Valuation and sample processing terms

These valuation and sample processing terms are between:

[the holder], of [its address] (the Holder, which may be a company or an individual: clause 2.7), as controller; and

O-mega Enterprise, Inc (address: 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States), trading as AIData.Broker (https://aidata.broker) (we, us, our), as processor,

each a Party.

1. What these terms cover

1.1 These terms apply to all Counts and Samples the Holder sends us, including those sent before it signed in or accepted these terms, whether before or after a Mandate is accepted, and to everything we derive from them.

1.2 They are the contract required by Article 28(3) of Regulation (EU) 2016/679, and of that Regulation as it applies in the United Kingdom where relevant (the GDPR); the service provider contract required by the California Consumer Privacy Act of 2018, as amended (the CCPA); and the equivalent contract under any other data protection law that applies to the Holder Data (together, Data Protection Law). Terms defined in the GDPR, such as personal data, processing, controller, processor, sub-processor and personal data breach, have the same meaning here.

1.3 Valuing the Holder's records binds the Holder only to these terms. A Mandate, and the NDA with it, bind only once the Holder accepts them in the Portal.

2. Definitions

2.1 Counts: the figures our valuation produces from the Holder's exports on the Holder's own computer and that the Holder releases to us: counts, shares and month-level dates; the systems and file types they were read from; one-way codes of file names and sizes, so that the same export is recognised when it is measured again; and, where the exports include mailboxes or e-invoices, the few internet domains the mailboxes use most and the company names that appear most as issuer or buyer on the e-invoices, each with its count. Counts contain no names of people, postal addresses, user ids, channel names, file names, subjects or message text, other than those domains and company names; a company name that reads as a person's name is removed on the Holder's computer before it is counted. People who wrote records are counted through a one-way code that stays on the Holder's computer.

2.2 Sample: a small part of the Holder's records that the Holder de-identifies and sends us, in a text format we accept, so that its content can be measured.

2.3 Measurements: the figures we compute from a Sample, such as the number of records and words, the shares of duplicates, of linked records and of records that state a reason, the share in English and the number of identifiers found by type, together with the de-identification report the Holder's computer produced (counts, and the names of the table columns it tested) and the Holder's confirmation and its time. Measurements contain no other text from the Sample.

2.4 Holder Data: Counts, Samples and Measurements. Other information the Holder gives us, such as its answers in the valuation, the Rights File, the Datasheet and the documents it adds for verification, is protected by the NDA, and we handle the personal data in it as our Privacy Policy at https://aidata.broker/legal/privacy describes.

2.5 Valuation: our valuation of the Holder's records, held in the Portal.

2.6 NDA: the mutual non-disclosure agreement between the Parties. Mandate: a sale mandate between the Parties for the Holder's records. Buyer and Benchmark Use have the meanings given in the NDA. Portal: the Holder's workspace at https://aidata.broker.

2.7 The Holder may be a company or other organisation, or an individual who holds its records in its own right. Where the Holder is an individual, the person who accepts these terms is the Holder itself.

3. Roles and instructions

3.1 The Holder is the controller of any personal data in the Holder Data and decides why and how it is processed. We process it as the Holder's processor.

3.2 We process Holder Data only on the Holder's documented instructions, including with regard to transfers of personal data to a third country. These terms, the Holder's written instructions, and the actions the Holder takes in the valuation and the Portal (running the valuation, releasing Counts, sending a Sample, deleting a Valuation where the Portal allows it), are those instructions. If the law requires us to process Holder Data otherwise, we tell the Holder before doing so, unless the law forbids it.

3.3 We tell the Holder at once if, in our opinion, an instruction infringes Data Protection Law.

3.4 Where a law exempts a person that processes data on behalf of, and at the direction of, a business (including chapter 509 of the Texas Business and Commerce Code), we process Holder Data only on behalf of, and at the direction of, the Holder, in order to perform a service for it.

4. Particulars of the processing

4.1 Subject matter: measuring the Holder's records so that they can be valued and, under a Mandate, described to Buyers.

4.2 Duration: for Counts and Measurements, from receipt until the Holder deletes the Valuation, or until 30 days after the Holder asks us in writing to delete or return them or these terms end; for the text of a Sample, only the time needed to check and measure it on receipt.

4.3 Nature: receiving, checking for identifiers, measuring, storing Counts and Measurements, reading them with our AI systems to prepare the Valuation and the Datasheet, showing them to the Holder, describing them to approved Buyers under a Mandate, and deleting.

4.4 Purpose: valuing the Holder's records for the Holder and, where a Mandate is in force, preparing their sale for the Holder.

4.5 Types of personal data: none is intended. Counts are designed to contain none, but a domain or company name in them may identify a person who trades alone or under their own name. A Sample is meant to be de-identified, but may still contain personal data that the de-identification missed, or information that identifies a person indirectly or through its context, including work written by an identifiable person.

4.6 Categories of data subjects: people who appear in, or wrote, the Holder's records, such as its staff and contractors, its customers and suppliers, and their contacts.

4.7 The Holder's obligations and rights are those of a controller under Data Protection Law and these terms.

5. How a Sample is handled

5.1 Before a Sample is sent, our de-identification tool looks for identifiers in it on the Holder's computer, and we look again when the Sample arrives. Neither check counts the words the Holder chose to keep, such as its own company and product names. If identifiers are found at either point, the Sample is refused, and nothing from it is kept other than a log line recording the refusal, the number and size of the files and the number of identifiers found by type.

5.2 If the Sample passes, we measure it by automated code and keep the Measurements with the Valuation. The text of the Sample is discarded when the request that carried it ends; no person reads it, and it is not shown or sent to a Buyer or anyone else.

5.3 We accept as a Sample only files in the text formats the sample step lists, and refuse images, audio, video, PDFs and office files. The Holder will not include images, audio, video, PDFs, office files, or recordings or pictures of people, in a Sample, including as attachments inside an email file.

6. Our obligations as processor

6.1 Confidentiality. Everyone we authorise to process Holder Data is bound by a duty of confidentiality, and only the people we appoint as operators of our service can open it.

6.2 Security. We keep technical and organisational measures appropriate to the risk, as Article 32 GDPR requires, taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of the processing. They include at least: encryption of Holder Data in transit and, by our database provider, at rest; access limited by database row rules to the people signed in for the Holder and our operators; the handling of Samples described in clause 5; and the measures described at https://aidata.broker/de-identification.

6.3 Sub-processors. The Holder authorises these sub-processors: Founden (the platform this service runs on), Render Services, Inc. (hosting for the platform), Vercel Inc. (hosting), Neon (database), Resend (email delivery) and Anthropic PBC (the AI models our operator runs on, through Founden). Our Privacy Policy at https://aidata.broker/legal/privacy states where each of them processes data. We tell the Holder in writing, by email to the signer, at least 14 days before we add or replace a sub-processor. The Holder may object on reasonable data protection grounds within that time; if we cannot resolve the objection, the Holder may end these terms, and have its Holder Data deleted or returned, without charge. Each sub-processor processes Holder Data under its own written contract terms, and we remain responsible to the Holder for its performance.

6.4 Assistance. Taking into account the nature of the processing, we help the Holder, by appropriate technical and organisational measures where possible, to answer requests from people exercising their rights under Data Protection Law, and to meet its obligations under Articles 32 to 36 GDPR (security, notification of breaches, impact assessments and prior consultation), taking into account the information available to us.

6.5 Breach notice. We tell the Holder without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Holder Data, or of unauthorised access to or disclosure of other Holder Data, with the information the Holder needs to meet its own obligations as it becomes available, and we take reasonable steps to contain it.

6.6 Deletion and return. The text of a Sample is discarded under clause 5.2. Counts and Measurements are kept with the Valuation. When the Holder deletes the Valuation in the Portal, where the Portal allows it, they are deleted with it. When the Holder asks us in writing to delete or return them, or these terms end, we return them to the Holder or delete them, at the Holder's choice, within 30 days, and confirm this in writing. This does not cover copies the law requires us to keep, or copies in automatic backups until they are overwritten in the ordinary course (which we do not restore for use), and aggregates already made under Benchmark Use that cannot be linked back to the Holder.

6.7 Information and audit. We make available to the Holder all information necessary to demonstrate compliance with Article 28 GDPR and these terms, and allow for and contribute to audits, including inspections, by the Holder or an auditor it mandates who is bound by confidentiality, on 30 days' notice, not more than once a year unless a breach or a supervisory authority requires otherwise, at the Holder's cost. We meet this first by giving the Holder, on request, our record of processing, our description of security measures and the data protection terms of our sub-processors' contracts; an audit or inspection follows where those do not suffice.

6.8 Records. We keep the record of processing activities that Article 30(2) GDPR requires, and give the Holder a copy of the part that concerns it on request.

7. The Holder's obligations and warranties

7.1 The Holder is responsible for having a lawful basis for its own processing, including de-identifying a Sample and sending it to us, and for giving any notice the people concerned are owed.

7.2 The Holder warrants that, before sending a Sample, it removed from it, or replaced with a role or a placeholder, everything in our de-identification checklist:

(a) Names of people: staff, customers, contacts, patients, applicants. Replace them with a role or a code (the customer, Engineer A, PERSON_1).

(b) Email addresses and phone numbers of people. Shared mailboxes such as support@ may stay.

(c) Postal addresses and precise locations of people.

(d) Customer, employee, account, case or order numbers that lead back to a person.

(e) Bank, card, tax and national identity numbers.

(f) IP addresses, device ids, user ids and chat handles.

(g) Passwords, API keys and access tokens.

(h) Anything about a person's health, finances, beliefs or private life.

7.3 The Holder warrants that no Sample contains health data, data about children, or biometric data (including voices, faces or fingerprints), and that no Sample contains protected health information as defined under the US Health Insurance Portability and Accountability Act of 1996. We are not the Holder's business associate under that Act and will not sign a business associate agreement.

7.4 The Holder warrants that it is allowed to share each Sample so that it can be valued, and that sharing it does not breach any contract or duty that binds the Holder.

7.5 The Holder will not send us personal data from its records in any other way than through the valuation, the Portal's forms and the verification documents the Portal asks for.

8. Limits on our use of Holder Data

8.1 We use Holder Data only to value the Holder's records, to describe them to Buyers for the Holder under a Mandate, and for the use in clause 8.4.

8.2 Data about the Holder's use of our service (such as the dates, times and duration of its activity, and its connections with Buyers) is used only to provide and develop our service and to keep the records the law requires, not to market to the Holder or anyone else, and we give the Holder a copy within 30 days of a request.

8.3 The tools we use to check, measure, convert or de-identify Holder Data are used only at the Holder's request, made by running the valuation or sending a Sample, and for no other purpose.

8.4 Benchmark Use of Counts and Measurements that are not personal data, on the conditions in clause 5 of the NDA, is part of developing our valuation service, and the Holder authorises it in writing by these terms until it withdraws that permission under clause 5.2 of the NDA. We make no Benchmark Use of anything that is personal data.

8.5 These limits follow the use restrictions of Article 12 of Regulation (EU) 2022/868 (the Data Governance Act) and apply whether or not that Regulation applies to our service. They are not a statement that it does.

9. CCPA service provider terms

9.1 Where the CCPA applies to personal information in Holder Data, we are the Holder's service provider, and the business purpose for which we process it is the purpose in clause 4.4. We will not:

(a) sell or share it;

(b) retain, use or disclose it for any purpose, including any commercial purpose, other than that business purpose, or as the CCPA otherwise permits a service provider;

(c) retain, use or disclose it outside the direct business relationship between us and the Holder; or

(d) combine it with personal information we receive from or on behalf of anyone else, or collect from our own interaction with consumers, except as the CCPA regulations permit a service provider.

9.2 We comply with the obligations the CCPA places on service providers and give that personal information the level of privacy protection the CCPA requires. We tell the Holder if we can no longer meet those obligations. The Holder may take reasonable and appropriate steps to ensure that we use the personal information consistently with its obligations under the CCPA, and to stop and remedy any unauthorised use.

9.3 We certify that we understand the restrictions in this clause and will comply with them.

10. No re-identification

10.1 We will not attempt to identify any person, including the Holder's staff, customers or anyone else described in its records, from Counts, Samples or Measurements, whether alone or combined with other information, and we will not help or allow anyone else to do so.

10.2 We keep and use de-identified Holder Data only in de-identified form, and we state this commitment publicly at https://aidata.broker.

10.3 We pass no information derived from Holder Data to anyone other than our sub-processors and, under the NDA, the Holder's approved Buyers, except aggregates made under Benchmark Use that cannot be linked back to the Holder. Every Buyer that receives de-identified information derived from Holder Data is bound, by the confidentiality undertaking in clause 4.1(b) of the NDA, to the commitments in this clause.

10.4 If any Holder Data turns out to identify a person, we delete the relevant part and tell the Holder.

11. International transfers

11.1 Where the Holder is established in, or Holder Data comes from, the European Economic Area, the United Kingdom or Switzerland, any personal data in Holder Data reaches us, and our sub-processors, in the United States. We receive it and pass it on only on the Holder's instructions and under a transfer mechanism recognised by Chapter V GDPR or the equivalent United Kingdom or Swiss law.

11.2 The transfer mechanism relied on, and the transfers it covers: the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), where personal data would leave the European Economic Area.

11.3 The Holder instructs us to make the transfers described in clause 11.2.

12. Duration and ending

12.1 These terms bind both Parties from when the Holder first releases Counts to us or sends us a Sample, as clause 13.5 describes, and the Holder may also accept them in the Portal. Either Party may end them by notice in writing, after which we delete or return Holder Data under clause 6.6.

12.2 Clauses 6, 8, 9, 10, 11 and 13 continue after these terms end, for as long as we hold any Holder Data or anything derived from it.

13. General

13.1 These terms, the NDA and any Mandate are read together. On personal data, and on how long Holder Data is kept and when it is deleted, these terms prevail.

13.2 Nothing in these terms limits either Party's liability to data subjects or to a supervisory authority under Data Protection Law.

13.3 A change to these terms is valid only in writing and accepted by both Parties; acceptance through the Portal counts. If Data Protection Law changes, we propose in writing the changes needed to comply with it; they take effect 30 days later unless the Holder objects in writing, in which case the Holder may end these terms without charge.

13.4 Notices go in writing to us at hello@aidata.broker or through the Portal, and to the Holder at [the account's confirmed email] or through the Portal, or to another address a Party gives in writing.

13.5 The Holder accepts these terms by releasing Counts to us or sending us a Sample through the valuation, or by accepting them in the Portal. At the same moment the Portal accepts for us, in our name, as our electronic agent, and its acceptance is ours. Where the Holder accepts in the Portal, the record of the acceptance is its evidence: the account it was given from and that account's confirmed email address, the date and time, the network address and browser it came from, the version and a fingerprint (SHA-256) of each text accepted, and the full name and role typed.

13.6 These terms are governed by the laws of the State of Delaware, United States, without regard to its conflict of laws principles, except where Data Protection Law requires a processor contract to be governed by another law. Disputes are decided exclusively by the state and federal courts located in the State of Delaware, United States.

Acceptance

Accepted for the Holder, [the holder]: by [the name typed when accepting], [the role typed when accepting] ([the account's confirmed email]), on [the day of acceptance].

Accepted for O-mega Enterprise, Inc: by the Portal, as our electronic agent, at the same moment.