary for implementing, managing and monitoring of the contract. The processor shall ensure that persons authorised to process the personal data received have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

7.5. Sensitive data

If the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (“sensitive data”), the processor shall apply specific restrictions and/or additional safeguards.

7.6 Documentation and compliance

(a) The Parties shall be able to demonstrate compliance with these Clauses.

(b) The processor shall deal promptly and adequately with inquiries from the controller about the processing of data in accordance with these Clauses.

(c) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations that are set out in these Clauses and stem directly from Regulation (EU) 2016/679. At the controller’s request, the processor shall also permit and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or an audit, the controller may take into account relevant certifications held by the processor.

(d) The controller may choose to conduct the audit by itself or mandate an independent auditor. Audits may also include inspections at the premises or physical facilities of the processor and shall, where appropriate, be carried out with reasonable notice.

(e) The Parties shall make the information referred to in this Clause, including the results of any audits, available to the competent supervisory authority/ies on request.

7.7. Use of sub-processors

(a) GENERAL WRITTEN AUTHORISATION: The processor has the controller’s general authorisation for the engagement of sub-processors from an agreed list. The processor shall specifically inform in writing the controller of any intended changes of that list through the addition or replacement of sub-processors at least 30 calendar days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned sub-processor(s). The processor shall provide the controller with the information necessary to enable the controller to exercise the right to object.

(b) Where the processor engages a sub-processor for carrying out specific processing activities (on behalf of the controller), it shall do so by way of a contract which imposes on the sub-processor, in substance, the same data protection obligations as the ones imposed on the data processor in accordance with these Clauses. The processor shall ensure that the sub-processor complies with the obligations to which the processor is subject pursuant to these Clauses and to Regulation (EU) 2016/679.

(c) At the controller’s request, the processor shall provide a copy of such a sub-processor agreement and any subsequent amendments to the controller. To the extent necessary to protect business secret or other confidential information, including personal data, the processor may redact the text of the agreement prior to sharing the copy.

(d) The processor shall remain fully responsible to the controller for the performance of the sub-processor’s obligations in accordance with its contract with the processor. The processor shall notify the controller of any failure by the sub-processor to fulfil its contractual obligations.

(e) The processor shall agree a third party beneficiary clause with the sub-processor whereby - in the event the processor has factually disappeared, ceased to exist in law or has become insolvent - the controller shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

7.8. International transfers

(a) Any transfer of data to a third country or an international organisation by the processor shall be done only on the basis of documented instructions from the controller or in order to fulfil a specific requirement under Union or Member State law to which the processor is subject and shall take place in compliance with Chapter V of Regulation (EU) 2016/679.

(b) The controller agrees that where the processor engages a sub-processor in accordance with Clause 7.7. for carrying out specific processing activities (on behalf of the controller) and those processing activities involve a transfer of personal data within the meaning of Chapter V of Regulation (EU) 2016/679, the processor and the sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 by using standard contractual clauses adopted by the Commission in accordance with of Article 46(2) of Regulation (EU) 2016/679, provided the conditions for the use of those standard contractual clauses are met.

Clause 8 — Assistance to the controller

(a) The processor shall promptly notify the controller of any request it has received from the data subject. It shall not respond to the request itself, unless authorised to do so by the controller.

(b) The processor shall assist the controller in fulfilling its obligations to respond to data subjects’ requests to exercise their rights, taking into account the nature of the processing. In fulfilling its obligations in accordance with (a) and (b), the processor shall comply with the controller’s instructions

(c) In addition to the processor’s obligation to assist the controller pursuant to Clause 8(b), the processor shall furthermore assist the controller in ensuring compliance with the following obligations, taking into account the nature of the data processing and the information available to the processor:

(1) the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a ‘data protection impact assessment’) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;

(2) the obligation to consult the competent supervisory authority/ies prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk;

(3) the obligation to ensure that personal data is accurate and up to date, by informing the controller without delay if the processor becomes aware that the personal data it is processing is inaccurate or has become outdated;

(4) the obligations in Article 32 Regulation (EU) 2016/679.

(d) The Parties shall set out in Annex III the appropriate technical and organisational measures by which the processor is required to assist the controller in the application of this Clause as well as the scope and the extent of the assistance required.

Clause 9 — Notification of personal data breach

In the event of a personal data breach, the processor shall cooperate with and assist the controller for the controller to comply with its obligations under Articles 33 and 34 Regulation (EU) 2016/679, where applicable, taking into account the nature of processing and the information available to the processor.

9.1 Data breach concerning data processed by the controller

In the event of a personal data breach concerning data processed by the controller, the processor shall assist the controller:

(a) in notifying the personal data breach to the competent supervisory authority/ies, without undue delay after the controller has become aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons;

(b) in obtaining the following information which, pursuant to Article 33(3) Regulation (EU) 2016/679, shall be stated in the controller’s notification, and must at least include:

(1) the nature of the personal data including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

(2) the likely consequences of the personal data breach;

(3) the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

(c) in complying, pursuant to Article 34 Regulation (EU) 2016/679, with the obligation to communicate without undue delay the personal data breach to the data subject, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

9.2 Data breach concerning data processed by the processor

In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller without undue delay after the processor having become aware of the breach. Such notification shall contain, at least:

(a) a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned);

(b) the details of a contact point where more information concerning the personal data breach can be obtained;

(c) its likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

The Parties shall set out in Annex III all other elements to be provided by the processor when assisting the controller in the compliance with the controller’s obligations under Articles 33 and 34 of Regulation (EU) 2016/679.

SECTION III – FINAL PROVISIONS

Clause 10 — Non-compliance with the Clauses and termination

(a) Without prejudice to any provisions of Regulation (EU) 2016/679, in the event that the processor is in breach of its obligations under these Clauses, the controller may instruct the processor to suspend the processing of personal data until the latter complies with these Clauses or the contract is terminated. The processor shall promptly inform the controller in case it is unable to comply with these Clauses, for whatever reason.

(b) The controller shall be entitled to terminate the contract insofar as it concerns processing of personal data in accordance with these Clauses if:

(1) the processing of personal data by the processor has been suspended by the controller pursuant to point (a) and if compliance with these Clauses is not restored within a reasonable time and in any event within one month following suspension;

(2) the processor is in substantial or persistent breach of these Clauses or its obligations under Regulation (EU) 2016/679;

(3) the processor fails to comply with a binding decision of a competent court or the competent supervisory authority/ies regarding its obligations pursuant to these Clauses or to Regulation (EU) 2016/679.

(c) The processor shall be entitled to terminate the contract insofar as it concerns processing of personal data under these Clauses where, after having informed the controller that its instructions infringe applicable legal requirements in accordance with Clause 7.1 (b), the controller insists on compliance with the instructions.

(d) Following termination of the contract, the processor shall, at the choice of the controller, delete all personal data processed on behalf of the controller and certify to the controller that it has done so, or, return all the personal data to the controller and delete existing copies unless Union or Member State law requires storage of the personal data. Until the data is deleted or returned, the processor shall continue to ensure compliance with these Clauses.

Annex I — List of Parties

Controller

Name: The Customer legal entity identified in the applicable Order, contracting record or electronic acceptance record incorporating this DPA.
Address: The Customer's legal/business address recorded in that contracting record.
Contact person's name, position and contact details: The authorized business or data-protection contact identified in that record, as updated by written notice.
Signature and accession date: The signature or affirmative electronic acceptance and date/time in that record, executing this DPA including this Annex I.

These records are incorporated into Annex I and must contain the Customer's legal identity, address, contact and acceptance/accession date. The parties must retain an accessible record of the binding acceptance and incorporated document. Customer workflow specifications may complete Annex II through documented instructions.

Processor

Name: MOTIVS OÜ
Registry code: 17567337
Commercial Register: Estonian Commercial Register
Address: Rävala pst 7, Kesklinna linnaosa, Tallinn 10143, Harju maakond, Estonia
VAT number: EE103014074
Contact: Motivs privacy/legal contact, team@motivs.ai; product support, support@motivs.ai. The authorized contracting representative's name and position, where applicable, are those recorded in the Order or electronic contracting record.
Signature and accession date: Motivs' execution of the incorporating Order/agreement or binding electronic contracting record, together with the Customer's recorded acceptance, constitutes execution of this DPA including Annex I. The applicable date is recorded there; the document's effective date is not a substitute for the parties' acceptance record.

An additional controller or processor acceding under Clause 5 must supply the same identity, address, contact, role and signature/date information and complete the relevant processing details.

Annex II — Description of Processing

1. Subject matter and categories of data subjects

The subject matter is Customer-directed processing of spreadsheet/business files and workflow information to build, validate and execute automations and deliver Customer reports and business Outputs through Motivs Flow.

Depending on the Customer's actual files and instructions, data subjects may include Customer administrators and Authorized Users insofar as their information forms part of instructed processing; employees; clients/customers; suppliers/vendors; contractors; business contacts; and other persons whose personal data appears in Customer-provided files, instructions or workflows. The list does not imply that each category occurs for every Customer. Motivs' independent controller records are outside this Annex's scope.

2. Categories of personal data

The Customer selects the content. Depending on the workflow, Customer Data may include:

• identity and contact information appearing in business records;
• employment, role and other business information;
• spreadsheet records, operational or transactional information;
• Customer instructions, descriptions, build briefs, workflow specifications and customer-authored code or text;
• file and sheet names, field/column names, formats, data types, formulas, ranges and other structural metadata;
• generated or derived workflow information, reports, calculations and business Outputs; and
• personal data contained in security-inspection/quarantine evidence or Customer-configured run logs.

Only the categories actually submitted or derived on the Customer's instructions are processed. These descriptions do not authorize collecting unnecessary information or adding independent purposes.

3. Sensitive data and additional safeguards

Customer Data may contain special-category personal data only where lawful. Where GDPR applies, the Customer must identify an applicable Article 6 legal basis, an applicable Article 9(2) condition and additional safeguards required by applicable law. The applicable types, such as health information or trade-union membership where present in an HR workflow, must be identified in the Customer's documented workflow instructions; they are not assumed for every workflow.

Where Article 10 GDPR applies, the Customer must have an applicable Article 6(1) legal basis, and criminal-conviction/offence data may be processed only under the control of official authority or where authorized by applicable Union or Member State law providing appropriate safeguards. Motivs' prior express written approval is an additional contractual requirement, not a legal basis or legal authorization.

The Service does not automatically detect whether Customer Data contains these categories. Before processing them, the Customer must communicate the relevant types, risks and required restrictions through an authorized channel. Motivs may request reasonable evidence of the required conditions.

Safeguards include strict Customer-instructed purpose limitation; organization- and role-scoped access; access only for personnel with a necessary processing task and confidentiality obligations; restricted quarantine access; access/security logging; the metadata-limited connected-assistant boundary; and restrictions on onward disclosure and transfers. The parties must document any additional safeguards necessary for the particular sensitive-data workflow before that processing starts. Unnecessary sensitive information must not be placed in filenames, field names or customer-authored metadata returned to a connected assistant.

4. Nature and purpose of processing

Processor operations comprise receipt; security inspection and quarantine; storage/hosting where needed; deriving structural metadata; transformation on instructions; building and validating workflows; isolated execution of automations; generation and delivery of Outputs; access/authentication support insofar as part of instructed processing; necessary operational/security logging; backup and recovery; Customer-instructed support; and export, return and deletion.

The purpose is to provide, secure, maintain and support the Service and execute the Customer's documented instructions. Motivs does not use Customer Data to train its own AI models. This Annex does not authorize independent advertising, marketing, model-training or profiling purposes.

5. Connected AI assistants and disclosure boundaries

Motivs does not independently invoke an AI model API using Customer Data for this workflow. A user-connected Anthropic or OpenAI assistant calls Motivs tools, and selected Model Context Protocol (MCP) responses are returned to that assistant and its provider on the Customer's instructions.

Permitted responses include structural metadata, names, size bands, formula-related metadata, automation descriptions/instructions, validation feedback and Generated Automation Code. Names and customer-authored text may themselves contain personal data. The hosted interface is designed to withhold raw spreadsheet rows and cell values, exact totals, run logs, generated reports, paths and error detail quoting Customer Data. The boundary does not make disclosed metadata anonymous or guarantee that every infrastructure error contains no technical detail.

The Customer selects and controls the connected provider account and its separate terms, settings and retention/training choices. A user's direct upload or paste to that provider outside the hosted Motivs workflow is separate processing. Neither provider is included in Schedule 1 merely because a Customer connects its own account. Motivs remains responsible for its own instructed disclosure and applicable processor obligations.

6. Duration and lifecycle instructions

Processing lasts for the Customer's use of the applicable Service and the subsequent return/deletion period under this DPA. For processing under this DPA, Motivs must apply the following lifecycle instructions. These are contractual requirements; no entitlement to retain all Customer Data for every listed period arises.

For quarantine, accepted-upload sampled raw rows must be removed immediately. A rejected upload has a 48-hour appeal period, after which sampled rows and uploaded bytes must be deleted. Pending uploads must be automatically rejected after 30 days and then follow the rejection/deletion lifecycle. A lawful, documented hold may delay deletion only for its necessary scope and duration.

Account/authentication records processed independently by Motivs as controller follow the Privacy Policy rather than being converted into Customer-controlled records by this table. OAuth refresh-token validity is 30 days, distinct from database-row retention. This DPA does not prescribe an invented separate row-retention period. Likewise, seven-year statutory accounting retention is not a blanket retention period for Customer files, support messages or acceptance records.

A hold must identify its reason, affected records, access restriction and review/release criteria. It cannot justify ordinary reuse of data due for deletion. After processing ends, continued processor storage must comply with Clause 10(d): storage required by Union/Member State law is limited to that obligation, with notice where legally permitted. A general business, security or evidentiary preference does not override that Clause.

7. Return/export and deletion after processing ends

The Customer retains the choice in Clause 10(d) to request return/export or deletion and may change its documented choice before processing ends. Requests go to team@motivs.ai through an authorized representative. Motivs must coordinate the scope, recipient and secure delivery arrangements and document completion.

Motivs must use supported export/receipt mechanisms and reasonable technical/operational assistance to return the personal data processed on the Customer's behalf. No self-service privacy portal or bespoke migration service is promised. Absence of a particular interface does not remove the return obligation or permit exclusion of otherwise returnable data. The Customer must request return before ordinary lifecycle deletion or expiry makes the data unavailable; Motivs must provide a reasonable opportunity to exercise its choice when ending processing.

Ordinary primary-system data must be deleted within the 30-day closure/termination lifecycle, subject to Clause 10(d). Backup copies are not selectively edited during ordinary rotation. Residual copies must be protected from ordinary use and expire under the backup periods above. Data due for deletion must not be restored for ordinary processing. If restoration for recovery is necessary before expiry, the relevant deletion instructions must be reapplied before ordinary use resumes.

Motivs must certify completed deletion to the Customer. If residual protected backups or legally required copies remain, the completion information must identify that residual scope, the applicable expiry or legal restriction, and confirm final deletion once completed. A primary-system deletion report is not a certificate that every residual copy has already disappeared. These practical arrangements do not displace the Commission Clauses' deletion/return obligation.

8. Subprocessor processing

DigitalOcean provides service infrastructure hosting/operation for Customer Data held and processed by the Service. Google Cloud Storage stores sealed offsite backup copies for recovery. Google Workspace transmits and stores email communications to the extent they contain Customer Data processed on the Customer's instructions for support, DPA instructions, data-subject assistance or breach handling. Their processing is limited to the allocated functions, the agreed list and applicable downstream contracts. Hosting duration follows the relevant Service and deletion lifecycle; backup storage follows the backup lifecycle above. Google Workspace's processor-scope communications are subject to the instructed task and the DPA's deletion/return requirements. Ordinary Motivs corporate correspondence for its own purposes remains outside that processor scope. The current agreed subprocessors are listed in Schedule 1.

Annex III — Technical and Organisational Measures

The following are the concrete measures required for processing under this DPA. Motivs must implement and maintain them before, and throughout, the relevant processing. They are scoped to the stated components; this Annex does not promise universal live-data encryption at rest, mandatory MFA, a certification, continuous security monitoring or tested production disaster restoration.

1. Transport and credentials

Motivs must protect external Service connections carrying Customer Data with encrypted transport. Passwords must be stored using password hashing, not as readable password text. Session, CSRF and OAuth access credentials must be stored/compared through hash-based mechanisms rather than exposing readable stored credentials. Access must be checked through authenticated sessions or appropriately scoped OAuth access. These measures do not authorize sharing credentials between users.

2. Organization isolation and access controls

Customer records and object access must be scoped to the authenticated organization. Resolvers must check organization authorization rather than rely only on a supplied object identifier. Role-based access must restrict administration and export; organization export is restricted to an authorized owner through authenticated browser-session access. Connected tools must not receive browser-only report downloads.

Motivs must restrict operational access to personnel who need it to implement, manage or monitor the processing. Authorized personnel must have confidentiality commitments or appropriate statutory obligations. Customer support access must be limited to the instructed task and relevant organization. Customer administrators remain responsible for granting and removing their own Authorized Users.

3. Upload inspection and quarantine

Supported uploads must pass Motivs Guard's security/integrity gate before normal workflow processing. Risky material may be rejected or quarantined with a recorded decision. Quarantine evidence is restricted to authorized personnel for the relevant organization and is subject to the quarantine retention and deletion lifecycle in Annex II. Quarantine evidence and source bytes must follow Annex II's decision and expiry rules. Raw quarantine evidence is not part of the permitted connected-assistant response.

4. Isolated execution

Workflow validation and automation execution must use isolated execution environments. Runners must receive the data and task information needed for the relevant run rather than unrestricted cross-organization access. Interactive notebook access must not bypass the hosted isolation or access controls. Isolation is not a guarantee that Customer-provided code is free from errors; the Customer must validate consequential outputs under the Terms.

5. MCP minimization and output separation

Connected-assistant responses must use the structural/metadata response design described in Annex II, excluding raw rows, cell values, exact totals, run logs and generated reports. Generated reports must be delivered through authorized Service access, not a connected tool download. Workflow information and metadata must be limited to what the instructed operation requires. Customer-authored names/text remain potentially personal data, so this is not an anonymization guarantee.

6. Logging, lifecycle and holds

Motivs must record relevant actor, organization, access and security/workflow actions necessary to operate and secure instructed processing. Access/security records and run logs must follow Annex II's limits. Customer-configured code may write personal data to run logs; the Customer must minimize that content.

Deletion must cover relevant database records and stored objects, including associated copies, rather than merely ending account access. Expiry and deletion mechanisms must support the instructed run-input, gate-copy, output, workflow and account lifecycle. Holds must be scoped, recorded, access-restricted and reviewed, and must not become indefinite ordinary retention. Applicable deletion instructions must also be respected after recovery from a backup.

7. Backup confidentiality and recovery

Offsite database/file backup artifacts must be sealed before upload using CMS public-key encryption. The production host holds the public certificate, not the private decryption key. Access to decryption and recovery must be restricted to authorized operational personnel.

Sealed offsite backups are stored in Google Cloud Storage in EUROPE-WEST1, Coldline storage. Public access prevention is enforced and uniform bucket-level access is enabled. Cloud copies follow 90-day object deletion plus up to 7-day soft delete; host and operator sealed copies follow 14- and 60-day rotation respectively. Residual deleted-Customer copies must be excluded from ordinary use.

Backups support recovery; this description is not an uptime commitment or a representation of a completed production restoration test. Recovery does not permit ordinary restoration of data already due for deletion.

8. Security maintenance and accountability

Motivs must make information about the applicable processing design, access boundaries, security measures, storage, retention and recipients available under Clause 7.6. Relevant security findings must be evaluated and addressed as required for appropriate Article 32 protection, with measures reviewed against the nature and risks of the Customer's processing. The Customer must inform Motivs of material workflow risks, including sensitive-data restrictions, so those can be addressed before processing.

Changes to the agreed measures must be documented and agreed with the Customer where they change the processing instructions or protections; they must not reduce the required level of protection or alter the Commission Clauses. No security certification or guaranteed penetration-testing programme is represented.

9. Rights-request assistance and data accuracy

Motivs must promptly forward requests concerning Customer-controlled data to the Customer and must not respond on its own unless authorized by the Customer, without prejudice to a binding legal requirement. The Customer decides the request's legal validity and response.

Through team@motivs.ai and authorized operational/support channels, Motivs must assist in locating relevant organization, workflow, file, database and log records; providing access or supported export; applying documented correction, restriction or deletion instructions; and recording relevant actions. The scope depends on the nature of processing and technical possibility, without removing the Commission-Clause obligation. Verification must use the least intrusive information reasonably sufficient to establish requester identity and Customer authority. Motivs must inform the Customer without delay if it becomes aware that instructed personal data is inaccurate or outdated.

10. Security, DPIA and prior-consultation assistance

Taking account of the processing and information available, Motivs must provide the Customer with relevant descriptions of data flows, categories, disclosed metadata, hosting/backup functions, safeguards, subprocessors and lifecycle controls. It must provide reasonable technical and operational assistance for the Customer's security assessment, DPIA and prior consultation, including relevant security findings and explanations of mitigation measures.

The Customer retains controller accountability and the decision whether a DPIA or consultation is required. Assistance is not general legal advice, a guarantee of lawful Customer use or a transfer of controller responsibility.

11. Personal-data-breach response information

Motivs must notify the Customer without undue delay after becoming aware of a breach affecting Customer Data and cooperate under Clause 9. Initial and supplemental notices must provide, to the extent available:

• the nature of the breach, affected systems/processing, categories and approximate numbers of affected data subjects and personal-data records;
• known timing of the event and discovery;
• likely consequences and containment, remediation and mitigation measures taken or proposed;
• relevant available facts to support the Customer's assessment and any authority/data-subject communications; and
• the contact point at team@motivs.ai for further information.

Unavailable information may follow in phases without undue delay. Motivs must preserve relevant evidence securely and cooperate with the Customer's lawful instructions. No fixed-hour notification limit, complete initial forensic report or admission of fault is required by this Annex.

12. Compliance information and audits

Motivs must respond promptly and adequately to relevant Customer inquiries and provide the information necessary to demonstrate compliance. Existing relevant documentation or reports may be considered first where appropriate, but are not a substitute for the Customer's audit rights.

The Customer may audit itself or appoint an independent auditor, including appropriate premises/facilities inspections, under Clause 7.6. The parties must cooperate on reasonable notice where appropriate, confidentiality, protection of other Customers' data and avoidance of unnecessary disruption. Those arrangements must not prevent a necessary audit, dictate the Customer's auditor or scope, or limit supervisory-authority powers. Motivs must address established non-compliance under the Commission Clauses.

Subprocessor contracts must impose the relevant same data-protection obligations in substance, including security and assistance for rights requests, breach information, DPIAs/consultation, deletion/return and compliance audits for the processing allocated to them. Copies and amendments must be available as required by Clause 7.7, with permitted redactions. Motivs remains responsible for their performance.

Annex IV — List of Sub-Processors

Not applicable to the selected general written authorisation under Clause 7.7(a). The agreed list for that option is in the separate Schedule 1 below; this formal Commission Annex is not completed as a specific-authorisation list.

Schedule 1 — Current Agreed Subprocessors

1. Processor-chain services

The following provider services perform the processor-chain functions described below.

2. Agreed list and authorization

This DPA and Schedule 1 constitute the agreed list of current subprocessors. The Customer authorizes the listed subprocessors by entering into this DPA.

Motivs must keep Schedule 1 accurate and current through the general-authorization procedure in Part A4 and Clause 7.7. Motivs must ensure the required downstream contract is binding; public availability of a provider DPA or transfer mechanism is not evidence of its application to the Motivs account.

3. Scope exclusions

Website-only delivery, fonts and marketing analytics providers are not authorized for Customer Data processing merely by appearing in the Privacy Policy. Google Workspace is included only for the Customer-instructed processor activities stated above. Ordinary Motivs corporate email processing for its own purposes remains outside this DPA; using email generally does not convert that processing into Customer-instructed processing. Any additional correspondence provider processing Customer Data on Motivs' behalf must first be identified and authorized under Clause 7.7.

Customer-connected Anthropic/OpenAI accounts are governed by Annex II's role allocation and are not automatically included. Historical or legacy providers are not authorized as current subprocessors by this schedule. No provider may be engaged for additional Customer Data processing without the applicable authorization and safeguards.