Data Processing Addendum

Last updated: October 2, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Bosque Technologies Inc. ("Bosque", "we", "us") and the customer that owns the workspace ("Customer", "you"). It applies when Bosque processes Personal Data in the hosted Service on Customer's behalf. It is accepted automatically when Customer accepts the Terms. If Customer needs a signed copy, email hello@bosque.cc.

It does not apply to self-hosted Bosque, where we do not process any data.

1. Definitions

• "Applicable Data Protection Law" means the data protection and privacy laws that apply to the processing, including, where applicable, the EU GDPR, the UK GDPR, the Swiss FADP, the California Consumer Privacy Act as amended (CCPA), and Canadian privacy laws such as PIPEDA and applicable provincial laws.
• "Personal Data", "controller", "processor", "process", "data subject", and "supervisory authority" have the meanings given in Applicable Data Protection Law. "Service Provider" has the meaning in the CCPA.
• "Customer Personal Data" means Personal Data in Customer Content that we process on Customer's behalf.
• "Subprocessor" means a third party that we engage to process Customer Personal Data.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in our possession or control.
• Other capitalized terms have the meanings in the Terms.

2. Roles

Customer is the controller (or a processor acting for its own controller) of Customer Personal Data. Bosque is the processor (or subprocessor) and, for the CCPA, a service provider. Each party will comply with the laws that apply to it.

Bosque is an independent controller for the Personal Data it handles to run its business, such as account and billing information. The Privacy Policy covers that.

3. Details of the processing

4. Customer's instructions

We process Customer Personal Data only on Customer's documented instructions. The Terms, this DPA, and Customer's use and configuration of the Service are Customer's complete instructions. We will tell Customer if we believe an instruction breaches Applicable Data Protection Law, and we may pause the processing until the instruction is changed or confirmed. We will not process Customer Personal Data for any other purpose, including our own, except as the law requires, in which case we will tell Customer first unless the law prohibits it.

As a service provider, we do not sell or share Customer Personal Data, retain, use, or disclose it outside our direct business relationship with Customer or for any purpose other than the business purposes in this DPA, or combine it with personal data from other sources, except as the CCPA allows.

Customer is responsible for the lawfulness, accuracy, quality, and content of Customer Personal Data; having a lawful basis for the processing; giving all notices and obtaining all consents; configuring and using the Service appropriately; and ensuring that its instructions comply with Applicable Data Protection Law. Customer will not instruct us to process prohibited data or in a way that violates the Terms or Applicable Data Protection Law.

5. Confidentiality

We make sure that people we authorize to process Customer Personal Data are bound by confidentiality duties, and we give access only to those who need it to provide the Service.

6. Security

We implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, taking into account the risk. These include, at least:

• Access control. Authentication through a dedicated identity provider; role-based access within workspaces; separation of each workspace's data enforced by the application back end; access by our personnel limited to what they need and logged where possible.
• Encryption. Encryption in transit for connections to the Service; encryption at rest provided by our infrastructure providers.
• Scoped access tokens. Agent (MCP) access tokens that are limited in scope, can be revoked, are rate-limited, and are logged.
• Secrets management. Credentials and keys kept as protected configuration values and not in source code.
• Logging and monitoring. Logs of access and of significant events, and monitoring for errors and abuse.
• Resilience. Backups and recovery capabilities provided by our infrastructure providers.
• Development practices. Review of changes, dependency updates, and a process for reporting and fixing vulnerabilities.
• Subprocessor diligence. Review of providers' security before we engage them.

We may update these measures to reflect technical development, provider changes, and evolving risks, provided that we do not materially reduce the overall level of protection during the applicable subscription term. No security measure eliminates all risk, and this Section is not a warranty that a Security Incident will never occur.

7. Subprocessors

General authorization. Customer authorizes us to engage the Subprocessors listed at https://bosque.cc/subprocessors.

Obligations. We will have a written agreement with each Subprocessor containing data protection obligations no less protective than this DPA, and we remain responsible for their performance.

Changes. We will update the list and give Customer advance notice, where reasonably practicable, before a new or replacement Subprocessor starts processing Customer Personal Data. Notice may be sent to workspace administrators or those who have asked to be notified. Customer may object promptly on reasonable data-protection grounds by writing to hello@bosque.cc. We will consider the objection in good faith. If we cannot provide the affected Service without that Subprocessor or a commercially reasonable alternative, Customer may terminate the affected Service and receive a refund of prepaid fees allocable to the period after termination, as its sole contractual remedy.

8. International transfers

Customer authorizes us to process and transfer Customer Personal Data to the countries where we and our Subprocessors operate. Where Applicable Data Protection Law requires a transfer mechanism for transfers of Customer Personal Data out of the EEA, the UK, or Switzerland, then:

• the EU Standard Contractual Clauses (Module Two, controller to processor, or Module Three, processor to processor) are incorporated into this DPA, with optional clauses selected as follows: Clause 7 (docking) applies, Clause 9(a) option 2 (general authorization) applies with the notice process in Section 7, Clause 11 optional language does not apply, Clause 17 is governed by the law of Ireland, and Clause 18 the courts of Ireland
• the UK International Data Transfer Addendum is incorporated, with the tables completed from this DPA
• for Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss FADP

For purposes of the SCCs:

• Annex I.A (parties): Customer is the data exporter, with the name, address, contact details, and activities associated with its Bosque account or order; Bosque is the data importer, with the identity and contact details in Section 15. Each party is a controller or processor as described in Section 2. Acceptance of the Terms constitutes signature of the SCCs.
• Annex I.B (transfer): the categories of data subjects, categories of Personal Data, sensitive data restrictions, nature and purpose, and duration are in Section 3. Transfers occur continuously or as initiated by Customer's use of the Service. Retention is described in Section 11. No special-category or highly sensitive data is intended or permitted except as expressly allowed by the Acceptable Use Policy and agreed in writing; Customer must apply suitable safeguards before submitting it.
• Annex I.C (authority): the competent supervisory authority is determined under Clause 13 of the SCCs.
• Annex II (security): the technical and organizational measures are in Section 6.
• Annex III (subprocessors): the authorized Subprocessors and their functions are listed on the Subprocessors page linked in Section 7.

For the UK Addendum, the parties and key contacts are those in Annex I.A; the selected SCC Modules and clauses are those stated above; the Appendix Information is supplied by Annexes I through III; and either party may end the Addendum as permitted by its mandatory Part 2. If a transfer mechanism is replaced or invalidated, the parties will cooperate on an alternative lawful mechanism.

9. Assistance

Taking into account the nature of the processing, we will help Customer to meet its obligations to respond to requests from data subjects, and to carry out data protection impact assessments and consult regulators, in each case where Customer can't do so by using the Service. If we receive a request directly from a data subject about Customer Personal Data, we will tell the person to contact Customer and will not respond except as Customer instructs or the law requires. We may charge reasonable fees for assistance that goes beyond what is normal for the Service.

10. Security Incidents

We will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, to the extent known at the time, the nature of the incident, the data concerned, the likely consequences, and the measures taken or proposed. Information may be provided in phases as it becomes available. Unsuccessful attempts or events that do not compromise Customer Personal Data, including scans, pings, failed login attempts, and denial-of-service attacks, are not Security Incidents requiring notice. We will take reasonable steps to contain and remediate the incident and provide further material information as reasonably available. Our notice is not an admission of fault or liability. Customer is responsible for deciding whether and how to notify regulators, data subjects, or others, except where law assigns that duty to us.

11. Return and deletion

Customer should export Customer Personal Data it needs before the Terms end. On termination and on Customer's documented choice, we will return available Customer Personal Data through the Service's ordinary export functionality or delete it; if Customer gives no instruction, we may delete it. We may delete data from active systems after termination and from backups through ordinary backup-rotation processes. If law requires us to keep data, we will protect it and process it only as the law requires. A post-termination export is not guaranteed unless separately agreed in writing.

12. Audits and information

We will give Customer the information reasonably needed to show that we comply with this DPA and Applicable Data Protection Law, such as written answers to reasonable security questionnaires and relevant documentation from our providers. Customer must first use that information. If it is not enough to meet Customer's obligations under law, we will allow one audit by Customer or an independent auditor bound by confidentiality, no more than once per year unless a regulator or a Security Incident requires more. Audits require at least 30 days' notice, must occur in business hours, must be limited to systems and records relevant to Customer Personal Data, and must not disrupt operations or compromise other customers, security, privilege, or confidential information. Customer bears the audit's costs and will reimburse our reasonable time and expenses unless the audit identifies a material breach by us. Audit findings are our Confidential Information.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, which apply to this DPA and the Terms together. Nothing limits liability that cannot be limited by law, or either party's liability to data subjects under the SCCs.

14. General

This DPA is effective for as long as we process Customer Personal Data. If it conflicts with the Terms, this DPA controls for the processing of Customer Personal Data. If it conflicts with the SCCs, the SCCs control. It is governed by the law that governs the Terms, except where the SCCs or Applicable Data Protection Law require another law.

Customer affiliates may use the Service under Customer's account, but no affiliate becomes a separate party to this DPA unless we agree in writing. Customer is responsible for its affiliates and will exercise all rights under this DPA on their behalf. Data subjects and regulators retain any rights the law gives them, but otherwise this DPA creates no third-party beneficiary rights.

15. Contact

Bosque Technologies Inc. Vancouver, British Columbia, Canada Email: hello@bosque.cc